- dovecot - dovecot.org

Splitting up packages
by Larry Rosenman 01 Feb '24

01 Feb '24

I'm the maintainer of the dovecot and pigeonhole ports on FreeBSD and am looking to make separate installable packages like the project does for Linux. Can you help me know what needs to go where and what options (if any) change the base? Thanks for any help here. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106 I'm the maintainer of the dovecot and pigeonhole ports on FreeBSD and am looking to make separate installable packages like the project does for Linux. Can you help me know what needs to go where and what options (if any) change the base? Thanks for any help here. -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

3 2

We couldn't drop root group privileges
by forumforeign 01 Feb '24

01 Feb '24

Hello. I have - dovecot 2.3.21 (also tried 2.3.5) - postfix 3.8.5 (also tried 3.8.4) It's a new setup where I use postfix + dovecot-delivery for delivery to local mailbox. At logs I have an error and mail deffers in queue: dovecot: [ID 702911 mail.crit] lda(poli(a)domain.com)<7808>: Fatal: We couldn't drop root group privileges (wanted=6(mail), gid=0(root), egid=0(root)) Postfix and dovecot start from root UID, but user dovecot/postfix has corresponding groups to run as specific group: root@solaris:# id -a dovecot uid=110(dovecot) gid=110(dovecot) groups=110(dovecot),6(mail) root@solaris:# id -a postfix uid=26(postfix) gid=26(postfix) groups=26(postfix),6(mail) root@solaris:# id -a root uid=0(root) gid=0(root) groups=0(root),1(other),2(bin),3(sys),4(adm),6(mail),7(tty),8(lp),12(daemon) Also, when I run a dtrace (a system call trace mechanism) I see, that dovecot-lda runs as group "mail" (gid=6), so, there isn't any problem, but dovecot thinks another: UID GID PID PPID ARGS 0 26 7719 7638 pipe -n dovecot -t unix flags=DRhu user=nobody:mail argv=/usr/libexec/dovecot/d 60001 6 7720 7718 /usr/libexec/dovecot/dovecot-lda -f mega(a)domain.com -d poli(a)domain.com 60001 6 7720 7718 /usr/bin/amd64/doveconf -f service=lda -c /etc/dovecot/dovecot.conf -m lda -e / 60001 6 7720 7718 /usr/libexec/dovecot/dovecot-lda -f mega(a)domain.com -d poli(a)domain.com What exactly dovecot wants and how to solve this error? Here is part of "dovecot -n" output which is corresponding to user/group/lda: # 2.3.5.1 (7ec6d0ade): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.6 (92dc263a) # OS: SunOS 5.11 i86pc # Hostname: solaris auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_process_limit = 99 disable_plaintext_auth = no first_valid_gid = 6 first_valid_uid = 60001 last_valid_gid = 6 last_valid_uid = 60001 mail_access_groups = mail mail_debug = yes mail_gid = 6 mail_location = /var/mail/vmail/%u@%d mail_max_userip_connections = 99 mail_privileged_group = mail mail_uid = 60001 maildir_very_dirty_syncs = yes ... service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ... protocol lda { mail_plugins = " sieve" postmaster_address = postmaster } PS. Also, I have aother box with very old setup (dovecot 2.2.27) and it works with the same configuration without any errors. I thought that this is OS specific problem and tried on the same version OS run a dovecot 2.3.21, but still had an errors.

1 1

Emails automatically thread by subject, no matter how old or unrelated
by wakod67943＠flexvio.com 01 Feb '24

01 Feb '24

To preface, I’m using the Crossbox mail client hosted by MXroute. I was directed to Dovecot support when I made my inquiry to the former’s developers. Apparently, when you write an email subject that is verbatim to another, previously sent email, the two become linked in a conversation thread. I could have an email from 1996 titled “Groceries” and if I make one today titled “Groceries” my inbox would have them connected as one long thread. I’m getting email threads in the 100s because of this. Crossbox people have told me it’s not something they have control over. They mentioned it being a Dovecot problem. Has anyone encountered this? It would be tremendously inconvenient to ensure that every email I ever send from now on has a unique subject so to as not have them threaded together. Let me be clear, email threading and conversation views are extremely useful. I just want them to be…relevant to the chain of emails that are being looked at. Is there a way to group threads by unique header information? It is becoming borderline unusable to sift through invoices.

3 2

JMAP support?
by Mark Constable 31 Jan '24

31 Jan '24

On Fri Jan 25 2019 Aki wrote: > There is no JMAP support in any dovecot version yet. Two years on so what is the status of JMAP support in Dovecot now?

7 10

doveadm sync failed after adding "mechanisms = plain login" to passdb
by James 31 Jan '24

31 Jan '24

Hello, After adding `mechanisms = plain login` to passdb (passwd-file), `doveadm -D sync -u e(a)example.com -d -N -l 30 -U` failed with ``` Jan 26 06:49:22 doveadm(e(a)example.com): Error: remote(server2.example.com:61526): doveadm(1.1.1.1,e(a)example.com): auth-master: passdb lookup(e(a)example.com): Auth PASS lookup failed Jan 26 06:49:22 doveadm(e(a)example.com): Error: remote(server2.example.com:61526): doveadm(1.1.1.1,e(a)example.com): /run/dovecot/auth-userdb: passdb lookup failed (to see if user is proxied, because doveadm_port is set) ``` With `auth_debug=yes`, I found these lines. ``` Jan 26 04:55:37 server2 dovecot: auth: Debug: skipping passdb: mechanism filtered Jan 26 04:55:37 server2 dovecot: auth: Error: All password databases were skipped ``` What should I do to fix it without deleting `mechanisms = plain login`? More information could be found on [this link](https://github.com/orgs/docker-mailserver/discussions/3836#discussion…. Thanks

1 0

Re: JMAP support?
by Marcel Schmidt 30 Jan '24

30 Jan '24

Hi, is there any progress on this? Since the IETF draft is long completed, will you integrate JMAP in a coming dovecot version or is this topic completely abandoned? Marcel Hi, is there any progress on this? Since the IETF draft is long completed, will you integrate JMAP in a coming dovecot version or is this topic completely abandoned? Marcel

1 0

One Way sync is deleting emails
by Steve Moser 30 Jan '24

30 Jan '24

Hello, I am hoping that you can help me. I am running this command on my main email server, one way backup/sync to the backup server. sudo doveadm sync -1 -A remote:root@x.x.x.x x.x.x.x is my remote server. I will add a new email on the main, run the command and it shows up on the backup. - Great! Now I delete that email from the main, run the command and the email is removed from the backup. That should not delete anything from the backup, correct? I prefer Not to delete anything, only update/add. Do you see what I am doing wrong? Thank You!!!! Here my installed versions dovecot-core 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-imapd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-lmtpd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-mysql 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-pop3d 1:2.3.16+dfsg1-3ubuntu2.2 postfix 3.6.4-1ubuntu1.2 amd64 High-performance mail transport agentpostfix-mysql 3.6.4-1ubuntu1.2 amd64 MySQL map support for Postfixpostfix-policyd-spf-python 2.9.3-1 all Postfix policy server for SPF checking Hello, I am hoping that you can help me. I am running this command on my main email server, one way backup/sync to the backup server. sudo doveadm sync -1 -A remote:root@x.x.x.x x.x.x.x is my remote server. I will add a new email on the main, run the command and it shows up on the backup. - Great! Now I delete that email from the main, run the command and the email is removed from the backup. That should not delete anything from the backup, correct? I prefer Not to delete anything, only update/add. Do you see what I am doing wrong? Thank You!!!! Here my installed versions dovecot-core 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-imapd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-lmtpd 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-mysql 1:2.3.16+dfsg1-3ubuntu2.2 dovecot-pop3d 1:2.3.16+dfsg1-3ubuntu2.2 postfix 3.6.4-1ubuntu1.2 amd64 High-performance mail transport agent postfix-mysql 3.6.4-1ubuntu1.2 amd64 MySQL map support for Postfix postfix-policyd-spf-python 2.9.3-1 all Postfix policy server for SPF checking

2 1

sieve filter generated email- sent folder
by joe a 29 Jan '24

29 Jan '24

dovecot 2.3.21 pigeonhole 0.5.21. Filters created via roundcube. Attempting to have filters detect certain email, send a notification text message to mobile via email, and copy that notification email to "Sent" folder. Filter(s) detect condition, move the email to desired folder and appear, as note in logs outside of dovecot, to sent the notification email. The notification email is not recorded in "Sent" folder and is not received by mobile device. Is this a "do-able" thing in dovecot/pigeonhole? If so, how? Docs available?

3 4

fts indexer stuck on very large plaintext messages
by p h 29 Jan '24

29 Jan '24

Hi, I recently fts indexed a users mailbox with xapian which had 10-15 very large plaintext messages (>20Mb). The content of these messages was mostly a list of all files on a linux server (tripwire and backup reports). The indexer-worker process was completely stuck processing these messages, cpu pegged at 100% running continuously for multiple days. I was wondering if there is way to avoid this issue. It would be great if I could configure limits for the fts indexing process.

2 1

shared mailbox replication
by micha＠micha.waw.pl 28 Jan '24

28 Jan '24

We use a shared mailbox, where incoming mails from customers are stored. Every user can see it as "shared/contact(a)domain.name". When a new message comes, any user who is currently available just takes the message and does something with it. It's configured this way: namespace shared { type = shared separator = / prefix = shared/%%u/ location = maildir:%%h/.maildir:LAYOUT=fs:INDEX=~/.shared/%%u subscriptions = no list = children } It worked perfectly until I set up replication. Now we have a mess, because a message moved/deleted on one server are replicated beck form another. This is known issue. The documentation says it clear: "Warning Shared folder replication doesn’t work correctly. Mainly it can generate a lot of duplicate emails. This is because there’s currently a per-user lock that prevents multiple dsyncs from working simultaneously on the same user. But with shared folders multiple users can be syncing the same folder. So this would need additional locks (e.g. shared folders would likely need to lock the owner user, and public folders would likely need a per-folder lock or maybe a global public folder lock). There are no plans to fix this." I understand "There are no plans to fix this." But... maybe there is a workaround? I am sure someone before me had already this problem... :-)

1 0

Tests fail 2.3.21 in aarch64 build
by Peter 28 Jan '24

28 Jan '24

Building Dovecot 2.3.21 for aarch64 (building with qemu emulation) I get the following in the test stage: test-file-cache.c:266: Assert failed: file_cache_set_size(cache, 1024) == -1 Panic: file test-common.c: line 211 (test_expect_error_string_n_times): assertion failed: (expected_errors == 0) test-common.c:245: Assert failed: suppress == TRUE Error: Raw backtrace: ./test-lib(+0x693f0) [0x7f10b36943f0] -> ./test-lib(+0x6d8e4) [0x7f10b36988e4] -> ./test-lib(+0x75110) [0x7f10b36a0110] -> ./test-lib(+0x75168) [0x7f10b36a0168] -> ./test-lib(+0x15534) [0x7f10b3640534] -> ./test-lib(+0x152ec) [0x7f10b36402ec] -> ./test-lib(+0x3411c) [0x7f10b365f11c] -> ./test-lib(+0x15e64) [0x7f10b3640e64] -> /lib64/libc.so.6(+0x2c79c) [0x40000087579c] -> /lib64/libc.so.6(__libc_start_main+0x98) [0x40000087586c] -> ./test-lib(+0x163f0) [0x7f10b36413f0] qemu: uncaught target signal 6 (Aborted) - core dumped I'll provide more info on request. Is this just an issue with the tests or is it an issue with Dovecot itself? Peter

1 0

Azure AD / Entra Id OAuth2 issue, username not recognized
by meint＠meint.net 26 Jan '24

26 Jan '24

Dovecot version 2.3.16 Trying to use Azure AD / Entra Id with OAuth2 authentication, I have most of it working but somehow Dovecot fails to map / recognize the username, hopefully somebody can point out what I'm doing wrong? Excerpt from log: Jan 26 09:13:20 localhost dovecot: auth: Debug: http-client: conn [2603:1026:3000:108::4]:443 [1]: Got 200 response for request [Req1: POST https://login.microsoftonline.com/79b065d9-761f-4b79-a5cb-71a452f452af/oaut…] OK (took 220 ms + 82 ms in queue) Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Password grant succeeded Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field token_type Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field scope Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field expires_in Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field ext_expires_in Jan 26 09:13:20 localhost dovecot: auth: Debug: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): Processing field access_token Jan 26 09:13:20 localhost dovecot: auth: Error: oauth2(test-external@secumailer.com,2a05:d018:ebe:d005:22b6:dc4b:41c6:7fec): oauth2 failed: Password grant failed: No username returned I'm using Resource Owner Password Grant flow. I have the following configured in conf.d/auth-oauth.conf.ext: passdb { driver = oauth2 mechanisms = plain args = /etc/dovecot/dovecot-oauth2.plain.conf.ext } I have the following configured in dovecot-oauth2.plain.conf.ext: grant_url = https://login.microsoftonline.com/<redacted>/oauth2/v2.0/token client_id = <redacted> client_secret = <redacted> username_attribute = email use_grant_password = yes scope = api://<redacted>/mail-relay debug = yes rawlog_dir = /tmp/oauth2 I have the following response from the oauth raw logs: out: 1706256800.309971 POST /<redacted>/oauth2/v2.0/token HTTP/1.1 1706256800.309971 Host: login.microsoftonline.com 1706256800.309971 Date: Fri, 26 Jan 2024 08:13:20 GMT 1706256800.309971 User-Agent: dovecot-oauth2-passdb/2.3.16 1706256800.309971 Content-Length: 255 1706256800.309971 Connection: Keep-Alive 1706256800.310013 Content-Type: application/x-www-form-urlencoded 1706256800.310018 1706256800.310056 grant_type=password&username=test-external(a)example.org&password=<redacted>&client_id=<redacted>&client_secret=<redacted>&scope=api:%2f%2f<redacted>%2fmail-relay in: 1706256800.530754 HTTP/1.1 200 OK 1706256800.530754 Cache-Control: no-store, no-cache 1706256800.530754 Pragma: no-cache 1706256800.530754 Content-Type: application/json; charset=utf-8 1706256800.530754 Expires: -1 1706256800.530754 Strict-Transport-Security: max-age=31536000; includeSubDomains 1706256800.530754 X-Content-Type-Options: nosniff 1706256800.530754 P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" 1706256800.530754 x-ms-request-id: 629ce7bf-a5e9-4655-9019-83690c8b4400 1706256800.530754 x-ms-ests-server: 2.1.17122.2 - SEC ProdSlices 1706256800.530754 X-XSS-Protection: 0 1706256800.530754 Set-Cookie: fpc=Am8EyNTmX2ZOkMLj2MB82W4gKLwwAQAAAJ9gRd0OAAAA; expires=Sun, 25-Feb-2024 08:13:20 GMT; path=/; secure; HttpOnly; SameSite=None 1706256800.530754 Set-Cookie: x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly 1706256800.530754 Set-Cookie: stsservicecookie=estsfd; path=/; secure; samesite=none; httponly 1706256800.530754 Date: Fri, 26 Jan 2024 08:13:20 GMT 1706256800.530754 Content-Length: 1979 1706256800.530754 1706256800.530754 {"token_type":"Bearer","scope":"api://<redacted>/mail-relay","expires_in":5296,"ext_expires_in":5296,"access_token":"eyJ0eX ...<redacted>"} If I inspect the access token I'm getting: { "aud": "<redacted>", "iss": "<redacted>", "iat": 1706256500, "nbf": 1706256500, "exp": 1706262097, "acr": "1", "aio": "ATQAy/8VAAAANgbkS6NmHL3yGyROhLM28ooLX57pCjHjp0TGtd7EjwgVZy/i2aEqfV6sxiHeGZ0N", "amr": [ "pwd" ], "appid": "<redacted>", "appidacr": "1", "email": "test-external(a)example.org", "ipaddr": "<redacted>", "login_hint": "<redacted>", "name": "test-external", "oid": "657401f0-c9f0-402c-af6f-9ef063e7a281", "preferred_username": "test-external(a)example.org", "rh": "0.ATEA2WWweR92eUuly3GkUvRSr08CZ45J3dRLnCQJZCVUYBcxAKo.", "scp": "mail-relay", "sub": "ST9owcQQN2e0tBsHiVjvR8SCdlfUR_114tJk4C2bRxg", "tid": "79b065d9-761f-4b79-a5cb-71a452f452af", "unique_name": "test-external(a)sexample.org", "upn": "test-external(a)example.org", "uti": "v-ecYumlVUaQGYNpDItEAA", "ver": "1.0" } The email attribute is present in the access token yet Dovecot doesnt appear to recognize it. What am I doing wrong?

2 3

Replication going away?
by Vladimir Mishonov 26 Jan '24

26 Jan '24

Hello everyone. Just saw this commit in the official Github repo: https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… Looking at the commit details, it appears that it completely removes the replication feature. I'm a bit perplexed by this change and am not sure what might be the justification for it. Personally, I find replication to be very useful, as it allows me to maintain a synchronized mirror of all of my mailboxes on my home server, for use as backup in case the primary server goes down for some reason. Perhaps there's some sort of replacement being planned for this feature? Or maybe the relevant code is simply going to be refactored to a plugin or external program, and there's nothing to worry about at all? In any case, I'd greatly appreciate if one of the developers could comment on this change. -- Kind regards, a concerned user of Dovecot (Vladimir)

34 66

Error activating filter set
by joe a 25 Jan '24

25 Jan '24

Some success creating and using filters, created via roundcube, but, when testing activate and deactivating filter sets, received an error. However, I can edit and add filters without apparent error, even "importing" from an existing filter set. var/log/dovecot-info.log shows, in part: ([%user] refers to the active dovecot user, whose account seems to operate perfectly, aside from filters). Obfuscated out of habit. Form is user(a)domain.com. "Jan 24 15:44:49 managesieve([%user])<23204><Pk9VIrcPfKx/AAAB>: Info: Failed to activate script `dovecot.orig': Internal error occurred. Refer to server log for more information. [2024-01-24 15:44:49]" It is unclear, among other things, what and where this "server log" is. tail -f /var/log/messages shows nothing during the various traipsing about in filters Not just foggy outdoors lately.

1 1

IMAP Sieve fileinto :create intermediate folders
by dovecot-4tg＠freakin.rocks 25 Jan '24

25 Jan '24

I apologize if this isn't the appropriate place for this question. Consider a Sieve script with this instruction: fileinto :create "folder 1.folder 2.folder 3"; That faithfully creates in Maildir the folder named '.folder 1.folder 2.folder 3'/ An IMAP Client shows this in tree format as: - folder 1 - - folder 2 - - - folder 3 But there isn't really a "folder 2". That is, there is no Maildir '.folder 1.folder 2' so what happens in the MUA is really subject to its coding. In Thunderbird, for example, 'folder 2' is grayed out. You can't subscribe to it or drop a file into that folder because it is disabled. With no mail actually targeted to that folder, that's generally not a problem, but Thunderbird does raise errors as it attempts to scan folders, correctly claiming that it can't access the folder because it doesn't exist. That's irritating to the user. So to the questions: 1) Is there anything in Dovecot or Pidgeonhole Sieve that might allow us to auto-create the missing intermediate folders? Maybe using a vnd.dovecot.* extension or some sieve capability? 2) Aside from being inelegant, is there anything wrong with a cron script that creates missing Maildir folders? While I am developer, I haven't yet looked into the proper way to create and configure folders user folders. 3) Would it be more appropriate to create a new extension, implementation of some RFC, Lua script, or some other type of plugin that might get triggered on a fileinto operation? Again, I haven't looked deeply in this direction and could use a few RTM references. 4) Might there already exist an external script or custom extension that does this? 5) Might this be a worthy enhancement request for Dovecot or Pidgeonhole Sieve? Thanks! Dovecot 2.3.7.2 / Pidgeonhole 0.5.7.2 / Ubuntu v20

1 0

lda or lmtp for sieve?
by Joe Acquisto 25 Jan '24

25 Jan '24

I noticed that many places in the documentation and in examples gleaned from the wilderness, refer to the LDA protocol when discussing sieve. The documentation also mentions that lmtp is preferred over lda, and seems to say in places that sieve will operate without issue in either case. Does it matter to sieve implementation if one uses only lmtp?

7 13

Can Dovecot use an MH data store?
by Steve Litt 25 Jan '24

25 Jan '24

Hi all, I know Dovecot can use a Maildir mail store and a Mailbox mail store. Can it also use an MH mail store? If so, is there a way of getting procmail to dump messages into the correct MH folder? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

1 0

Re: "Connection reset by peer" errors with Outlook
by Joseph Tam 24 Jan '24

24 Jan '24

From: Steve Dondley <s(a)dondley.com> > I have no idea what is triggering it for so many different users from legit > email addresses. Still investigating. But this appears to be a fail2ban > problem, not a dovecot problem. My logs are filled with failed authentication from Outlook clients. The clients seem to be trying different usernames (with/without domains), and maybe SSL/TLS flavours. My guess is Outlook is doing some autodiscovery/autoconfiguration thing, and occasionally hits the right combo and successfully authenticates. I'm not sure I would characterise this as a fail2ban problem. Fail2ban is doing what it says on the side of the tin: looking for repeated authentication failures, and blocking those that fail too many times. The real problem is Outlook fumble around for the correct settings, and mimicking a brute force attack. I've had great difficulty getting some Outlook clients to configure exactly the settings it should have (like excluding domain names from usernames). Try running his command line using Windows-R (not from cmd.exe). outlook.exe /PIM NoEmail This will avoid the auto-setup process that railroads you into frustration. MacOSX Mail app tries the same stuff, but at least you can turn that behaviour off and stop it from second guessing your settings. Joseph Tam <jtam.home(a)gmail.com>

2 1

Managesieve "config" unable to complete?
by joe a 24 Jan '24

24 Jan '24

What say we try this again, on a "blank slate"? Dovecot installed on OpenSuse Leap 15.5, from their supplied "dovecot23" package. That package claims to be Dovecot 2.3.21 and Pigeonhole 0.5.21 Unable to get managesieve to bind to port 4190. Output of dovecot -n attached. Various tools, including lsof, sockets, do not show 4190 in use. While grasping for/at straws, noticed this: ~: # lsof | grep manage config 19097 root mem REG 0,47 6896 257261 /usr/lib64/dovecot/modules/settings/libmanagesieve_settings.so config 19097 root mem REG 0,47 14696 257260 /usr/lib64/dovecot/modules/settings/libmanagesieve_login_settings.so Does that suggest an attempt to configure managesieve is unable to do so? What does it infer? Bad configuration? File ownership? File rights? Bug? Thanks for patience and forbearance

3 6

Strangeness in defining "protocols"
by joe a 24 Jan '24

24 Jan '24

Well, a strangeness to my view. Since this is an opensuse package and not the "lastest and greatest", not sure if I should post this here or "over there". It is a given that I may have, through some noobiness have bungled something early on that is causing this. I am prepared to accept the semi-public ritual shaming that may follow. All references to results mean per "dovecot -n". One can be assured that dovecot.conf was edited followed by "dovecot -n", then 20-managesieve.conf edited followed by "dovecot -n", for each "set". What happens is, it appears, that if one specifies or alters the "default" protocols in /etc/dovecot/dovecot.conf, any protocols subsequently defined, at least in /etc/dovecot/conf.d/20-managesieve.conf, are not honored. It does not seem to matter if it is specified as "protocols = sieve" or "protocols = $protocols sieve". Further, in /etc/dovecot/dovecot.conf, if one comments out "protocols", one finds protocols is not listed at all, unless there is a protocol defined later such as "sieve" in 20-managesieve.conf. if one lists "protocols = " then "protocols = " is listed even if a protocol is defined later such as "sieve" in 20-managesieve.conf of one lists "protocols = $protocols", nothing is listed, unless if: "protocols = sieve" is defined in 20-managesieve.conf, "protocols = sieve" is listed "protocols = $protocols sieve" is defined in 20-managesieve.conf - then "protocols = imap pop3 lmtp sieve" is listed. Again, all as shown by "dovecot -n" after editing each file(s). I hope this is useful in determining if there is a problem, and helps lead to a solution if one is warranted. I'll send this also to the openSuse list as a distinct email.

1 0

managesieve server not answering?
by Joe Acquisto 23 Jan '24

23 Jan '24

Trying to connect to managesieve server configured to port 4190. No go. Roundcube is configured (thunderbird apparently having nothing current), but selecting "Add Filter" (new since re-configured for managesieve) produces "unable to connect to server". Port 4190 does not seem to answer or be "bound" to anything. Telnet to 4190 produces "connection refused". A "one box" solution. If I had to guess, I would guess, operator error. Otherwise, things are looking up. But, I remember a movie that said never to do that . . .

6 32

Replication between three or more servers
by tomas.simonaitis＠gmail.com 23 Jan '24

23 Jan '24

Hi list members, documentation says "Replication works only between server pairs. If you have a large cluster, you need multiple independently functioning Dovecot backend pairs". Do I understant correctly, that in order to have replication between 3 servers, one would need to run 2 instances of dovecot on each server with (a bit) different configuration. e.g. Serv1: -- dovecot-1.conf .. plugin { mail_replica = tcps:Serv2:1234 } .. -- dovecot-2.conf .. plugin { mail_replica = tcps:Serv3:1234 } .. Serv2: -- dovecot-1.conf .. plugin { mail_replica = tcps:Serv1:1234 } .. -- dovecot-2.conf .. plugin { mail_replica = tcps:Serv3:1234 } .. etc. Won't two processes of dovecot in one machine (assuming local storage) conflict accessing same Maildirs? Thanks for any insights

1 0

doveadm http api not responding under load
by Achim Stahlberger 23 Jan '24

23 Jan '24

Hello, we see this problem when doveadm-server is under load. We enabled doveadm http api with this config: service doveadm { inet_listener { port = 50000 } inet_listener http { port = 50001 ssl = no } } When doveadm server receives at lot of connects on port 50000 the http service on port 50001 is not responding until load on port 50000 drops to zero. It seems like doveadm-server is prefering port 50000 over 50001. Looking into Recv-Q when http hangs Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port tcp LISTEN 129 128 0.0.0.0:50000 0.0.0.0:* tcp LISTEN 1 128 0.0.0.0:50001 0.0.0.0:* I used this script to produce load on port 50000 #!/bin/bash for i in {1..1000} do echo "124" | netcat localhost 50000 & done wait When this script is started it takes several seconds until a connect on port 50001 succeeds. We are using Dovecot version 2.3.20 (bdc808f24c). I think the problem is in src/lib/ioloop-epoll.c function io_loop_handler_run_internal. This might fix the problem (look for new variable rr): void io_loop_handler_run_internal(struct ioloop *ioloop) { struct ioloop_handler_context *ctx = ioloop->handler_context; struct epoll_event *events; const struct epoll_event *event; struct io_list *list; struct io_file *io; struct timeval tv; unsigned int events_count; int msecs, ret, i, j, k, rr; bool call; i_assert(ctx != NULL); /* get the time left for next timeout task */ msecs = io_loop_run_get_wait_time(ioloop, &tv); events = array_get_modifiable(&ctx->events, &events_count); if (ioloop->io_files != NULL && events_count > ctx->deleted_count) { ret = epoll_wait(ctx->epfd, events, events_count, msecs); if (ret < 0 && errno != EINTR) i_fatal("epoll_wait(): %m"); } else { /* no I/Os, but we should have some timeouts. just wait for them. */ i_assert(msecs >= 0); i_sleep_intr_msecs(msecs); ret = 0; } /* execute timeout handlers */ io_loop_handle_timeouts(ioloop); if (!ioloop->running) return; rr = ret>1 ? i_rand_limit(ret) : 0; for (k = 0; k < 2; k++) { for (i = (k==0 ? rr : 0); i < (k==0 ? ret : rr); i++) { /* io_loop_handle_add() may cause events array reallocation, so we have use array_idx() */ event = array_idx(&ctx->events, i); list = event->data.ptr; for (j = 0; j < IOLOOP_IOLIST_IOS_PER_FD; j++) { io = list->ios[j]; if (io == NULL) continue; call = FALSE; if ((event->events & (EPOLLHUP | EPOLLERR)) != 0) call = TRUE; else if ((io->io.condition & IO_READ) != 0) call = (event->events & EPOLLIN) != 0; else if ((io->io.condition & IO_WRITE) != 0) call = (event->events & EPOLLOUT) != 0; else if ((io->io.condition & IO_ERROR) != 0) call = (event->events & IO_EPOLL_ERROR) != 0; if (call) { io_loop_call_io(&io->io); if (!ioloop->running) return; } } } } } Thanks a lot. Achim https://www.tallence.com Folgt uns auf LinkedIn <https://www.linkedin.com/company/tallence-ag> // XING <https://www.xing.com/pages/tallenceag> // Twitter <https://twitter.com/tallence> // Instagram <https://www.instagram.com/tallence_ag/> // facebook <http://www.facebook.com/Tallence> Tallence AG // Sitz der Gesellschaft: Hamburg // Neue Gröningerstraße 13, 20457 Hamburg // Amtsgericht Hamburg HRB 142900 Vorstand: Frank Moll (Vorsitzender), Bernd Scherf // Aufsichtsrat: Wolf Ingomar Faecks (Vorsitzender) Die Speicherung und Verarbeitung personenbezogener Daten erfolgt entsprechend unserer Datenschutzhinweise. <https://www.tallence.com/datenschutzhinweise>

2 2

"Connection reset by peer" errors with Outlook
by Steve Dondley 23 Jan '24

23 Jan '24

I have a mail server using dovecot that has been running without issue for quite a couple of years now. It serves email for about 30 individuals. But since Jan 14th, users have been reporting spurious errors in MS Outlook: 316 Jan 21 00:38:12 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=783) failed: Connection reset by peer, session=<yVd4Hm4Pst12wSuN> 317 Jan 21 00:38:12 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<aKOAHm4PCOB2wSuN> 318 Jan 21 00:38:13 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=598) failed: Connection reset by peer, session=<9rWIHm4PtuF2wSuN> 319 Jan 21 00:38:13 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=677) failed: Connection reset by peer, session=<NsORHm4P9OJ2wSuN> 320 Jan 21 00:38:14 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=691) failed: Connection reset by peer, session=<AACaHm4PdOR2wSuN> 321 Jan 21 00:38:15 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=610) failed: Connection reset by peer, session=<G8umHm4P2OV2wSuN> 322 Jan 21 00:38:16 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=609) failed: Connection reset by peer, session=<qSy0Hm4PuOd2wSuN> 323 Jan 21 00:38:16 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=596) failed: Connection reset by peer, session=<W427Hm4PtOl2wSuN> 324 Jan 21 00:38:17 ip-172-30-0-131 dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=118.xxx.xxx.xxx, lip=172.30.0.131, TLS handshaking: read(size=596) failed: Connection reset by peer, session=<mu/JHm4Ptup2wSuN> Some characteristics of the problem that may offer a clue: * happening with multiple users, not just the same one * happens from different IP addresses. * happens about 3 to 5 times per day and the errors come in batches like above * MS Outlook error is: reported error (0x80042109): ‘Outlook cannot conect to your outgoing SMTP email server. If you continue to receive this message….blah blah blah I googled the error code but didn’t find anything particularly helpful. I’m running Debian bullseye, version 11.8.

4 7

Migrate Dovecot 2.0.16 (mbox) to Dovecot 2.3.16 (MaiDir) and preserve POP UIDs
by Barbara M. 21 Jan '24

21 Jan '24

Already done a first migration using imapsync Good result, but there is the POP3 UIDs problem. Searching online give a Tried to understand the instructions on: https://doc.dovecot.org/settings/plugin/pop3-migration-plugin/? with limited comprension results (the link in the page is to the old wiki). Searching online give more confusion ... I am obviouly interested to resync the INBOX with somethig that give to clients the old UIDs so they don't re-download all messages in the inbox as duplicates into their mailbox. I suppose I can do: doveadm -v expunge -u <username> mailbox INBOX all rm dovecot* in the Maildir folder doveadm force-resync -u <username> INBOX then use dsync to migrate the INBOX Here I need some hints to how setup it and wich syntax use. If useful I can copy or mount the /var/mail/ folder of the old server that contains the users INBOX to the new server. Thanks, B.

2 1

Re: Migrate Dovecot 2.0.16 (mbox) to Dovecot 2.3.16 (MaiDir) and preserve POP UIDs
by Joseph Tam 21 Jan '24

21 Jan '24

From: "Barbara M." <barbara(a)rfx.it> > I am obviouly interested to resync the INBOX with somethig that give to > clients the old UIDs so they don't re-download all messages in the inbox > as duplicates into their mailbox. When I mitigated away from qpopper, I configured protocol pop3 { ... pop3_reuse_xuidl = yes } Maybe that's of use to you? Joseph Tam <jtam.home(a)gmail.com>

1 0

Uncompress compressed messages in Maildir mailbox?
by achekalin＠lazurit.com 21 Jan '24

21 Jan '24

Some time ago I enabled compression on incoming messages, so LMTP delivered messages were compressed. Good idea in terms of disk space, but now I cannot uncompress any of these messages even when I need to! I was using this setting: plugins { zlib_save = lz4 } and now I can see this string at the beginning of each message file - "Dovecot-LZ4", so no other software can uncompress them for me. Please advise, how can I uncompress message file in Maildir mailbox when I need to access its contents directly?

4 5

master-users problem
by Barbara M. 20 Jan '24

20 Jan '24

I am trying to activate master-users as usual but seems in this case I am doing something wrong and I can't have it working. It is a Rocky Linux 9.x (in Proxmox CT), installed with virtualmin and using system users: # doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 6.5.11-4-pve x86_64 Rocky Linux release 9.3 (Blue Onyx) auth_master_user_separator = * auth_mechanisms = plain login disable_plaintext_auth = no first_valid_uid = 1000 mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes result_success = continue } passdb { driver = pam } protocols = imap pop3 ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } Any hints on what I am doing wrong and/or how to debug it? Thanks, B.

3 4

Forcing imap authentication failure for certain IP addresses
by Hippo Man 20 Jan '24

20 Jan '24

I'm running dovecot 2.3.18 under Debian 11. I want to do something that's a bit unusual: when IMAP connections are attempted from a few specific IP addresses, I want to force an IMAP authentication failure from those connections, no matter what user ID and password are specified. I know that I can use iptables to completely block imap access from those IP addresses to the IMAP ports. However, in these specific cases, I'd prefer that the connection goes through to dovecot, but for dovecot then to always generate authentication failures for those specific connections ... even if a valid user ID and password happen to be specified. Is there a way to do this in dovecot? Thank you very much in advance. -- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

2 1

Documentation flaw: man-page link.
by Ralph Corderoy 19 Jan '24

19 Jan '24

Hi, https://doc.dovecot.org/admin_manual/doveadm_mailbox_commands/ ends with The man-pages also contain good descriptions of doveadm commands. Man-pages can be accessed online at e.g. https://wiki.dovecot.org/Tools/Doveadm That wiki page says Our primary documentation is now at https://doc.dovecot.org, please update your links. But I was at https://doc.dovecot.org to start with and there is no obvious mention of man pages there. This needs tidying up to avoid the loop and ideally provide man pages. -- Cheers, Ralph.

3 3

post-login scripting
by Alex 19 Jan '24

19 Jan '24

Hi, I'm trying to determine the last login time for my IMAP users. Some systems use mbox while others are Maildir, but not sure that matters. I'd just like to touch a file similar to how it's done in this article, but it doesn't work for me. https://doc.dovecot.org/admin_manual/post_login_scripting/ I've followed the instructions explicitly - made the required changes to 10-master.conf and created a shell script in /usr/local/bin that touches a file in the user's home directory. However, the file doesn't get created/touched. I've enabled debugging and don't see any errors that might lead to what I'm doing wrong. It doesn't say explicitly in the article that the last-login script referenced in the article is actually the contents of the postlogin.sh script, but I'm assuming it is? When I put the following in my dovecot.conf instead of conf.d/10-auth.conf, it core dumps. I thought local changes should be made in dovecot.conf? service imap-login { executable = imap imap-postlogin inet_listener imap { port = 0 } inet_listener imaps { port = 993 } process_min_avail = 6 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/bin/postlogin.sh user = $default_internal_user } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 } } Hi, I'm trying to determine the last login time for my IMAP users. Some systems use mbox while others are Maildir, but not sure that matters. I'd just like to touch a file similar to how it's done in this article, but it doesn't work for me. https://doc.dovecot.org/admin_manual/post_login_scripting/ I've followed the instructions explicitly - made the required changes to 10- master.conf and created a shell script in /usr/local/bin that touches a file in the user's home directory. However, the file doesn't get created/touched. I've enabled debugging and don't see any errors that might lead to what I'm doing wrong. It doesn't say explicitly in the article that the last-login script referenced in the article is actually the contents of the postlogin.sh script, but I'm assuming it is? When I put the following in my dovecot.conf instead of conf.d/10-auth.conf, it core dumps. I thought local changes should be made in dovecot.conf? service imap-login { executable = imap imap-postlogin inet_listener imap { port = 0 } inet_listener imaps { port = 993 } process_min_avail = 6 service_count = 0 vsz_limit = 512 M } service imap-postlogin { executable = script-login /usr/local/bin/postlogin.sh user = $default_internal_user } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 } }

4 7

Re: What is the difference between BEFORE, SENTBEFORE, and SAVEDBEFORE?
by Joseph Tam 19 Jan '24

19 Jan '24

From: Paul Pace <paul(a)mostlybsd.com> > BEFORE date specification > Matches messages with an internal date before date > specification. > > SENTBEFORE date specification > Matches messages with a Date: header before date specification. > > SAVEDBEFORE date specification > Matches messages, which were saved before date specification. > > I am creating a cron job to purge old messages in Trash or Spam folders, > but I discovered using doveadm search queries using savedbefore that > somehow no message in any of the folders shows up with queries starting > at 5d, even though there are much older messages. I don't know exactly the answer to your query, but the semantics of each term may not be the problem. I had this exact problem a decade ago with my own trash purging script. If you dump the above values e.g. doveadm fetch -ftab -A 'mailbox date.received' mailbox Trash BEFORE 90d you may find that many of them have the same value, and what's more, the time coincides with the first time you queried for that value (i.e. when you ran the above doveadm fetch). I think these fields may not have cached values before you ask for it, then it gets instantiated the current timestamp when you do. If you do a fetch every day, you'll eventually reach 90d, and it will work forever more (+/- 1 day). Perhaps adding those fields into these settings is a more direct and better solution: https://doc.dovecot.org/configuration_manual/mail_cache_settings/ Joseph Tam <jtam.home(a)gmail.com>

1 1

What is the difference between BEFORE, SENTBEFORE, and SAVEDBEFORE?
by Paul Pace 19 Jan '24

19 Jan '24

In doveadm-search-query(7), it states: BEFORE date specification Matches messages with an internal date before date specification. SENTBEFORE date specification Matches messages with a Date: header before date specification. SAVEDBEFORE date specification Matches messages, which were saved before date specification. I am creating a cron job to purge old messages in Trash or Spam folders, but I discovered using doveadm search queries using savedbefore that somehow no message in any of the folders shows up with queries starting at 5d, even though there are much older messages. doveadm search mailbox Trash before 90d -A | wc -l 277 doveadm search mailbox Trash sentbefore 90d -A | wc -l 277 doveadm search mailbox Trash savedbefore 90d -A | wc -l 0 For my purpose, I'm not clear on the differences between the different queries and am wondering what will be the better option. Thank you, Paul

1 0

testing sieve/pigeonhole, auth errors
by Joe Acquisto 18 Jan '24

18 Jan '24

A small SOHO system, of installed perhaps a year. Seems to be working and wished to add pigeonhole/sieve. Per Pigeonhole/sieve troubleshooting in the docs, set on mail_debug = yes and this is what I see, upon launching Thunderbird as the client. Thought that "unknown user" and "permission denied" deserved attention before any other steps. Just the dialog for one user is pasted below. pid 475 is dovecot,vmail for dovecot imapd This is what I see for /proc/self/io blah #ll /proc/self/io -r-------- 1 root root 0 Jan 15 15:10 /proc/self/io Jan 15 14:53:35 auth-worker(22903): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam(me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<4>: passwd(me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22907, session=<RbZgXgEPUKbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: open(/proc/self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:35 auth-worker(22904): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam(me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<5>: passwd(me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22908, session=<d7VgXgEPTqbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: open(/proc/self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:36 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:36 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:37 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: UID 13710: Opened mail because: prefetch A small SOHO system, of installed perhaps a year. Seems to be working and wished to add pigeonhole/sieve. Per Pigeonhole/sieve troubleshooting in the docs, set on mail_debug = yes and this is what I see, upon launching Thunderbird as the client. Thought that "unknown user" and "permission denied" deserved attention before any other steps. Just the dialog for one user is pasted below. pid 475 is dovecot,vmail for dovecot imapd This is what I see for /proc/self/io blah # ll /proc/self/io -r-------- 1 root root 0 Jan 15 15:10 /proc/self/io Jan 15 14:53:35 auth-worker(22903): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam (me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<4>: passwd (me(a)here.com,192.168.11.166,<RbZgXgEPUKbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22907, session=<RbZgXgEPUKbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: open(/proc/ self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/ vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:35 auth-worker(22904): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<1>: pam (me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 auth-worker(22901): Info: conn unix:auth-worker (pid=22897,uid=475): auth-worker<5>: passwd (me(a)here.com,192.168.11.166,<d7VgXgEPTqbAqAum>): unknown user Jan 15 14:53:35 imap-login: Info: Login: user=<me(a)here.com>, method=PLAIN, rip=192.168.11.166, lip=192.168.0.225, mpid=22908, session=<d7VgXgEPTqbAqAum> Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Effective uid=100, gid=1000, home=/home/vmail/me(a)here.com Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: open(/proc/ self/io) failed: Permission denied Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/ Maildir Jan 15 14:53:35 imap(me(a)here.com)<22908><d7VgXgEPTqbAqAum>: Debug: maildir++: root=/home/vmail/me(a)here.com/Maildir, index=, indexpvt=, control=, inbox=/home/ vmail/joea@j4com puters.com/Maildir, alt= Jan 15 14:53:36 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:36 imap(me(a)here.com)<22907><RbZgXgEPUKbAqAum>: Debug: Mailbox INBOX: Mailbox opened Jan 15 14:53:37 imap(joea(a)acquisto-us.com)<22906><fwJdXgEPQKbAqAum>: Debug: Mailbox INBOX: UID 13710: Opened mail because: prefetch

3 4

Re: [EXT] Re: Dovecot imap-hibernate errors in 2.3.21
by Aki Tuomi 18 Jan '24

18 Jan '24

Can you send `doveconf -n`? I think it might be related to the separete user accounts somehow. Aki > On 18/01/2024 09:45 EET Lucas Rolff <lucas(a)lucasrolff.com> wrote: > > > SELinux runs in permissive mode on the system (so doesn't take action, and no violations are logged either), the OS specifically is Oracle Linux 8.9, the only main thing that differs from RHEL or eg rocky/almalinux is I use the newer oracle kernel they release, but shouldn't have any effect > > > The only "special" thing being that mail users are isolated on their own Linux user (a domain will result in a local Linux user being created), but that's about it. > There's nothing with eg virtualized file systems or anything like that, that would result in per user mount points as well > > > Sent from Outlook for iOS (https://aka.ms/o0ukef) > ------------------------------ > From: Aki Tuomi <aki.tuomi(a)open-xchange.com> > Sent: Thursday, January 18, 2024 8:37:07 AM > To: Lucas Rolff <lucas(a)lucasrolff.com>; dovecot(a)dovecot.org <dovecot(a)dovecot.org> > Subject: Re: Dovecot imap-hibernate errors in 2.3.21 > Did you check if maybe selinux is interfering here? I tested the 2.3.21-CE in a RHEL7 VM and hibernation seems to work there. > > Aki > > > On 17/01/2024 22:51 EET lucas(a)lucasrolff.com wrote: > > > > > > Thanks for your reply Aki! > > > > It doesn't seem to contain much more information sadly that points towards anything related to hibernate itself. > > "Debug: open(/proc/self/io) failed: Permission denied" being the main "thing" that seems a bit odd, but that also happens under 2.3.20 as well by the looks of it: > > > > ``` > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap-login: Login: user=<customer(a)example.com>, method=PLAIN, rip=193.36.xx.xx, lip=176.9.151.xxx, mpid=3631534, TLS, session=<JVYMV8gOq5vBJIOe> > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Loading modules from directory: /usr/lib64/dovecot > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib10_quota_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib11_imap_quota_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib20_fts_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib20_quota_clone_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib20_zlib_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Module loaded: /usr/lib64/dovecot/lib21_fts_solr_plugin.so > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Added userdb setting: mail=mdbox:~/mail/example.com/customer/ > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=10240M > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Effective uid=1098, gid=1098, home=/home/username/ > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Quota root: name=User quota backend=count args= > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Quota rule: root=User quota mailbox=* bytes=10737418240 messages=0 > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Quota grace: root=User quota bytes=1073741824 (10%) > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: dict(proxy): dict created (uri=proxy::sqlquota, base_dir=/run/dovecot) > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: open(/proc/self/io) failed: Permission denied > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=mdbox:~/mail/example.com/customer/ > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: fs: root=/home/username//mail/example.com/customer, index=, indexpvt=, control=, inbox=, alt= > > Jan 17 20:42:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping > > Jan 17 20:42:17 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:42:17 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:42:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:42:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:43:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:43:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:43:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:44:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:44:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:44:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:45:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:45:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:45:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > Jan 17 20:46:16 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Debug: Mailbox INBOX: Mailbox opened > > Jan 17 20:46:49 de-mail01 dovecot[3631433]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3631534,uid=1098): IMAP client fd not received > > Jan 17 20:46:49 de-mail01 dovecot[3631433]: imap(customer(a)example.com)<3631534><JVYMV8gOq5vBJIOe>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected > > ``` > > > > Best Regards, > > Lucas Rolff > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org >

1 0

Dovecot imap-hibernate errors in 2.3.21
by lucas＠lucasrolff.com 18 Jan '24

18 Jan '24

Hello, I recently upgraded a Dovecot install from 2.3.20 to 2.3.21 from the 2.3-latest repository ( http://repo.dovecot.org/ce-2.3-latest/rhel/$releasever/RPMS/$basearch ) However since then, I seem to be getting: Jan 13 01:08:32 mail01 dovecot[3646235]: imap-login: Login: user=<user(a)example.com>, method=PLAIN, rip=35.243.xxx.xxx, lip=176.9.xxx.xxx, mpid=3646265, TLS, session=<o9jJlMgOFzMj86dT> Jan 13 01:09:03 mail01 dovecot[3646235]: imap-hibernate: Error: conn unix:imap-hibernate (pid=3646265,uid=1010): IMAP client fd not received Jan 13 01:09:03 mail01 dovecot[3646235]: imap(user(a)example.com)<3646265><o9jJlMgOFzMj86dT>: Error: Couldn't hibernate imap client: /run/dovecot/imap-hibernate disconnected This seems to be the case for every email-account on the system. Related configs: 20-imap.conf: protocol imap { imap_hibernate_timeout = 30s imap_idle_notify_interval = 24 mins mail_plugins = $mail_plugins imap_quota quota_clone zlib fts fts_solr mail_max_userip_connections = 20 } 10-master.conf: service imap { # Most of the memory goes to mmap()ing files. You may need to increase this # limit if you have huge mailboxes. #vsz_limit = $default_vsz_limit unix_listener imap-master { user = $default_internal_user } extra_groups = $default_internal_group } service imap-hibernate { unix_listener imap-hibernate { mode = 0660 group = $default_internal_group } } 10-metrics.conf event_exporter log { format = json format_args = time-rfc3339 transport = log } metric hibernation_logging { exporter = log filter = event=imap_client_hibernated OR event=imap_client_unhibernated } socket: $ stat /run/dovecot/imap-hibernate File: /run/dovecot/imap-hibernate Size: 0 Blocks: 0 IO Block: 4096 socket Device: 19h/25d Inode: 48551407 Links: 1 Access: (0660/srw-rw----) Uid: ( 0/ root) Gid: ( 97/ dovecot) Context: system_u:object_r:dovecot_var_run_t:s0 Access: 2024-01-13 01:03:07.432084831 +0100 Modify: 2024-01-13 00:50:56.394662577 +0100 Change: 2024-01-13 00:50:56.394662577 +0100 Birth: - From the change log, I see the following: - imap-hibernate: If an IMAP client unhibernation timed out with "(version received)", the unhibernation could still have successfully finished later on and continued working normally. This was rather confusing, because imap-hibernate already logged that the client got disconnected. Avoid this by forcing the connection to shutdown on unhibernation timeout. By the looks of it, it seems hibernation never actually happens anymore as of the new version. Downgrading to version 2.3.20 again seems to make hibernation function again based on the event logs. In 2.3.21 I only see events being logged for `imap_client_hibernated` which matches the /run/dovecot/imap-hibernate disconnected: "error":"/run/dovecot/imap-hibernate disconnected" In 2.3.20 I get both imap_client_hibernated and imap_client_unhibernated events (that it happens and when idle_done is triggered). Thank you in advance!

2 3

Re: Multiple user attributes in LDAP userdb query strings
by Oucheou Hassan 17 Jan '24

17 Jan '24

Merci Merci

1 0

recipient delimiter option in dovecot
by André Rodier 17 Jan '24

17 Jan '24

Hello, all. Postfix allows me to configure multiple characters to be used as recipient delimiter. However, I don't see that in dovecot, it seems I can only use one character in recipient_delimiter ? Am I right ? Does dovecot would only let me use email+box(a)domain.com, or can I use other forms, for instance email~box(a)domain.com and email&box(a)domain.com ? Thanks. André -- 𝓐𝓡 - 𝐴𝑛𝑑𝑟𝑒 𝑅𝑜𝑑𝑖𝑒𝑟

2 1

Virtual folder with custom flags
by Kirill Korinsky 15 Jan '24

15 Jan '24

Greetings, I can't figure out how doesn it possible to create a virtual folder which contains mails which has falgs: \Flagged or any customers flag. For example I do have a test mail: mx2$ doas doveadm fetch -u kirill(a)korins.ky "mailbox flags" mailbox-guid fb9e821c7b778b658896000079e31c01 uid 67096 mailbox: Archive flags: \Flagged \Seen $NotJunk NotJunk $MailFlagBit0 $MailFlagBit2 Invoice mx2$ and virtual folder: mx2$ cat /etc/dovecot/virtual/Flagged/dovecot-virtual * -INBOX/Trash -INBOX/Trash/* -INBOX/Junk -INBOX/Junk/* flagged mx2$ If I unset flag \Flagged from that mail, it dissapear from the folder. So, how should I change definition to keep it here if it has user's specified flags like Invoice or ASAP or whatsoever? -- wbr, Kirill

2 1

Quota clone plugin - initial population of data
by John Fawcett 15 Jan '24

15 Jan '24

Hi while responding on a previous thread, I noticed in the documentation: https://doc.dovecot.org/configuration_manual/quota_clone_plugin/ "For example you might want to access everybody’s quota via Redis ... but you don’t store the Redis database permanently so it could become empty once in a while. " It aslo seems that the quota clone plugin propagates only quota changes. Putting both of these points together, you'll going to have missing quotas in redis if it is restarted. It will gradually get populated but only on basis of mailbox changes. Maybe there should be an initial load of all the quotas when dovecot starts, or could that be a performance issue? Maybe even doveadm quota recalc should propagate or contain an option to propage quotas so that even if it can't be done on dovecot startup, at least it can be done on demand by the administrator. John

1 0

ARM support
by Brad Koehn 15 Jan '24

15 Jan '24

Hey there, I was wondering if you’re planning to support ARM in your packages and/or Docker images. Right now I’m stuck on whatever ships with Debian for ARM64 architectures. Otherwise, suggestions how would I go about building them myself? In a modern build world, it’s fairly straightforward, especially with Docker to handle all the emulation. Thanks for such a great product! I’ve used Dovecot on my little server for over twenty years. — Brad Koehn Hey there, I was wondering if you’re planning to support ARM in your packages and/or Docker images. Right now I’m stuck on whatever ships with Debian for ARM64 architectures. Otherwise, suggestions how would I go about building them myself? In a modern build world, it’s fairly straightforward, especially with Docker to handle all the emulation. Thanks for such a great product! I’ve used Dovecot on my little server for over twenty years. — Brad Koehn

8 15

Custom map for quota
by Matt 15 Jan '24

15 Jan '24

Hi, I'm trying to setup quota with the following layout CREATE TABLE "domain" ( "id" INTEGER, "name" TEXT, "active" INTEGER DEFAULT 0, PRIMARY KEY("id"), UNIQUE("name") ) CREATE TABLE "address" ( "id" INTEGER, "localpart" TEXT NOT NULL, "domain_id" INTEGER NOT NULL, PRIMARY KEY("id"), UNIQUE("localpart","domain_id") ) CREATE TABLE "mailbox" ( "id" INTEGER, "address_id" INTEGER, "active" INTEGER DEFAULT 0, "password" TEXT, "quota_bytes" INTEGER DEFAULT 0, PRIMARY KEY("id") ) As I like to update the quota and I like to use a dict/map I'm not sure if I can update this following: map { pattern = priv/quota/storage table = maibox value_field = dummy fields { value_field = quota_bytes id = mailbox_id } mailbox_id will be queried using password_query using: "mailbox.id as mailbox_id" Using such map I hope to be able to use: SELECT quota_bytes FROM mailbox WHERE id = '$mailbox_id' INSERT INTO mailbox (quota_bytes) VALUES ('$value') ON DUPLICATE KEY UPDATE quota_bytes='$value' Can someone help me with this ? Hi, I'm trying to setup quota with the following layout CREATE TABLE "domain" ( "id" INTEGER, "name" TEXT, "active" INTEGER DEFAULT 0, PRIMARY KEY("id"), UNIQUE("name") ) CREATE TABLE "address" ( "id" INTEGER, "localpart" TEXT NOT NULL, "domain_id" INTEGER NOT NULL, PRIMARY KEY("id"), UNIQUE("localpart","domain_id") ) CREATE TABLE "mailbox" ( "id" INTEGER, "address_id" INTEGER, "active" INTEGER DEFAULT 0, "password" TEXT, "quota_bytes" INTEGER DEFAULT 0, PRIMARY KEY("id") ) As I like to update the quota and I like to use a dict/map I'm not sure if I can update this following: map { pattern = priv/quota/storage table = maibox value_field = dummy fields { value_field = quota_bytes id = mailbox_id } mailbox_id will be queried using password_query using: "mailbox.id as mailbox_id" Using such map I hope to be able to use: SELECT quota_bytes FROM mailbox WHERE id = '$mailbox_id' INSERT INTO mailbox (quota_bytes) VALUES ('$value') ON DUPLICATE KEY UPDATE quota_bytes='$value' Can someone help me with this ?

3 3

Panic: file index-search-result.c: line 132 (index_search_result_update_flags): assertion failed: (result->search_args->args == &search_arg)
by Markus Doits 14 Jan '24

14 Jan '24

Hello dovecot community, I hope you can help me with the following panic: --- Panic: file index-search-result.c: line 132 (index_search_result_update_flags): assertion failed: (result->search_args->args == &search_arg) Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x7f839a045846] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f839a045962] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d81b) [0x7f839a05281b] -> /usr/lib/dovecot/libdovecot.so.0(+0x10d8b7) [0x7f839a0528b7] -> /usr/lib/dovecot/libdovecot.so.0(+0x5e2e2) [0x7f8399fa32e2] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x518a4) [0x7f839a1768a4] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(virtual_storage_sync_init+0x274e) [0x7f8399ea4a9e] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x5c) [0x7f839a192f9c] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x39) [0x7f839a193039] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_get_status+0x37) [0x7f839a210467] -> /usr/lib/dovecot/modules/lib20_virtual_plugin.so(+0xc6c5) [0x7f8399e9f6c5] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x145e2) [0x7f8399ee65e2] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x10cb9) [0x7f8399f31cb9] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_get_status+0x64) [0x7f839a1935a4] -> dovecot/imap(imap_status_get+0x98) [0x55c63c180748] -> dovecot/imap(cmd_status+0x19e) [0x55c63c170a7e] -> dovecot/imap(command_exec+0xa4) [0x55c63c177444] -> dovecot/imap(+0x22392) [0x55c63c175392] -> dovecot/imap(+0x22444) [0x55c63c175444] -> dovecot/imap(client_handle_input+0x1bd) [0x55c63c17589d] -> dovecot/imap(client_input+0x74) [0x55c63c175e64] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f839a06903d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x7f839a06a7aa] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f839a0690e4] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f839a0692a0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f8399fd9ad7] -> dovecot/imap(main+0x570) [0x55c63c166d20] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f8399c29d90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f8399c29e40] -> dovecot/imap(_start+0x25) [0x55c63c166de5] Fatal: master: service(imap): child 793983 killed with signal 6 (core dumped) --- Happening on ubuntu 22.04, dovecot 2.3.21 from [this ubuntu ppa](https://launchpad.net/~patrickdk/+archive/ubuntu/production/+packages?… dovecot-core:amd64 1:2.3.21-0a~jammy dovecot-dev:amd64 1:2.3.21-0a~jammy dovecot-imapd:amd64 1:2.3.21-0a~jammy dovecot-ldap:amd64 1:2.3.21-0a~jammy dovecot-lmtpd:amd64 1:2.3.21-0a~jammy dovecot-sieve:amd64 1:2.3.21-0a~jammy dovecot-solr:amd64 1:2.3.21-0a~jammy --- I have this virtual mailbox configured: namespace { prefix = _/ separator = / location = virtual:~/Maildir/virtual:LAYOUT=maildir++:INDEX=~/Maildir/virtual } When I remove this mailbox, the error goes away - so it seems to be something with the virtual mailbox. As the fts provider I use [fts_flatcurve](https://slusarz.github.io/dovecot-fts-flatcurve), maybe this has something to do with it? Any help appreciated how to debug this further and maybe fix it. Thanks!

3 3

execute: /user/bin/checkpassword /user/libexec/dovecot/checkpassword-reply
by Steve Button 14 Jan '24

14 Jan '24

Hi, I have recently moved a dovecot installation from 2.2.36 on RHEL7.9 onto 2.3.20 on Amazon Linux 2023 and I'm now seeing the error message in the title relating to /usr/bin/checkpassword (which doesn't exist on either). This is a project that I've inherited, and I've never used dovecot previously. I've been searching around for a couple of days trying to figure this out. Running out of ideas. Here's a slightly redacted snippet from dovecot.log Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Performing passdb lookup Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): execute: /usr/bin/checkpassword /usr/libexec/dovecot/checkpassword-reply Jan 04 17:23:22 auth: Fatal: execv(/usr/bin/checkpassword) failed: No such file or directory Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Received input: Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): exit_status=84 Jan 04 17:23:22 auth: Error: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Child 106455 exited with status 84 Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Finished passdb lookup Jan 04 17:23:22 auth: Debug: auth(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Auth request finished Jan 04 17:23:24 auth: Debug: client passdb out: FAIL 1 user=redacted(a)redacted.redacted.local code=temp_fail Jan 04 17:23:24 imap-login: Info: Disconnected: Connection closed (auth service reported temporary failure): user=redacted(a)redacted.redacted.local, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<6uwL/SEOzpt/AAAB> Jan 04 17:23:24 auth: Debug: auth client connected (pid=106456) Jan 04 17:23:24 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R5kq/SEO0Jt/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39888 As part of the build process we overwrite the config files with ones which are presumably from a previous version. In particular there's an auth.conf file which contains :- !include auth-checkpassword.conf.ext and in turn that file contains the stanza :- passdb { driver = checkpassword args = /usr/bin/checkpassword } which is where I guess the problem lies. The thing is the config files are almost identical on both systems. Here's the dovecot -n output... [root@server dovecot]# dovecot -n # 2.3.20 (xyz675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.61-85.141.amzn2023.x86_64 x86_64 ext4 # Hostname: server...1a97d auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 0 listen = * log_path = /var/project/log/dovecot/dovecot.log mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail mbox_write_locks = fcntl passdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /usr/bin/checkpassword driver = checkpassword } protocols = imap service auth { unix_listener auth-userdb \{ group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } userdb { driver = prefetch } Hi, I have recently moved a dovecot installation from 2.2.36 on RHEL7.9 onto 2.3.20 on Amazon Linux 2023 and I'm now seeing the error message in the title relating to /usr/bin/checkpassword (which doesn't exist on either). This is a project that I've inherited, and I've never used dovecot previously. I've been searching around for a couple of days trying to figure this out. Running out of ideas. Here's a slightly redacted snippet from dovecot.log Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Performing passdb lookup Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): execute: /usr/ bin/checkpassword /usr/libexec/dovecot/checkpassword-reply Jan 04 17:23:22 auth: Fatal: execv(/usr/bin/checkpassword) failed: No such file or directory Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Received input: Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): exit_status=84 Jan 04 17:23:22 auth: Error: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Child 106455 exited with status 84 Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Finished passdb lookup Jan 04 17:23:22 auth: Debug: auth (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Auth request finished Jan 04 17:23:24 auth: Debug: client passdb out: FAIL 1 user=redacted(a)redacted.redacted.local code=temp_fail Jan 04 17:23:24 imap-login: Info: Disconnected: Connection closed (auth service reported temporary failure): user=redacted(a)redacted.redacted.local, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<6uwL/SEOzpt/AAAB> Jan 04 17:23:24 auth: Debug: auth client connected (pid=106456) Jan 04 17:23:24 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R5kq/SEO0Jt/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39888 As part of the build process we overwrite the config files with ones which are presumably from a previous version. In particular there's an auth.conf file which contains :- !include auth-checkpassword.conf.ext and in turn that file contains the stanza :- passdb { driver = checkpassword args = /usr/bin/checkpassword } which is where I guess the problem lies. The thing is the config files are almost identical on both systems. Here's the dovecot -n output... [root@server dovecot]# dovecot -n # 2.3.20 (xyz675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.61-85.141.amzn2023.x86_64 x86_64 ext4 # Hostname: server...1a97d auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 0 listen = * log_path = /var/project/log/dovecot/dovecot.log mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail mbox_write_locks = fcntl passdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /usr/bin/checkpassword driver = checkpassword } protocols = imap service auth { unix_listener auth-userdb \{ group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } userdb { driver = prefetch }

2 1

Unconfigurable 500 ms debounce on IMAP IDLE notifications
by Alex 14 Jan '24

14 Jan '24

Hello all, I have been investigating the reason for high end-to-end email delivery delay (>1 second to send a message to echo bot and receive a reply back) on a Postfix+Dovecot email server setup used to run the tests for Delta Chat core [1]. It appeared that most of the time was spent between the submission SMTP service accepting the mail for delivery and receiving an IDLE wakeup on the other side. Looking into the Dovecot source code, I found that all notifications from the storage to callbacks set up by IDLE are delayed by a debounce constant NOTIFY_DELAY_MSECS [2]. It appears to have been added in 2009 [3], but even before that Dovecot was only delivering notifications when a second-resolution timer is changed by at least 1, so IDLE notifications probably were delayed by half a second on average even before that. Commit message says "If the notification is done immediately, IDLE may not notice the change because it's not finished yet." This sounds like a workaround for some internal Dovecot bug. I have nevertheless tried to compile Dovecot with this constant reduced from 500 ms to 1 ms [4] and it resulted in exceptionally fast delivery without any problems caused to the Delta Chat core online test suite which is using this Postfix+Dovecot server accounts. We are running all the tests against this server and it appears to work fine. Round trip time for sending a message to an echo bot and receiving a reply back is reduced from 1.1 s to 0.2 s, which is easily visible in a chat app [5]. I wonder if this debounce delay was added as a workaround for an internal Dovecot bug or a client bug and is not necessary anymore. It does not seem to be useful for well-behaving clients because if necessary the client may debounce notifications on its side and postpone interrupting IDLE with "DONE". I would actually like to disable this delay completely on our server setup [6], as for chat it is common to receive multiple messages in a short period of time, e.g. when sending a message to a group and receiving multiple read receipts from currently active users. [1] https://github.com/deltachat/deltachat-core-rust/ [2] https://github.com/dovecot/core/blob/93a53a9d590f0220de28600f36a969cc38c314… [3] https://github.com/dovecot/core/commit/56fb5d09955b6097f77b341717fd9b70e9f1… [4] https://github.com/deltachat/chatmail/issues/72#issuecomment-1806645153 [5] https://delta.chat/assets/blog/nine-echo.mp4 [6] https://github.com/deltachat/chatmail Best regards, Alex

2 6

Lots of "dovecot: auth: Error: auth client 0 disconnected with 1 pending requests: EOF" errors in error.log
by Jay Sladojevic 14 Jan '24

14 Jan '24

I've recently upgraded to dovecot 2.3 and now my error.log is full of this message: dovecot: auth: Error: auth client 0 disconnected with 1 pending requests: EOF In earlier versions, this error was logged at a warning level. What is the rationale behind the elevation to error log level? May I suggest to revert this change? (fyi: the code in question is in /src/auth/auth-client-connection.c) static void auth_client_disconnected(struct auth_client_connection **_conn) { struct auth_client_connection *conn = *_conn; unsigned int request_count; int err; *_conn = NULL; if (conn->input->stream_errno != 0) err = conn->input->stream_errno; else if (conn->output->stream_errno != 0) err = conn->output->stream_errno; else err = 0; request_count = conn->request_handler == NULL ? 0 : auth_request_handler_get_request_count(conn->request_handler); if (request_count > 0) { e_error(conn->event, "auth client %u disconnected with %u " "pending requests: %s", conn->pid, request_count, err == 0 ? "EOF" : strerror(err)); } auth_client_connection_destroy(&conn); }

1 0

Redirects 550'd So why no SRS method
by Laura Steynes 05 Jan '24

05 Jan '24

Happy New Year! Now to Aki, Timo, Corr, why, when setting up mail forwarding, is sieve not automatically configuring rules for SRS, it has this ability for long time, yet dovecots sieve based forwarding just creates a plain old redirect "forward" resulting in,in 2024, 99% of forwarded emails getting rejected for failing SPF because it's not enabling the require or the rules needed for successful sender rewriting. Is this an oversight? and I suppose the bigger question is, when is it planned to be corrected to using SRS method? Happy New Year! Now to Aki, Timo, Corr, why, when setting up mail forwarding, is sieve not automatically configuring rules for SRS, it has this ability for long time, yet dovecots sieve based forwarding just creates a plain old redirect "forward" resulting in,in 2024, 99% of forwarded emails getting rejected for failing SPF because it's not enabling the require or the rules needed for successful sender rewriting. Is this an oversight? and I suppose the bigger question is, when is it planned to be corrected to using SRS method?

3 2

Piegonhole behaviour when redirect fails
by Aubry Jaquier 04 Jan '24

04 Jan '24

Hello, I noticed an unusual behavior of the implicit keep from pigeonhole when a redirect fails in a sieve script. For instance, with the sieve below, if the relay host is unavailable, dovecot will not accept the email and will respond with a tempfail. redirect "myaddress(a)domain.com"; stop; But if my sieve script has a fileinto inside (see the example below), dovecot will accept the message, copy the email in the INBOX and in the folder from the fileinto and write the following log "Execution of script filter.sieve failed, but implicit keep was successful" fileinto "Folder"; redirect "myaddress(a)domain.com"; stop; According to the RFC 5228, section 2.10.2 Implicit keep, the last example should not trigger an implicit keep but act like the first example. An implicit keep is performed if a message is not written to a mailbox, redirected to a new address, or explicitly thrown out. That is, if a fileinto, a keep, a redirect, or a discard is performed, an implicit keep is not. Does it look like a bug to you, or is this the intended behaviour ? Best regards, Aubry Hello, I noticed an unusual behavior of the implicit keep from pigeonhole when a redirect fails in a sieve script. For instance, with the sieve below, if the relay host is unavailable, dovecot will not accept the email and will respond with a tempfail. redirect "myaddress(a)domain.com"; stop; But if my sieve script has a fileinto inside (see the example below), dovecot will accept the message, copy the email in the INBOX and in the folder from the fileinto and write the following log "Execution of script filter.sieve failed, but implicit keep was successful" fileinto "Folder"; redirect "myaddress(a)domain.com"; stop; According to the RFC 5228, section 2.10.2 Implicit keep, the last example should not trigger an implicit keep but act like the first example. An implicit keep is performed if a message is not written to a mailbox, redirected to a new address, or explicitly thrown out. That is, if a fileinto, a keep, a redirect, or a discard is performed, an implicit keep is not. Does it look like a bug to you, or is this the intended behaviour ? Best regards, Aubry

2 1

Autocreate virtual users' home directory?
by John Fawcett 04 Jan '24

04 Jan '24

Hi I have recently rectified an old configuration error whereby I had virtual users' home and mail directories set to the same value. I used option 3 from "ways to set up home directory" https://doc.dovecot.org/configuration_manual/home_directories_for_virtual_u… so I have: home= |/var/vmail/domain/user/home/| mail= |/var/vmail/domain/user/| |where domain and user are substituted for the real domain and user.| For existing users where I created the home directory when migrating the settings, there is no issue. But I am seeing errors like this for new users: lmtp(test(a)example.com)<125035><EHDOAyS1lWVr6AEAjpgUYA>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/vmail/example.com/test@example.com/home//dovecot.au… failed: safe_mkstemp(/var/vmail/example.com/test@example.com/home//dovecot.autoexpu… failed: No such file or directory Seems that differently to mail directory which is automatically created, the home directory is not created. I couldn't see any config setting that would autocreate home directories (where home directories are subdirectories of mail directories). Would it be worthwhile introducing an autocreate option for home directories? John Hi I have recently rectified an old configuration error whereby I had virtual users' home and mail directories set to the same value. I used option 3 from "ways to set up home directory" https://doc.dovecot.org/configuration_manual/ home_directories_for_virtual_users/ so I have: home= /var/vmail/domain/user/home/ mail= /var/vmail/domain/user/ where domain and user are substituted for the real domain and user. For existing users where I created the home directory when migrating the settings, there is no issue. But I am seeing errors like this for new users: lmtp(test(a)example.com)<125035><EHDOAyS1lWVr6AEAjpgUYA>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/vmail/ example.com/test@example.com/home//dovecot.autoexpunge.lock) failed: safe_mkstemp(/var/vmail/example.com/test@example.com/home// dovecot.autoexpunge.lock) failed: No such file or directory Seems that differently to mail directory which is automatically created, the home directory is not created. I couldn't see any config setting that would autocreate home directories (where home directories are subdirectories of mail directories). Would it be worthwhile introducing an autocreate option for home directories? John

2 2

Solr/Tika patches for dovecot 2.3.21
by John Fawcett 03 Jan '24

03 Jan '24

Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John *dovecot-2.3.21-tika-http-auth.patch* Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika *dovecot-2.3.21-solr-max-size.patch * This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M *dovecot-2.3.21-solr-max-rows.patch * When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger. Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John dovecot-2.3.21-tika-http-auth.patch Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika dovecot-2.3.21-solr-max-size.patch This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M dovecot-2.3.21-solr-max-rows.patch When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger.

2 2

how to take mdbox extract of time interval and restore that again?
by lutz.niederer＠gmx.net 03 Jan '24

03 Jan '24

Hi! Due to a fatal hardware error we have to extract data of all existing imap accounts and all their boxes/folders etc. from an mdbox store starting with the 5th of december until today. Then we have to restore the old system and import the data back into it. Mail before 5th will come from the system backup, newer mail from that export. After that it may be possible that some/few mails may exist twice in the boxes, but that's ok. 1. What would be the command line for doveadm to extract everything starting the 5th? I find that the command line for doveadm is pretty complicated. I tried but I am not sure if I really got all mails exported. So I would like to ask if someone with much more experience can give me a command line that surely does what we want. The command will be run from a remote machine. 2. And what would be the command line to restore all the mails that we have exported back into the system? (The folder and account structure is the same.) 3. After that some of the mails may exist twice. Is that a problem, maybe because of internal IDs? 4. Are there any other things we need to be aware of when doing that? I thank you very much for your help! Cheers! -lutzn

2 1

Broken Docs
by Peter 02 Jan '24

02 Jan '24

The page: https://doc.dovecot.org/configuration_manual/protocols/lmtp_server/ ... has links to the old dovecot wiki which are now broken, specifically the Postfix and Exim links at the bottom of the page. Can someone please port those pages over to the docs and fix the links? Peter

2 1

Certificate of the documentation site (https://doc.dovecot.org/)
by gileh13242＠vasteron.com 02 Jan '24

02 Jan '24

Hey ! Your certificate expired today, I can't access it because of my business proxy :). [No Error] (TLS code: X509_V_ERR_CERT_HAS_EXPIRED) SSL Certificate expired on: Jan 2 06:31:02 2024 GMT Have a nice day !

2 1

A bug and a misleading description
by David Van Edwards 01 Jan '24

01 Jan '24

!. I have just tried deleting Sent messages and when I put the search string 1:200 in only one message was deleted. And when I put in 1:500 again only one message was deleted. In both cases a green message box came up saying the operation was successful. 2. I successfully deleted 1000 messages from my Inbox using the search string 1:1000 but it was not clear to me that this would delete the 1000 most RECENT emails, not as I imagined the FIRST 1000 emails counting from the beginning. Is that the case? It certainly seems to have been the result and it’s rather upsetting. Should your documentation make it clear whether 1:1000 is counting forwards or backwards? Best wishes, David David Van Edwards The Smokehouse 6 Whitwell Road, Norwich NR1 4HB 01603 629899 david(a)vanedwards.co.uk https://www.vanedwards.co.uk

2 1

Authentication failure due to address space limit
by Max Nikulin 26 Dec '23

26 Dec '23

Hi, I faced an error that appeared rather obscure at first, so I am trying to figure out if something can be improved. I have managed to solve the issue. I am running a Dovecot IMAP server to keep my personal mail archive. This server does not receive or send mail, just IMAP access. There was no reason to tune its performance, so its configuration is close to what Debian package has out of the box (actually doc/example-config). At certain moment I started to get authentication failures: dovecot[72165]: auth-worker: Error: fatal error: failed to reserve page summary memory dovecot[72165]: auth-worker: Error: dovecot[72165]: auth-worker: Error: runtime stack: dovecot[72165]: auth-worker: Error: runtime.throw({0x7f552c418194?, 0x7f552c1feb10?}) dovecot[72165]: auth-worker: Error: runtime/panic.go:1047 +0x5f fp=0x7f552c1feac0 sp=0x7f552c1fea90 pc=0x7f552c28a53f dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).sysInit(0x7f552c5f6fd0) dovecot[72165]: auth-worker: Error: runtime/mpagealloc_64bit.go:82 +0x195 fp=0x7f552c1feb48 sp=0x7f552c1feac0 pc=0x7f552c280ef5 dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).init(0x7f552c5f6fd0, 0x7f552c5f6fc0, 0x0?) dovecot[72165]: auth-worker: Error: runtime/mpagealloc.go:324 +0x70 fp=0x7f552c1feb70 sp=0x7f552c1feb48 pc=0x7f552c27eb50 dovecot[72165]: auth-worker: Error: runtime.(*mheap).init(0x7f552c5f6fc0) dovecot[72165]: auth-worker: Error: runtime/mheap.go:729 +0x13f fp=0x7f552c1feba8 sp=0x7f552c1feb70 pc=0x7f552c27bf5f dovecot[72165]: auth-worker: Error: runtime.mallocinit() dovecot[72165]: auth-worker: Error: runtime/malloc.go:407 +0xb2 fp=0x7f552c1febd0 sp=0x7f552c1feba8 pc=0x7f552c260e72 dovecot[72165]: auth-worker: Error: runtime.schedinit() dovecot[72165]: auth-worker: Error: runtime/proc.go:693 +0xab fp=0x7f552c1fec30 sp=0x7f552c1febd0 pc=0x7f552c28df0b dovecot[72165]: auth-worker: Error: runtime.rt0_go() dovecot[72165]: auth-worker: Error: runtime/asm_amd64.s:345 +0x120 fp=0x7f552c1fec38 sp=0x7f552c1fec30 pc=0x7f552c2b7c20 dovecot[72165]: auth: Error: auth-worker: Aborted PASSV request for mailuser: Worker process died unexpectedly dovecot[72165]: auth-worker: Fatal: master: service(auth-worker): child 72211 returned error 2 Such errors happen even for invalid users curl -v 'imap://bad:bad@localhost/' I have realized that it may be related to the pam_fscrypt plugin I had installed before. It is intended for another system user, so I did not expect any negative consequence on Dovecot. Disabling the module confirmed my guess. This PAM module is written in Go and language runtime requires almost 1G of address space (RLIMIT_AS) even when actual memory allocation is several times lower (the user has no configured login protector). https://github.com/golang/go/issues/38010 "runtime: high startup address space usage (RLIMIT_AS) on Linux AMD64" The code of the fscrypt PAM module has Go panic handlers, but this case error happens early during runtime initialization, so error handlers have not set yet and can not provide a more instructive error. I do not like that Go has no knobs like compile or link flags to prevent early allocation of rather large address space. At the same time I admit that doing garbage collection efficiently is tricky and unreasonable efforts may be required to allow modest address space at startup. Default Dovecot configuration has vsz_limit = $default_vsz_limit = 256M The following configuration snippet solves the issue: service auth-worker { # still crash, but later # vsz_limit = 800M vsz_limit = 1024M } I am realizing that my use case is rather specific. Mail and encrypted home directories are hardly compatible. However some other PAM modules may cause similar issues. Cgroup Linux kernel feature should allow to limit real memory usage and it should be better than per-process limits imposed on address space size. However assigning proper control groups for Dovecot processes may be not so trivial. I am unsure if auth-worker vsz_limit or default_vsz_limit should be raised in the example configuration. Do you think it is reasonable to add warnings concerning PAM plugins and vsz_limit to docs? I mean - https://doc.dovecot.org/configuration_manual/authentication/pam/ - https://doc.dovecot.org/configuration_manual/service_configuration/#auth-wo… in a similar way as it is done for Argon2 in https://doc.dovecot.org/configuration_manual/authentication/password_scheme… P.S. Debian 12 bookworm, Dovecot 1:2.3.19.1+dfsg1-2.1

2 4

Elevate Your Storytelling Experience with Start Motion Media
by petersthomas383＠gmail.com 19 Dec '23

19 Dec '23

Startmotionmedia.com Media, we specialize in crafting captivating visual narratives through expert video production services. Our dedicated team focuses on delivering compelling storytelling that resonates across diverse industries, creating impactful videos that leave a lasting impression. At Start Motion Media, our mission is to bring creativity to life. From conceptualization to production, we ensure each project reflects our commitment to excellence. Our portfolio showcases the artistry and skill behind Start Motion Media's captivating visual storytelling. Experience storytelling prowess firsthand by exploring <a href="https://www.startmotionmedia.com/can-web-development-be-a-side-hustle-for-s…">startmotionmedia</a>. Immerse yourself in our gallery of projects, witnessing the transformative power of visual narratives. Start Motion Media invites you to witness how storytelling unfolds through our lens, shaping brands and captivating audiences worldwide. For businesses seeking to amplify their narratives and engage audiences effectively, Start Motion Media is the answer. Harness the storytelling expertise of Start Motion Media to elevate your brand's story and make a lasting impact in the digital sphere.

1 0

Re-Enabling TLS1.1 in dovecot 2.3.16
by Nils 14 Dec '23

14 Dec '23

Hi, I'd like to re-enable TLS1.1 (at least temporary) to see if it fixes a problem with one of my clients. When I add "ssl_min_protocol = TLSv1.1" to either dovecot.conf or conf.d/10-ssl.conf it doesn't seem to have an effect. Still the client is not working. I used testssl.sh to check the available ssl versions and it says that tls1.1 is not offered: $ ./testssl.sh --starttls imap SERVERNAME.TLD:143 ... Service set: STARTTLS via IMAP Testing protocols via sockets SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final Kind regards, Nils

2 2

dovecot submission max line length
by Kees van Vloten 13 Dec '23

13 Dec '23

Hi all, After upgrading Debian Bullseye (Dovecot 2.3.13) to Bookworm (Dovcecot 2.3.19), submission-login returns an error on Kerberos authentication: "Client sent invalid command: Command line is too long". When I initially set this up on Bullseye I have seen the same issue, but adding "imap_max_line_length = 2M" solved it. Now with 2.3.19 kerberos authentication still works (with this setting) for imap connections but it stopped working for submission. Is there a new config setting for submission-login that I missed? Or is this a bug in 2.3.19? - Kees.

3 3

Username used by dovecot to access database certificate and key files
by John Fawcett 08 Dec '23

08 Dec '23

Hi does anyone happen to know the username under which dovecot accesses the certificate and key files when connecting to a mariadb database with ssl? I can't seem to get dovecot to read the files without a "other" readable bit set. I have dovecot users in mysql with the following connect string in dovecot-sql.conf.ext connect = host=x.x.x host=y.y.y host=z.z.z dbname=maildb user=mailuser password=xxxxxx \ ssl_ca=/etc/ssl/mysql/ca-cert.pem \ ssl_cert=/etc/ssl/mysql/client-cert.pem \ ssl_key=/etc/ssl/mysql/client-key.pem \ ssl_verify_server_cert=yes The certificate and key files in /etc/ssl/mysql/ are owned by root with group users: ls -l /etc/ssl/mysql total 12 -r--r--r--. 1 root root 2041 Jun 22 15:32 ca-cert.pem -r--r--r--. 1 root users 1907 Jun 22 15:32 client-cert.pem -r--r--r--. 1 root users 3272 Jun 22 15:32 client-key.pem For my test dovecot, dovenull and vmail are all members of group users: grep users /etc/group users:x:100:postfix,dovecot,dovenull,vmail If I remove the "other" readable attribute on the certificate and key files, dovecot complains it can't connect to the db server: auth: Error: mysql(x.x.x): Connect failed to database (maildb): TLS/SSL error: Permission denied (13) - waiting for 1 seconds before retry I realize it only adds marginal security to not have these files world readable, but still it is puzzling why dovecot cannot read them in that case. Can anyone see what I am missing? Thanks John

3 5

Unlocking Entertainment Excellence: Explore jGuru's Latest Netflix Series Guide
by Angelique Medina 08 Dec '23

08 Dec '23

Discover a digital haven at jgurucom, where entertainment expertise meets insightful curation. JGuru, a premier online destination, stands as a beacon for enthusiasts seeking the latest trends and in-depth knowledge. As a dynamic platform, jGuru transcends conventional boundaries, offering a plethora of resources for tech aficionados, gamers, and pop culture enthusiasts alike. Navigate through jGuru's diverse content to unearth gems like their comprehensive guide to the most anticipated Netflix series of 2022. Delve into the intricacies of storytelling, cinematography, and exclusive insights that make each series a must-watch. JGuru's commitment to excellence shines through in its meticulous coverage, establishing it as a go-to hub for all things entertainment. For an unparalleled experience, visit http://www.jguru.com/the-most-anticipated-netflix-series-2022/ – where entertainment aficionados converge to elevate their viewing journey. JGuru: Your Gateway to Entertainment Brilliance.

1 0

Compiler error
by Goetz Schultz 06 Dec '23

06 Dec '23

Hi, I have upgraded my system to FreeBSD14 and tried to recompile dovecot. The following error is thrown now (It did compile on FBSD13): <quote> test-mail-index-transaction-update.c:650:36: error: incompatible pointer to integer conversion passing 'char *(*)(int, int)' to parameter of type 'time_t' (aka 'long') [-Wint-conversion] mail_index_update_day_headers(t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ </quote> (t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ Is there a patch or something like that to compensate? -- Thanks and regards Goetz R Schultz ---------------->8---------------- Quis custodiet ipsos custodes? /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ ----------------8<---------------- ---------------------------->8------------------------------ /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ This message is transmitted on 100% recycled electrons. ---------------------------->8------------------------------ Unsigned message - no responsibillity that content is not altered

4 9

replicator: Panic: data stack: Out of memory when allocating 268435496 bytes
by Gerben Wierda 06 Dec '23

06 Dec '23

One step further in my quest to create a replacement mail server. I now have my old mail server (2.3.19.1, macOS + MacPorts) and my new (2.3.20, Alpine Linux, Docker, apk package). When I turn on replication it works, but, after a while I see: Jan 06 00:50:31 replicator: Panic: data stack: Out of memory when allocating 268435496 bytes Jan 06 00:50:32 replicator: Fatal: master: service(replicator): child 133 killed with signal 6 (core dumped) Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Sync failure: Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Remote sent invalid input: - I've removed synchronous operation for now (found a message on the net suggesting that) but is this known and what does it mean? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

6 15

Enhance Your Website Content: Logicsofts' Expert Tips
by Angelique Medina 04 Dec '23

04 Dec '23

Logicsofts, a leading web development company, is dedicated to empowering businesses through cutting-edge solutions. With a proven track record of creating visually appealing and functionally robust websites, Logicsofts stands out in the digital landscape. Their commitment to excellence extends to providing valuable insights through their blog. In a recent post https://www.logicsofts.co.uk/blog/how-to-write-website-content-rules-to-fol… , Logicsofts unravels the art of crafting compelling website content. The blog delves into essential rules for creating impactful content that resonates with your audience. Logicsofts emphasizes the significance of engaging and user-centric content to boost online presence and drive conversions. For businesses seeking to elevate their online game, Logicsofts' blog is a goldmine of practical advice. Implement the strategies outlined in the post to transform your website content and leave a lasting impression on your visitors. Explore the full article for a deep dive into the nuances of content creation - an invaluable resource for businesses striving to stay ahead in the digital realm.

1 0

auth_mechanisms per listener or local_name?
by Kees van Vloten 01 Dec '23

01 Dec '23

Hi all, I would like to use kerberos authentication on the local network but not for connections from internet, which are forwarded by haproxy. So both types of login can be distinguished by a different inet_listener and also a different by local_name. Is there a way to set auth_mechanisms such the it will impossible to use kerberos via haproxy connections or by filtering on local_name? - Kees.

1 0

client port int auth-worker log
by Joao Reis 29 Nov '23

29 Nov '23

Hello, Can the client's port number be included in the log entries generated by auth-worker, without needing to recompile Dovecot? Currently, the log entries look like this: |auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123): Password mismatch | I would like the log entries to appear as follows: |auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123,45343): Password mismatch | In this format, the client's port number (e.g., 45343) is also logged. thanks in advance. Hello, Can the client's port number be included in the log entries generated by auth- worker, without needing to recompile Dovecot? Currently, the log entries look like this: auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123): Password mismatch I would like the log entries to appear as follows: auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123,45343): Password mismatch In this format, the client's port number (e.g., 45343) is also logged. thanks in advance.

1 0

Re: Replication going away?
by Peter Wienemann 28 Nov '23

28 Nov '23

Hi, On 2023-11-28 16:20:56 +0100, gerben.wierda(a)rna.nl wrote: >From what version on is replication gone? I am running 2.3.20 and it still there. it will be gone from version 2.4/3.0 onward (see [0]). Best regards, Peter [0] https://doc.dovecot.org/3.0/installation_guide/upgrading/from-2.3-to-3.0

1 0

I've sent a question to dovecot@dovecot.org via mail. Why is it not ending up here?
by gerben.wierda＠rna.nl 28 Nov '23

28 Nov '23

This is what my postfix server says: Nov 28 14:23:12 albus postfix/qmgr[654]: 823D71CDE2714: from=<gerben.wierda(a)rna.nl>, size=9144, nrcpt=1 (que ue active) Nov 28 14:23:12 albus postfix/smtp[2294]: Untrusted TLS connection established to talvi.dovecot.org[94.237.1 05.223]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server -signature RSA-PSS (2048 bits) server-digest SHA256 Nov 28 14:23:13 albus postfix/smtp[2294]: 823D71CDE2714: to=<dovecot(a)dovecot.org>, relay=talvi.dovecot.org[9 4.237.105.223]:25, delay=2.1, delays=0.51/0.02/0.75/0.83, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as E5 C425DEEF) Nov 28 14:23:13 albus postfix/qmgr[654]: 823D71CDE2714: removed But I can't see it here nor do I get it sent back to me.

1 0

OT? Maybe so, maybe no.
by joe a 27 Nov '23

27 Nov '23

Dovecot installation on OpenSuse LEAP 15.5. Works fine via Thunderbird. Roundcube install works great. Astonishing given my rusting skills. But only until . . . I try to send email. Then RoundCube tells me smtp error(): connection to server failed. Well, yeah, 'you're trying port 587, when I told you to use port 25. Whatareya, dense?'. Nah, yer just a machine, must be me. Posted on Roundcube board, views but no replies. Perhaps someone here knows what else I need to change besides: ~etc/roundcubemail/config.inc.php //$config['smtp_port'] = 587; $config['smtp_port'] = 25; I don't find any other relevant referenced to SMTP port in RC configuration.

2 5

Couldn't get vsize Issue
by duluxoz 26 Nov '23

26 Nov '23

Hi All, Looking for a little help, please. We're getting the following showing up in our dovecot logs: `Debug: Mailbox Junk: Couldn't get vsize from mailbox list index: Record for vsize`. This is happening for all(?) the different mailboxes We're not sure what we're looking at or looking for to even begin the t/shoot. I dropped the above into google but couldn't *seem* to find anything relevant. Would someone(s) be able to point me in the right direction as to what the actual issue is (ie some more in-depth detail than just the log message - yes, it may be obvious to some but not to me) and, more importantly, what to look at to get it resolved, please. :-) Thanks in advance Dulux-Oz

3 4

Re: How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 26 Nov '23

26 Nov '23

I would like to avoid making a local deep copy first. This essentially doubles the required storage on the local disk and it also wears down the disk much faster as I will write gigabytes of data onto the disk every 24 hours. I would prefer an option which allows the backup program (Borg backup in my case) to only read the local data and send it to the remote backup space directly.

3 3

2 users who are the same user
by Michael Grant 26 Nov '23

26 Nov '23

I have been using system users (/etc/passwd). I recently started using, in addition, passwd-file with a separate dovecot password database so that I could have user@domainname users with a different password as their shell login password. This means I have dovecot authenticating on users in both /etc/passwd and /etc/dovecot/users. If I have a user in /etc/passwd, for example 'joe' and a user in /etc/dovecot/users, joe(a)example.org, and both of these users are in fact the same user but different password. They use the same inbox and the same mail files. Dovecot does not seem to like this very much. I am seeing many errors like this: Error: Mailbox INBOX: Sync failed for mbox: UID inserted in the middle of mailbox (4315358 > 4312144, seq=1, idx_msgs=3212) I think I'm causing this by having 2 users that are in fact the same user and dovecot is stepping on itself. Is it possible to tell Dovecot that these 2 users are in fact the same, as in like an alias user? Or is it possible to tell dovecot not to process mail for say for 'joe' the system user? Michael Grant

3 5

RE: How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 25 Nov '23

25 Nov '23

> Why would you want to do that? Afaik sdbox stores email per file. There is also an index file which stores meta attributes per mail/file and I want them to be consistent. > The mta just delivers the email later and your backup is already old. That's not really am argument. Just imagine the mail would have been sent some moment later after the backup has been started. In that case the mail wouldn't be in the backup either. A backup on a regular schedule for catastrophe recovery always has the "issue" that it will be old by half the time of the schedule on average in case one really needs it. Regarding snapshots on ZFS an similar file system: Not an option as I am using a shared hoster and the file system does not allow snapshots. Am 22. November 2023 21:46:19 schrieb Marc <Marc(a)f1-outsourcing.eu>: > Why would you want to do that? Afaik sdbox stores email per file. The mta > just delivers the email later and your backup is already old. Are you > making a snapshot and backup that, that is a very short time window. > >> >> I am using Dovecot sdbox format for mailboxes. Is there an option to >> temporarily make Dovecot read-only while the mailboxes are being backed-up >> such that a consistent state is backed-up? >> >> I am looking for some command which I can use as pre- and post-hook for >> Borgbackup. I am looking for a way such that Dovecot defers any mail coming >> in via LMTP from Postfix, denies modifying mails/mailboxes via IMAP while >> Dovecot still allows to browse mails read-only.

2 1

How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 24 Nov '23

24 Nov '23

Dear all, I am using Dovecot sdbox format for mailboxes. Is there an option to temporarily make Dovecot read-only while the mailboxes are being backed-up such that a consistent state is backed-up? I am looking for some command which I can use as pre- and post-hook for Borgbackup. I am looking for a way such that Dovecot defers any mail coming in via LMTP from Postfix, denies modifying mails/mailboxes via IMAP while Dovecot still allows to browse mails read-only. Is that possible? Bests, Matthias

2 1

Ouath2 compatible mail clients
by Francis Augusto Medeiros-Logeay 23 Nov '23

23 Nov '23

Hi, Are there any oauth2 compatible mail clients out there? For Mac/iOS? I see that Mail for Mac supports it, but just for Exchange. __ Francis Augusto Medeiros-Logeay Oslo, Norway Sent from a mobile device / Enviado a partir de dispositivo móvel Hi, Are there any oauth2 compatible mail clients out there? For Mac/iOS? I see that Mail for Mac supports it, but just for Exchange. __ Francis Augusto Medeiros-Logeay Oslo, Norway Sent from a mobile device / Enviado a partir de dispositivo móvel

1 0

[CFP] "Modern Email" Developer Room at FOSDEM '24
by Joris Baum 23 Nov '23

23 Nov '23

Hi, There will be a developer room that I think will be of particular interest for subscribers of this mailing list for "Modern Email" during FOSDEM '24. It will center around the current state of email, free/open source software projects related to email and current developments. FOSDEM is and event for free software and open source developers. The event encompasses two main streams: talks curated by organizers covering diverse topics and the developer rooms. Spread across multiple buildings at the venue, the developer rooms are focusing on specific concepts, technologies, and ideas. This is where the fun is. And most of the fun will obviously happen in the "Modern Email" room. The submission deadline for proposals is 1st December 2023. You can find more info on GitHub: https://github.com/modern-email/FOSDEM-24 . Regards, Joris Baum -- Joris Baum Tel: +49 721 170293 16 Fax: +49 721 170293 179 http://www.audriga.com | http://www.twitter.com/audriga -------------------------------------------------------------------------- audriga GmbH | Alter Schlachthof 57 | 76137 Karlsruhe Sitz der Gesellschaft: Karlsruhe - Amtsgericht Mannheim - HRB 713034 Geschäftsführer: Dr. Frank Dengler, Dr. Hans-Jörg Happel --------------------------------------------------------------------------

2 2

Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Michael Peddemors 21 Nov '23

21 Nov '23

There is a network claiming to be a security company, however the activity appears to be a little more malicious, and appears to be attempting buffer overflows against POP-SSL services.. (and other attacks). https://www.abuseipdb.com/check/104.156.155.21 Just thought it would be worth mentioning, you might want to keep an eye out for traffic from this company... Might want to make up your own mind, or maybe someone has more information, but enough of a red flag, that thought it warranted posting on the list. Not sure yet if it is Dovecot, or the SSL libraries they are attempting to break, but using a variety of SSL/TLS methods and connections... Anyone with more information? NetRange: 104.156.155.0 - 104.156.155.255 CIDR: 104.156.155.0/24 NetName: ACDRESEARCH NetHandle: NET-104-156-155-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Academy of Internet Research Limited Liability Company (AIRLL) RegDate: 2022-01-07 Updated: 2022-01-07 Ref: https://rdap.arin.net/registry/ip/104.156.155.0 OrgName: Academy of Internet Research Limited Liability Company OrgId: AIRLL Address: #A1- 5436 Address: 1110 Nuuanu Ave City: Honolulu StateProv: HI PostalCode: 96817 Country: US RegDate: 2021-10-15 Updated: 2022-11-06 Ref: https://rdap.arin.net/registry/entity/AIRLL -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company.

11 15

dovecot and oauth2 (with keycloak) not working
by Francis Augusto Medeiros-Logeay 20 Nov '23

20 Nov '23

Hi, I successfully configured Roundcube to use keycloak for oauth2. However, I am having trouble to make it work with dovecot. My configuration is this: cat dovecot-oauth2.conf.ext tokeninfo_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/userinfo introspection_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/token/intr… introspection_mode = post username_attribute = postfixMailAddress debug = yes scope = openid Roundcube_email This is what I am getting from the logs: Nov 20 08:20:30 auth: Error: ldap(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): ldap_bind() failed: Constraint violation Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host session created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: IPs have expired; need to refresh DNS lookup Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Performing asynchronous DNS lookup Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Submitted (requests left=1) Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: DNS lookup successful; got 1 IPs Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443 (shared): Peer created Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Peer pool created Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Peer created Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Setting up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) (1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Linked queue https://auth.mydomain.com:443 (1 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Started new connection to 10.10.100.10:443 (SSL=auth.mydomain.com) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Making new connection 1 of 1 (0 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connecting Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Waiting for connect (fd=23) to finish for max 0 msecs Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: HTTPS connection created (1 parallel connections exist) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Client connection failed (fd=23) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Connection failed (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Failed to make connection (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Failed to establish any connection within our peer pool: connect(10.10.100.10:443) failed: Connection refused (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) connect(10.10.100.10:443) failed: Connection refused (1 peers pending, 1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Unlinked queue https://auth.mydomain.com:443 (0 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up any connection; failing all queued requests Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Error: 9003 connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Dropping request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Nov 20 08:20:30 auth: Error: oauth2(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): oauth2 failed: connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Destroy (requests left=1) Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Free (requests left=0) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection close Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection disconnect Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Disconnected: connect() failed: Connection refused (fd=23) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Detached peer Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection destroy Nov 20 08:20:32 imap-login: Info: Disconnected (auth service reported temporary failure): user=<francis(a)mydomain.com>, method=XOAUTH2, rip=10.10.40.30, lip=172.18.0.10, TLS, session=<yskzUpAKb9EKCige> My dovecot version is 2.3.7.2 (3c910f64b). I find it odd that it is sending the token as a parameter, when I chose “post” as the introspection mode. But I don’t know if that is the problem. best, Francis

3 6

Avoiding POODLE vulnerability
by Steve Litt 20 Nov '23

20 Nov '23

Hi all, Ten years after the fact I learned about POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerabilities, which enable a poorly configured server to force my client to downgrade to vulnerable encryption. My current conf.d/10-ssl.conf contains the following line: ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL I've read that I should change the preceding line to the following: ssl_protocols = !SSLv3 !SSLv2 Is this correct? For some reason I have the same ssl_cipher_list in dovecot.conf. Should I make the change there too? Is there anything else I need to change? The following is my current dovecot.conf: ================================================= # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # OS: Linux 5.10.12_1 x86_64 # Hostname: mydesk.domain.cxm mail_location = maildir:~/mail/Maildir:INBOX=~/mail/Maildir/.INBOX namespace inbox { inbox = yes location = prefix = } passdb { driver = pam args = %s } userdb { driver = passwd } protocols = imap service imap-login { inet_listener imap { #port = 143 port = 0 } inet_listener imaps { port = 993 #port = 0 ssl = yes #ssl = no } } ssl = required #ssl = yes ssl_cert = </etc/ssl/dovecot_certs/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL ssl_key = </etc/ssl/dovecot_certs/private/dovecot.pem ================================================= By the way, does the preceding dovecot.conf even use the files in directories off conf.d ? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

3 8

passdb doesn't support credential lookups
by Michael Grant 20 Nov '23

20 Nov '23

I'm having trouble authenticating certain users. I see this in the logs: Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Performing passdb lookup Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): passdb doesn't support credential lookups Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Finished passdb lookup at the command line, if I run this: % doveadm auth login jane Password: passdb: jane auth succeeded Oddly, I have a handfull of users that are failing and others that are not and I don't see the difference.

1 0

Re: DMARC Failures for Mailing List
by dovecot＠x9p.org 18 Nov '23

18 Nov '23

On 11/17/23 10:38, Nick Lockheart wrote: > The DKIM check is also failing. I think the list software may be re-writing the > message bodies. I believe one of the reasons for the DKIM failure is this addition/configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send an email todovecot-leave(a)dovecot.org >>>>>>>> --x9p On 11/17/23 10:38, Nick Lockheart wrote: The DKIM check is also failing. I think the list software may be re- writing the message bodies. I believe one of the reasons for the DKIM failure is this addition/ configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org >>>>>>>> --x9p

1 0

DMARC Failures for Mailing List
by Nick Lockheart 18 Nov '23

18 Nov '23

Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re- writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message. Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re-writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message.

4 3

how to filter in doevecot/lmtp with sieve according to postfix orig_to value
by TSHIMANGA Minkoka 17 Nov '23

17 Nov '23

Dear All, I am managing an email infrastructure running with the below. Rocky Linux 8.7 (Green Obsidian) 4.18.0-425.3.1.el8.x86_64 postfix-3.5.8-4.el8.x86_64 dovecot-2.3.16-3.el8.x86_64 dovecot-pigeonhole-2.3.16-3.el8.x86_64 In reality there are more packages installed and configured. But I limited my enumeration above to what I think is relevant. I will be happy to provide more details if needed and/or requested. Here is my problem, or at least on what I need help/guidance/assistance. I have a virtual alias that forward emails to support(a)example.com to my inbox tshimanga.minkoka(a)example.com. That works fine as I can see those emails in my INBOX. And I want those emails to be moved in INBOX/support with a local sieve rule. For that I have the below that works. # rule:[support] if allof (header :is "to" "support(a)example.com") { fileinto :create "INBOX/support"; } The problem is that the above sieve rule seems not enough to catch email where support(a)example.com is not the "To" fields, as with cases of "Cc:" or "Bcc:". In the log of postfix, I can see lines with "... postfix/lmtp ... orig_to=<support(a)example.com> ...". The problem I am facing is that "orig_to" is not part of the headers postfix/lmtp (in reality dovecot/lmtp process) can see in order to apply on it a sieve rule. Any suggestions on how I can also sieve filter those emails ? Regards, Tshimanga

2 2

auth service over tls
by ibra 17 Nov '23

17 Nov '23

Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing? Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing?

4 5

Re: Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Joseph Tam 16 Nov '23

16 Nov '23

On Wed, 15 Nov 2023, 23:25 Michael Peddemors, <michael(a)linuxmagic.com> wrote: > Not sure yet if it is Dovecot, or the SSL libraries they are > attempting > to break, but using a variety of SSL/TLS methods and connections... > > They are not interested in dovecot per se. They scan for TLS vulnerabilities, > mostly. They're running comprehensive port scans, so they're targeting more than just SSL services. > OrgName: Academy of Internet Research Limited Liability > Company > OrgId: AIRLL > Address: #A1- 5436 > Address: 1110 Nuuanu Ave > City: Honolulu > StateProv: HI > PostalCode: 96817 > Country: US Out of business virtual offices, naturally. AIRLL also operating out of 195.96.137.0/24. Joseph Tam <jtam.home(a)gmail.com>

3 2

Re: auth service over tls
by ibra 16 Nov '23

16 Nov '23

I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: > > Are Postfix and Dovecot running on the same server? If so, you might be > better served by connecting with a UNIX socket rather than TCP. > > I'm not sure there is much security benefit to using TLS on the loopback > interface which is what was in your example from the previous email. > > And to clarify, Postfix supports TLS for authentication between an email > program like Thunderbird and the Postfix server, but does not support TLS > for the SASL AUTH *service* connection from Postfix to the AUTH provider > (Dovecot or Cyrus-SASL). > > Also, please use the group reply function so your email goes to the list, > this email only went to me. > > > On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: > > Good Morning, > thank you for your fast response, and sorry to not answer before, I forgot > to check spam folder. Good to know that postfix does not support SASL AUTH > over TLS, because actually I was planning to use it. > I started with Dovecot to check if auth port support tls. For that I > launched tls handshake using openssl, like this command: > $ openssl s_client -servername mail.sample.com -connect localhost:12345 > > But I got an error. (In summary Dovecot ends the connection). > Anyway, it would be awesome that in the future both Postfix and Dovecot > could support it. > > > On LMTP port, tls handshake worked in Dovecot side, now I have to > configure Postfix to make the request to dovecot LMTP over tls. > > With Postfix I was able to send data to Dovecot LMTP port, but was not > over TLS. Do you know what settings should I enable in Postfix side? > > Regards > Ibra. > > > On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> > wrote: > > On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: > > Hi, > I'm trying running tls connections for both auth and lmtp services. For > lmtp it is ok, for auth service I couldnt make it. I configure dovecot with > the next configuration in file "conf.d/10-myconfig.conf": > > > Which MTA are you trying to connect from? Postfix does not support SASL > AUTH over TLS, for example. > > > I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: Are Postfix and Dovecot running on the same server? If so, you might be better served by connecting with a UNIX socket rather than TCP. I'm not sure there is much security benefit to using TLS on the loopback interface which is what was in your example from the previous email. And to clarify, Postfix supports TLS for authentication between an email program like Thunderbird and the Postfix server, but does not support TLS for the SASL AUTH *service* connection from Postfix to the AUTH provider (Dovecot or Cyrus-SASL). Also, please use the group reply function so your email goes to the list, this email only went to me. On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: Good Morning, thank you for your fast response, and sorry to not answer before, I forgot to check spam folder. Good to know that postfix does not support SASL AUTH over TLS, because actually I was planning to use it. I started with Dovecot to check if auth port support tls. For that I launched tls handshake using openssl, like this command: $ openssl s_client -servername mail.sample.com -connect localhost:12345 But I got an error. (In summary Dovecot ends the connection). Anyway, it would be awesome that in the future both Postfix and Dovecot could support it. On LMTP port, tls handshake worked in Dovecot side, now I have to configure Postfix to make the request to dovecot LMTP over tls. With Postfix I was able to send data to Dovecot LMTP port, but was not over TLS. Do you know what settings should I enable in Postfix side? Regards Ibra. On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> wrote: On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/ 10-myconfig.conf": Which MTA are you trying to connect from? Postfix does not support SASL AUTH over TLS, for example.

1 0

Fwd: dovecot submission max line length
by Kees van Vloten 14 Nov '23

14 Nov '23

Op 14-11-2023 om 14:35 schreef Aki Tuomi: >> On 14/11/2023 14:59 EET Kees van Vloten <keesvanvloten(a)gmail.com> wrote: >> >> Hi all, >> >> >> After upgrading Debian Bullseye (Dovecot 2.3.13) to Bookworm (Dovcecot >> 2.3.19), submission-login returns an error on Kerberos authentication: >> "Client sent invalid command: Command line is too long". >> >> When I initially set this up on Bullseye I have seen the same issue, but >> adding "imap_max_line_length = 2M" solved it. >> >> Now with 2.3.19 kerberos authentication still works (with this setting) >> for imap connections but it stopped working for submission. >> >> Is there a new config setting for submission-login that I missed? Or is >> this a bug in 2.3.19? >> >> >> - Kees. >> >> > You are probably running into a client-side issue. SMTP RFC says that > all commands, including sasl ir, must be at most 998 bytes. Can you > check if the client is sending AUTH KERBEROS which is longer than 998 > lines? > > After AUTH KERBEROS you can send longer lines. The client has not changed. I have just upgraded the server from Bullseye to Bookworm, without configuration changes to Dovecot. The only change is version 2.3.13 to 2.3.19, that is why my first suspicion is that something changed in dovecot submission-login. The client is Thunderbird 102 and that has not changed for a long time (a year or so). Is there a way to create debug logs that show the client communication to submission-login? I had enabled "auth_debug" and "auth_verbose" in Dovecot but that seems to log the server side communication only (see below). And even with that information, would it be possible to convince Thunderbird to send 'AUTH KERBEROS' if it does not do that already? I logging I have is this: Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sent: 220 mailserver.example.com Dovecot ready. Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Received new command: EHLO [192.168.1.106] Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: New command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Execute command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Pipeline blocked Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Submitted Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Replied Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Ready to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Completed Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Pipeline unblocked Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Connection state reset Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Sent: 250-mailserver.example.com 8BITMIME AUTH GSSAPI GSS-SPNEGO PLAIN BURL imap CHUNKING ENHANCEDSTATUSCODES SIZE PIPELINING Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Finished Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Client sent invalid command: Command line is too long Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Invalid command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Submitted Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Replied Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Ready to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Completed Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Sent: 500 5.5.2 Line too long Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Finished Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Remote closed connection: Connection closed Do note that I redacted a column with the server ipaddress to make the lines a bit shorter and more readable. - Kees > > Aki

1 0

MySQL connection keepalive for pass/auth db
by dvuoud＠at.encryp.ch 14 Nov '23

14 Nov '23

Hello, Is it possible to configure SQL connection keepalive for Dovecot? Probably what I have to do is "Note that the SQL backend must be used via Proxy", however I was unsucsessful in figuring out how can I setup this to get use of connection pool at Dovecot. Thanks. > $ dovecot --version > 2.3.20 (80a5ac675d) > $ dovecot -n > # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.20 (149edcf2) > # OS: Linux 6.1.57 x86_64 Gentoo Base System release 2.14 > # Hostname: flopster > import_environment = TZ CORE_OUTOFMEM CORE_ERROR TZ=:/etc/localtime > lmtp_add_received_header = no > mail_gid = vmail > mail_location = maildir:~/.maildir > mail_server_admin = mailto:me@at.encryp.ch > mail_uid = vmail > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader > metric auth_failures { > filter = event=auth_request_finished AND NOT success=yes > } > metric auth_success { > filter = event=auth_request_finished AND success=yes > } > metric imap_command { > filter = event=imap_command_finished > group_by = cmd_name tagged_reply_state > } > metric mail_delivery { > filter = event=mail_delivery_finished > group_by = duration:exponential:1:5:10 > } > metric smtp_command { > filter = event=smtp_server_command_finished > group_by = cmd_name status_code duration:exponential:1:5:10 > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = * > driver = pam > } > passdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > sieve_extensions = +editheader > } > protocols = imap lmtp sieve > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > vsz_limit = 2 G > } > service dict { > unix_listener dict-passdb { > mode = 0600 > user = vmail > } > unix_listener dict-userdb { > mode = 0600 > user = vmail > } > } > service lmtp { > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0600 > user = postfix > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > } > service stats { > inet_listener http { > address = [::] > port = 9900 > } > } > ssl = required > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > userdb { > driver = passwd > } > userdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > protocol lmtp { > mail_plugins = " sieve" > postmaster_address = postmaster(a)at.encryp.ch > } > protocol lda { > mail_plugins = sieve > } > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = # hidden, use -P to show it > }

1 0

ldap passdb, userdb imap auth sasl and lmtp
by bd730c5053df9efb 14 Nov '23

14 Nov '23

Hi! I'm trying to setup dovecot 2.3.17 such that it authenticates users against a samba4 ad dc when they connect through imap. I would also need dovecot to authenticate the same users through sasl so that postfix can relay mails based on the user's auth and finally I would also need for an lmtp service that maps email addresses into AD users. I've been tinkering with dovecot-ldap.conf.ext using auth_bind = yes and no, with all sorts of pass_filters, user_filter, pass_attr and user_attr and I just can't figure out how it works. I assume that for the auth part (both imap and sasl) I would rather benefit with using auth_bind = yes and auth_bind_userdn = %u and I seem to be able to authenticate the user but I can't get the passdb to prefetch the userdb attributes. I also assume that for lmtp to be able to fetch the ad information it would be necessary for dovecot to be able to bind to the ad ldap server with a "service account" to be able to query the ldap server and I haven't been able to figure out how to have both kinds of auth schemas. Does anyone know of some documentation that could clarify some of this issues, I have been searching the web for days to no avail. I'm sorry I can't show what I have tried for I have tried so many things with more or less the same lack of success that I wouldn't know where to start. Thanks in advance. Best regards, Dave.

2 1

More information on dict proxy
by Steve 09 Nov '23

09 Nov '23

Hello, I'm working on an implementation of a dict server. I've looked through all your documentation but can't seem to find how I can create the proper URI to direct the quota plugin to use a TCP socket instead of a UNIX socket. I'd appreciate any insight you can provide. Steve

2 1

file dotlock create
by The Doctor 07 Nov '23

07 Nov '23

I am seeing errors in our log as follows Nov 07 14:20:06 POP3(user937):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user937) failed: Permission denied (euid=937(user937) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) /var/mail is set to 1775 Running FreeBSD 14.0-RC4 -- Member - Liberal International This is doctor(a)nk.ca Ici doctor(a)nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen Suffering will continue until we stop believing lies. -unknown Beware https://mindspring.com

1 0

mail boxes on net mounted filesystem with multiple Dovecots
by lejeczek 07 Nov '23

07 Nov '23

Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount-point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L. Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount- point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L.

4 3

Can Dovecot Use Wildcard TLS Certificates?
by duluxoz 07 Nov '23

07 Nov '23

Hi All, Quick Q: Can dovecot use wildcard TLS Certificates? I'm having issues with a new dovecot/postfix stack set-up and I can't get mutt on the local box to connect via imap - its coming back with an SSL error, and as I'm using a wildcard cert for the domain I was wondering if that was my issue. If dovecot can use wildcard certs then I'll look elsewhere in my troubleshooting. Thanks in advance Cheers Dulux-Oz

8 7

Minimum configuration for Dovecot SASL only?
by Nick Lockheart 06 Nov '23

06 Nov '23

I have a Dovecot IMAP server and a Postfix server on separate machines. The user information is stored in a MariaDB database that is replicated on both servers. Postfix needs to authenticate outgoing mail against our valid user database. I believe this requires us to install a "dummy" Dovecot on the Postfix server so that Dovecot SASL can provide authentication to Postfix from the database. I think Cyrus had a standalone Cyrus-SASL package, but Dovecot doesn't? If I wanted to setup a Dovecot instance on the Postfix server just for the purposes of SMTP authentication, and not use it to handle any mail, what is the minimum configuration required to make that work? Is the dovecot-common package (Debian) enough? Or do I need the full dovecot-imap package? What protocols go in the protocols directive? Can you just make it "protocols = auth" to disable IMAP connections?

5 9

with GlusterFS - permissions for vmail ?
by lejeczek 05 Nov '23

05 Nov '23

Hi guys. I must be missing, having something misconfigured. I have: -> $ gluster volume info VMAIL Volume Name: VMAIL Type: Distributed-Replicate Volume ID: 462a1850-a31a-4a17-934d-26f3996dc9b8 Status: Started Snapshot Count: 0 Number of Bricks: 1 x 2 = 2 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/VMAIL Brick2: 10.1.1.101:/devs/00.GLUSTERs/VMAIL Options Reconfigured: storage.owner-gid: 2000 storage.owner-uid: 2000 cluster.granular-entry-heal: on storage.fips-mode-rchecksum: on transport.address-family: inet nfs.disable: on performance.client-io-threads: off and my _dovecot_ errors out with: ... imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000(vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000(vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2023-11-05 12:08:25] ... What might I have incorrect or wrong? many thanks, L Hi guys. I must be missing, having something misconfigured. I have: -> $ gluster volume info VMAIL Volume Name: VMAIL Type: Distributed-Replicate Volume ID: 462a1850-a31a-4a17-934d-26f3996dc9b8 Status: Started Snapshot Count: 0 Number of Bricks: 1 x 2 = 2 Transport-type: tcp Bricks: Brick1: 10.1.1.100:/devs/00.GLUSTERs/VMAIL Brick2: 10.1.1.101:/devs/00.GLUSTERs/VMAIL Options Reconfigured: storage.owner-gid: 2000 storage.owner-uid: 2000 cluster.granular-entry-heal: on storage.fips-mode-rchecksum: on transport.address-family: inet nfs.disable: on performance.client-io-threads: off and my _dovecot_ errors out with: ... imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/ test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000 (vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: mkdir(/VMAIL/ test.web/ja_discourse) failed: Permission denied (euid=2000(vmail) egid=2000 (vmail) missing +w perm: /VMAIL, UNIX perms appear ok (ACL/MAC wrong?)) imap(ja_discourse(a)test.web)<92447><w3ygwWUJUNddviSg>: Error: Mailbox INBOX: Failed to autocreate mailbox: Internal error occurred. Refer to server log for more information. [2023-11-05 12:08:25] ... What might I have incorrect or wrong? many thanks, L

2 3

install/compile dovecot-pigeonhole
by joe a 03 Nov '23

03 Nov '23

Working dovecot 2.3, wish to be able to implement "server side" filtering. My understanding is that is done with "sieve". My further understanding is that "dovecot-pigeonhole" and be used to manage "sieve" in some fashion. Attempting to compile dovecot-2.3-pigeonhole-0.5.21 proves problematic due to its inability to find dovecot-config. Which is not astonishing as, on my system dovecot-config does not exist, dovecot having been installed as a vendor configure package. Sadly, no vendor package or binary is provided for dovecot-pigeonhole. At least that I am aware of. OS is opensuse LEAP 15.5. Any helpful commentary is welcome. Honest.

1 1

Too many auth errors
by DeJa Wu 03 Nov '23

03 Nov '23

I've got too many errors on my mail server like this: Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2965 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2966 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2967 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2084 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 1972 And my users say that login to the mail server is too long. In some cases I've got an error connection problem. How do I fix this? BR, DeJa I've got too many errors on my mail server like this: Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2965 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2966 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2967 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 2084 Nov 3 12:03:13 mail01 dovecot[5562]: imap-login: Error: auth-client: conn unix:login (pid=5553,uid=0): Authentication server sent unknown id 1972 And my users say that login to the mail server is too long. In some cases I've got an error connection problem. How do I fix this? BR, DeJa

1 0

Sieve/Pigeonhole
by joe a 01 Nov '23

01 Nov '23

For dovecot, I see there is a "sieve" download at dovecot downloads and separately there is a pigeonhole download. Are these parallel projects, distinct and separate?

1 1

Setting up a new server
by James Cloos 30 Oct '23

30 Oct '23

I'm in the process of switching to dovecot for my lan imap and have a couple of questions. I want to keep the folder names unchanged. For mailing lists I use the posting address (eg foo(a)bar.co) for others I use / as the separator. If I use mdbox, will those choices cause any issues? My impression is not, but I'd like to be sure. Also I'd like to use imap-specific passwds for each user. My tests so far have used the login passwds for each user. Not necessarily virtual users, just imap-specific passwds. There is already a pgsql server handy; I take it that would be the way to go for passdb and userdb lookups, yes? Thanks, -JimC -- James Cloos <cloos(a)jhcloos.com> OpenPGP: 0x997A9F17ED7DAEA6

2 1

Two-way TLS and other security for LMTP over the internet?
by forum＠ageofdream.com 29 Oct '23

29 Oct '23

Dovecot version 2.3.19.1 (9b53102964) Postfix version 3.5.18 We have a Postfix server that runs on a VPS with a hosting company and a Dovecot IMAP server that runs at the office. We want Postfix to push the mail it receives to the Dovecot IMAP server, using the least amount of intermediate software. This transfer occurs over the open internet. LMTP over TCP seems like a great solution, *if* it can be secured. But I'm not finding documentation on how to actually setup something like two-way TLS over LMTP. 1. Is there any setting in Dovecot where I can set a remote IP address (or hostname) that will be the only address that Dovecot's LMTP accepts connections from? 2. My current configuration options for LMTP in Dovecot look like: protocol lmtp { ssl_cert = </etc/ssl/imap/imap.crt ssl_key = </etc/ssl/imap/imap.key ssl_ca = </etc/ssl/imap/authority.crt ssl_verify_client_cert = yes auth_ssl_require_client_cert = yes } service lmtp { user = vmail inet_listener lmtp { address = * :: port = 24 } } With these settings, I can telnet from the Postfix server to the Dovecot server with LMTP, and I'm not convinced there is any encryption actually enabled or any TLS verification going on. Is there any reasonable security that can be setup to make this safe (within Dovecot and Postfix settings, not using VPNs and SSH tunnels)? If so, how?

3 2

{ldap:objectGUID} returns binary data when used for user_attrs
by Andreas Haerter 26 Oct '23

26 Oct '23

Hi, there is an environment in which I have to use MS Active Directory for authentication and mail server user database, and I've run into a problem. I. The problem I want to retrieve the objectGUID attribute for the homedir path of the users. This attribute does never change, even when the username does or the account gets moved to another AD domain. However, the objectGUID is returned as binary gibberish when using the following setting: > user_attrs = \ > =home=/var/vmail/example.com/%LT{ldap:objectGUID}, \ It results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/d ��n�aa_ o�� > mail maildir:~/mail Can someone reproduce this or offer a workaround? The only idea I had was hashing the value using =%M{ldap:objectGUID}. However, this approach would become problematic if the behavior changes and a proper string representation is returned, as expected, instead of the binary data. Therefore, I'm hesitant to use this method for now. A better approach would be encoding it as Base64, but I was unsuccessful to identify a fitting modifier at <https://doc.dovecot.org/configuration_manual/config_file/config_variables/#…>. Any ideas? II. Additional info Using other attributes for LDAP/Active Directory works as expected. E.g. > =home=/var/vmail/example.com/%LT{ldap:sAMAccountName} results in > # doveadm user uTesting > field value > user utesting > home /var/vmail/example.com/utesting > mail maildir:~/mail The objectGUID is indeed binary data, but IHMO, it should be handled differently when returned. E.g. there is a defined string representation, [MS-DTYP] section 2.3.4.3: <https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/222af…> which links to: > curly braced GUID string: The string representation of a 128-bit > globally unique identifier (GUID) using the form > {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}, where X denotes a hexadecimal > digit. The string representation between the enclosing braces is the > standard representation of a GUID as described in [RFC4122] section 3. > Unlike a GUIDString, a curly braced GUID string includes enclosing braces. Some libs simply decide to return the data Base64 encoded (which would be OK, too). E.g. openldap-clients / ldapsearch does so with objectGUID and objectSid: > $ ldapsearch [...] > [...] > # uTesting, common, user, managed, example.com > dn: CN=uTesting,OU=common,OU=user,OU=managed,DC=example,DC=com > [...] > name: uTesting > objectGUID:: RCDirQPvGU6KQUFfIE/i2Q== > [...] > objectSid:: AQUAAAAAAAUVAAAALenCqsullBUfFoubWQQAAA== > [...] > sAMAccountName: uTesting > [...] Other software had comparable bugs or behavior , e.g. sssd ("Properly handle AD's binary objectGUID"): <https://bugzilla.redhat.com/show_bug.cgi?id=1205382> <https://github.com/SSSD/sssd/issues/3629> owncloud ("ensure that objectguid or guid really return binary data before converting it"): <https://github.com/owncloud/core/issues/8317> III. Software versions, config I can reproduce the issue on Fedora Server 38 > # cat /etc/redhat-release > Fedora release 38 (Thirty Eight) > # uname -r > 6.4.15-200.fc38.x86_64 > # dovecot --version > 2.3.20 (80a5ac675d) and CentOS 9 Stream: > # cat /etc/redhat-release > CentOS Stream release 9 > # uname -r > 5.14.0-364.el9.x86_64 > # dovecot --version > 2.3.16 (7e2e900c1a) I did not try a Debian-based distro yet. The config itself works fine, relevant settings just for reference (as there are not many examples on the internet, maybe useful for somebody): > auth_username_format = %Lu > > passdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap.conf.ext > } > userdb { > driver = ldap > args = /etc/dovecot/dovecot-ldap-userdb.conf.ext > } with the following options to exclude inactive accounts, search smtp proxy addresses and having a mandatory group membership in SERVICE_EmailUsers: > base = OU=common,OU=user,OU=managed,DC=example,DC=com > scope = subtree > > user_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) > pass_filter = \ > (& \ > (objectClass=user) \ > (objectCategory=Person) \ > (|(sAMAccountName=%{username})(mail=%{username})(proxyAddresses=smtp:%{username}@%{domain})) \ > (!(userAccountControl:1.2.840.113556.1.4.803:=2)) \ > (memberOf:1.2.840.113556.1.4.1941:=SERVICE_EmailUsers) \ > ) I will blog about the config in more detail at https://foundata.com/en/blog/ soon, especially when the objectGUID is solved (maybe hashing it really the way to go). :-) Regards, Andreas -- foundata GmbH Steinhäuserstr. 20 76135 Karlsruhe Sitz der Gesellschaft: Karlsruhe Registergericht: Amtsgericht Mannheim, HRB 714807 Geschäftsführer: Andreas Haerter USt-IdNr.: DE284122682

1 1

Correct sizing of CPU and RAM
by DeJa Wu 26 Oct '23

26 Oct '23

How to correctly calculate the number of CPUs and memory required for 1000 client mailboxes and beyond? Given that 30-50% of users will be constantly connected via IMAP. I looked for information and did not find any sizing in the documentation anywhere. Is there a way to calculate my required resources? BR, DeJa How to correctly calculate the number of CPUs and memory required for 1000 client mailboxes and beyond? Given that 30-50% of users will be constantly connected via IMAP. I looked for information and did not find any sizing in the documentation anywhere. Is there a way to calculate my required resources? BR, DeJa

2 1

OAUTH2 tokeninfo is doing a GET instead of a POST request
by Alexander Leidinger 26 Oct '23

26 Oct '23

Hi, I try to setup oauth2 authentication with dovecot 2.3.21. The debug log of dovecot shows that it tries to do a HTTP GET request to the tokeninfo url with the token appended to the end of the URL. This gives a 404 error. The openidconnect server I use (keycloak) tells that this API endpoint conforms to https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint which specifies that the request has to be a HTTP POST request. So dovecot is trying do to something (GET request) which the OIDC specification does not agree with (shall be POST request). Here is the dovecot debug log of it: ---snip--- Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: http-client[1]: request [Req1: GET https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/tokeneyJhb…<rest_omitted>...: Submitted (requests left=1) [...] Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSLv3/TLS read server session ticket Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: where=0x1002, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap syslogd: last message repeated 1 times Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1001, ret=1: SSLv3/TLS read server session ticket Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: oauth2.domain.tld: SSL: where=0x1002, ret=1: SSL negotiation finished successfully Oct 17 12:11:19 imap dovecot[81589]: auth: Debug: http-client: conn <IP>:443 [1]: Got 404 response for request [Req1: GET https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/tokeneyJhb…<rest_omitted> ---snip--- My passdb config (only showing the oauth part): ---snip--- passdb { driver = oauth2 mechanisms = oauthbearer xoauth2 args = /usr/local/etc/dovecot/auth-oauth2.token.conf.ext } passdb { driver = oauth2 mechanisms = plain args = /usr/local/etc/dovecot/auth-oauth2.plain.conf.ext } ---snip--- auth-oauth2.token.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = post active_attribute = active active_value = true client_id = myid client_secret = mysecret use_grant_password = no debug = yes username_attribute = email pass_attrs = pass=%{oauth2:access_token} ---snip--- auth-oauth2.plain.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = post active_attribute = active active_value = true client_id = myid client_secret = mysecret use_grant_password = yes debug = yes username_attribute = email pass_attrs = host=<IP of webmail> proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} ---snip--- On https://doc.dovecot.org/configuration_manual/authentication/oauth2/ I can not find any way to tell that the tokeninfo url shall do a POST request instead of a GET request. I found something on reddit how to make it work with keycloak, but this seems to be a workaround, and not a proper fix... The first comment at https://www.reddit.com/r/selfhosted/comments/omwb2j/any_one_get_dovecot_key… makes this work for me. The working but not really up to the OIDC spec dovecot config is: auth-oauth2.token.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/Leidinger/protocol/openid-connect/… tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/userinfo?t… introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = auth #active_attribute = active #active_value = true client_id = myid client_secret = mysecret use_grant_password = no #debug = yes username_attribute = email pass_attrs = pass=%{oauth2:access_token} ---snip--- auth-oauth2.plain.conf.ext: ---snip--- openid_configuration_url = https://oauth2.domain.tld/realms/MyRealm/.well-known/openid-configuration #tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token tokeninfo_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/userinfo?t… introspection_url = https://oauth2.domain.tld/realms/MyRealm/protocol/openid-connect/token/intr… introspection_mode = auth #active_attribute = active #active_value = true client_id = myid client_secret = mysecret use_grant_password = yes #debug = yes username_attribute = email pass_attrs = host=<IP of webmail> proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token} ---snip--- Bye, Alexander. -- http://www.Leidinger.net Alexander(a)Leidinger.net: PGP 0x8F31830F9F2772BF http://www.FreeBSD.org netchild(a)FreeBSD.org : PGP 0x8F31830F9F2772BF

2 8

Is it possible to show different mechanism according to client IP ?
by Philippe MARASSE 26 Oct '23

26 Oct '23

Hello, Say I'm wondering if it's possible to show 3 mechanisms for clients in private network (XOAUTH2 / PLAIN / EXTERNAL) and only 2 to others (only OAUTH / EXTERNAL) ? I've seen allow_nets extra field for args, but it seems that's not working with ldap passdb. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19 Hello, Say I'm wondering if it's possible to show 3 mechanisms for clients in private network (XOAUTH2 / PLAIN / EXTERNAL) and only 2 to others (only OAUTH / EXTERNAL) ? I've seen allow_nets extra field for args, but it seems that's not working with ldap passdb. Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

2 1

Unclear output from force-resync.
by Justin Wheeler 25 Oct '23

25 Oct '23

Hi, After a hard drive issue from my VPS provider, one of my customers' mailboxes has been corrupted, and has been complaining about index sync issues. So I am attempting a force-resync. The command I used was: doveadm -v force-resync -u user(a)mailbox.com '*' The output it's been giving doesn't look anything like a 'progress counter', so I have no idea if it's just losing its mind, or if it's actually achieving anything. The mailbox is 20G, so theoretically it's just working its way through it, but I can't tell. The output looks like: doveadm(user(a)mailbox.com): Warning: fscking index file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index doveadm(user(a)mailbox.com): Warning: mdbox /home/mail/mailbox.com/user/mdbox/storage: rebuilding indexes doveadm(user(a)mailbox.com): Warning: Transaction log file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index.log was locked for 90 seconds (mdbox storage rebuild) doveadm(user(a)mailbox.com): Warning: fscking index file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index doveadm(user(a)mailbox.com): Warning: fscking index file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index doveadm(user(a)mailbox.com): Warning: mdbox /home/mail/mailbox.com/user/mdbox/storage: rebuilding indexes doveadm(user(a)mailbox.com): Warning: Transaction log file /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index.log was locked for 90 seconds (mdbox storage rebuild) It's just this over and over and over and over. Does this mean it's working, or that something else is going on? fuser /home/mail/mailbox.com/user/mdbox/storage/dovecot.map.index.log shows only the PID of the force-resync, and ls -l /proc/pid/fd shows it has a bunch of index and index.log and index.cache files open, as well as scrolling through mdbox/storage/m.{digits} a bunch, and strace -fp on the process shows a boatload of pread64 on those m.{digits} files, so I *think* it's working, but I can't tell if it's just restarting after the above messages and doing the same thing over and over again. I've locked the mailbox so there's no mail delivery being attempted on it, and changed its password and kicked out any logged in users on the mailbox, so the only process anywhere near that entire directory structure is the force-resync. Thanks, Justin

1 0

dovecot lmtp and smtputf8
by Kamil Jońca 25 Oct '23

25 Oct '23

Does dovecot handle smtputf8? Last articles regarding this are several years old. Anything changed? KJ

2 2

dovecot 2.0 supports EC private key?
by Marc 24 Oct '23

24 Oct '23

Does dovecot 2.0 supports EC private key?

2 1

Question: ETA OpenSSL 3.0 Support
by Niklas Meyer 23 Oct '23

23 Oct '23

Hello everyone, i stumbled across some serious problems with decrypting of e-mails if you use a Dovecot installation with OpenSSL 3.X so i started digging. It turns out that Dovecot is not OpenSSL 3.X ready yet, at least if you compile it yourself. The Debian Project adapted a OpenSSL 3.X patch to their repo version of Dovecot to make it run with Debian 12. Alpine Linux has not added a Workaround Patch for Dovecot yet. This is actually really bad if you want to Upgrade your Dovecot Server to a Distro which has OpenSSL 3.X as the new standard and you are not using their patched Repo Versions but instead compiling dovecot by yourself or install it from your package repos (which are not Debian 12 compatible also, which is probably because of OpenSSL 3.X i presume?) However though i think that this compatibility should be added soon as more and more Distros are using OpenSSL 3.X. So: Is there a approx. ETA when the OpenSSL Compatibility the devs worked/are working on is coming? Thank you for your answers. Kind regards from Germany Niklas Meyer aka. DerLinkman

2 3

Confusing documentation for 'address/listen' setting
by Bruno Victal 21 Oct '23

21 Oct '23

Hi, The 'address' setting in the “Service configuration” of the Configuration Manual [1] says: Space separated list of IP addresses / host names to listen on. […] Defaults to listen setting. I'm finding this part confusing as it seems that by “listen setting” it is referring to the 'listen' setting in the “Dovecot Core Manual” [2] which is described as: A comma-separated list of IP addresses or […] which leads me to suspect that either “listen setting” refers to something else (what?) or there's some inconsistency with the documentation or perhaps a bug/foot-gun here. [1]: <https://doc.dovecot.org/configuration_manual/service_configuration/#address> [2]: <https://doc.dovecot.org/settings/core/#core_setting-listen> Regards, -- Bruno.

1 0

Re: Dovecot behind Reverse Proxy and IP families
by Arnaud Cordier 20 Oct '23

20 Oct '23

On 10/13/23 06:55, Arnaud Cordier wrote: > Hi Justas, > > Thank you for your answer. Unfortunately, I already have a dual stack > cluster with an IPv6 assigned to the pod: > > 3: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1430 qdisc > noqueue state UP qlen 1000 > link/ether c6:90:d2:cf:b8:77 brd ff:ff:ff:ff:ff:ff > inet 10.42.4.52/32 scope global eth0 > valid_lft forever preferred_lft forever > inet6 fd23:23:42:0:251d:192a:bb7f:a1f4/128 scope global > valid_lft forever preferred_lft forever > inet6 fe80::c490:d2ff:fecf:b877/64 scope link > valid_lft forever preferred_lft forever > > Any additional idea? > > --- > Arnaud Cordier > --------------- > CryptID > Freelance cybersecurity engineer - Pentester - Red teamer > Tel: +33 (0)6 61 44 82 04 > On 10/12/23 22:54, Justas Umbrasas wrote: >> >> Hey, >> >> >> we are running a similar setup without an issue (not on k8s). I >> believe the reason is that the remote dovecot pod is only binding on >> IPv4 and has no IPv6 configured. This is kind of a hack, however you >> could try binding the pod to both IPv4 and IPv6 and see if it works. >> >> >> Best, >> >> Justas Umbrasas >> >> >> On 2023-10-12 20:25, Arnaud Cordier via dovecot wrote: >> >>> Dear all, >>> >>> I am running Dovecot 2.3.20 in a Kubernetes cluster. The Dovecot >>> container is exposed behind a Traefik load-balancer, which acts just >>> like HAProxy would, using the Proxy Protocol in order to allow >>> Dovecot to be aware of the real source IP of the client, as follows: >>> >>> Internet <-> Traefik load-balancer <---- Proxy protocol ----> Dovecot >>> >>> My setup works well over IPv4. >>> >>> Oct 12 19:11:33 imap-login: Info: Login: user=<arnaud@xxx>, >>> method=PLAIN, rip=<my_ipv4_public_address> lip=10.42.4.21, >>> mpid=1369531, session=<xxxx> >>> >>> Howevever, if the client originates from an IPv6 address, Dovecot >>> does not seem to take the real IPv6 origin into account and fails. >>> >>> Oct 12 19:09:04 imap-login: Error: haproxy(v1): Client disconnected: >>> Proxied local address is invalid (address=`10.42.4.21', rip=10.42.4.21) >>> >>> A network capture shows that the proxy protocol indeed sends the >>> real IPv6 IP, that should be taken into account by dovecot: >>> >>> ......&.PROXY TCP6 2001:<rest_of_my_public_ip> 10.42.4.21 20200 993 >>> >>> The error seems to be raised in >>> "core/src/lib-master/master-service-haproxy.c" line 553: >>> >>> 551 if (net_addr2ip(*fields, &local_ip) < 0 || >>> 552 local_ip.family != family) { >>> 553 e_error(hpconn->event, "Client disconnected: " >>> 554 "Proxied local address >>> is invalid " >>> 555 "(address=`%s', >>> rip=%s)", str_sanitize(*fields, 64), >>> 556 net_ip2addr(real_remote_ip)); >>> 557 return -1; >>> 558 } >>> 559 fields++; >>> >>> I suppose that the issue is related to the fact that the client >>> originates from an IPv6 then the reverse proxy forwards the >>> connection to Dovecot over IPv4, which results in the >>> "local_ip.family != family" condition to be true. >>> >>> Why is such a restriction implemented ? >>> >>> It is to be noted that I implemented the exact same load-balancer >>> architecture for postfix, which successfully handles an IPv6 real IP >>> over an IPv4 connection. >>> >>> I temporarily fixed the issue by setting an IPv4 only DNS record for >>> my imaps domain name, however, do you think that a fix could be >>> implemented in Dovecot? >>> >>> Kind regards, >>> >>> _______________________________________________ >>> dovecot mailing list -- dovecot(a)dovecot.org >>> To unsubscribe send an email to dovecot-leave(a)dovecot.org >> >> On 10/13/23 06:55, Arnaud Cordier wrote: Hi Justas, Thank you for your answer. Unfortunately, I already have a dual stack cluster with an IPv6 assigned to the pod: 3: eth0@if22: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1430 qdisc noqueue state UP qlen 1000 link/ether c6:90:d2:cf:b8:77 brd ff:ff:ff:ff:ff:ff inet 10.42.4.52/32 scope global eth0 valid_lft forever preferred_lft forever inet6 fd23:23:42:0:251d:192a:bb7f:a1f4/128 scope global valid_lft forever preferred_lft forever inet6 fe80::c490:d2ff:fecf:b877/64 scope link valid_lft forever preferred_lft forever Any additional idea? --- Arnaud Cordier --------------- CryptID Freelance cybersecurity engineer - Pentester - Red teamer Tel: +33 (0)6 61 44 82 04 On 10/12/23 22:54, Justas Umbrasas wrote: Hey, we are running a similar setup without an issue (not on k8s). I believe the reason is that the remote dovecot pod is only binding on IPv4 and has no IPv6 configured. This is kind of a hack, however you could try binding the pod to both IPv4 and IPv6 and see if it works. Best, Justas Umbrasas On 2023-10-12 20:25, Arnaud Cordier via dovecot wrote: Dear all, I am running Dovecot 2.3.20 in a Kubernetes cluster. The Dovecot container is exposed behind a Traefik load-balancer, which acts just like HAProxy would, using the Proxy Protocol in order to allow Dovecot to be aware of the real source IP of the client, as follows: Internet <-> Traefik load-balancer <---- Proxy protocol ----> Dovecot My setup works well over IPv4. Oct 12 19:11:33 imap-login: Info: Login: user=<arnaud@xxx>, method=PLAIN, rip=<my_ipv4_public_address> lip=10.42.4.21, mpid=1369531, session=<xxxx> Howevever, if the client originates from an IPv6 address, Dovecot does not seem to take the real IPv6 origin into account and fails. Oct 12 19:09:04 imap-login: Error: haproxy(v1): Client disconnected: Proxied local address is invalid (address=`10.42.4.21', rip=10.42.4.21) A network capture shows that the proxy protocol indeed sends the real IPv6 IP, that should be taken into account by dovecot: ......&.PROXY TCP6 2001:<rest_of_my_public_ip> 10.42.4.21 20200 993 The error seems to be raised in "core/src/lib-master/master-service- haproxy.c" line 553: 551 if (net_addr2ip(*fields, &local_ip) < 0 || 552 local_ip.family != family) { 553 e_error(hpconn->event, "Client disconnected: " 554 "Proxied local address is invalid " 555 "(address=`%s', rip=%s)", str_sanitize(*fields, 64), 556 net_ip2addr(real_remote_ip)); 557 return -1; 558 } 559 fields++; I suppose that the issue is related to the fact that the client originates from an IPv6 then the reverse proxy forwards the connection to Dovecot over IPv4, which results in the "local_ip.family != family" condition to be true. Why is such a restriction implemented ? It is to be noted that I implemented the exact same load-balancer architecture for postfix, which successfully handles an IPv6 real IP over an IPv4 connection. I temporarily fixed the issue by setting an IPv4 only DNS record for my imaps domain name, however, do you think that a fix could be implemented in Dovecot? Kind regards, _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

2 1

submission server relay to localhost
by Michael Grant 20 Oct '23

20 Oct '23

I'm trying to set up dovecot-submission server which will listen on external ports 465 (SSL) and 587 (StartTLS) and relay mail to sendmail waiting on localhost port 587. I have dovecot submission listening on the external ports and sendmail listening on the localhost port. I want dovecot-submission doing the authentication on the external ports because sendmail doesn't use the /etc/dovecot/users file. I can authenticate to dovecot: auth: Debug: client in: CONT<hidden> auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Performing passdb lookup auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): lookup: user=mgrant(a)top.networkguild.org file=/etc/dovecot/users auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Finished passdb lookup auth: Debug: auth(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Auth request finished auth: Debug: client passdb out: OK 1 user=mgrant(a)top.networkguild.org But in the sendmail logs, dovecot *is* trying to authenticate and it's trying to use a username that sendmail can't look up in the password file: top sm-mta[1012721]: 39KCg8h31012721: --- 220 top.networkguild.org ESMTP Sendmail 8.17.2/8.17.2/Debian-1~bpo12+1; Fri, 20 Oct 2023 12:42:08 GMT; (No UCE/UBE) logging access from: localhost(OK)-localhost [IPv6:0:0:0:0:0:0:0:1] top sm-mta[1012721]: 39KCg8h31012721: <-- EHLO top.networkguild.org top sm-mta[1012721]: 39KCg8h31012721: --- 250-top.networkguild.org Hello localhost [IPv6:0:0:0:0:0:0:0:1], pleased to meet you top sm-mta[1012721]: 39KCg8h31012721: --- 250-ENHANCEDSTATUSCODES top sm-mta[1012721]: 39KCg8h31012721: --- 250-PIPELINING top sm-mta[1012721]: 39KCg8h31012721: --- 250-EXPN top sm-mta[1012721]: 39KCg8h31012721: --- 250-VERB top sm-mta[1012721]: 39KCg8h31012721: --- 250-8BITMIME top sm-mta[1012721]: 39KCg8h31012721: --- 250-SIZE top sm-mta[1012721]: 39KCg8h31012721: --- 250-AUTH DIGEST-MD5 CRAM-MD5 top sm-mta[1012721]: 39KCg8h31012721: --- 250-STARTTLS top sm-mta[1012721]: 39KCg8h31012721: --- 250-DELIVERBY top sm-mta[1012721]: 39KCg8h31012721: --- 250 HELP top sm-mta[1012721]: 39KCg8h31012721: <-- MAIL FROM:<mgrant(a)top.networkguild.org> AUTH=mgrant(a)top.networkguild.org top sm-mta[1012721]: 39KCg8h31012721: --- 530 5.7.0 Authentication required top dovecot: submission(mgrant(a)top.networkguild.org)<1012719><blablabla>: Error: Relay server requires authentication: 530 5.7.0 Authentication required top dovecot: submission(mgrant(a)top.networkguild.org)<1012719><blablabla>: Disconnected: Internal error occurred. Refer to server log for more information. (unfinished MAIL command) (state=MAIL FROM) in=41 out=121 top sm-mta[1012721]: 39KCg8h31012721: <-- QUIT How do I stop dovecot from proposing AUTH to the relay server? Once I am authenticated via dovecot, the relay which is only available on localhost, doesn't need to authenticate. It should be as if bin-mail is submitting to localhost. I tried setting up a user with a password but no shell and configure this into submission_relay_master_user and submission_relay_password but this leads to other problems. Dovecot wants to do PLAIN auth, so I then enable starttls, but then the ssl certificate doesn't match because I'm connecting to localhost, not top.networkguild.org. So it seems clear, the relay should a) not auth, and b) not do ssl. Note that this is not an open relay, it's only open on the loopback interface. Michael Grant

1 1

Extract body preview in lua notify script
by Filip Hanes 20 Oct '23

20 Oct '23

Hi, I am trying to extract short text preview from mail body in function dovecot_lua_notify_end_txn. I want to send notification about new email with perex included. How can it be done? Is it possible? thanks -- Filip Hanes

2 1

Replicator service in Dovecot 2.4 CE
by k v 18 Oct '23

18 Oct '23

On the documentation page for the upgrade to version 2.4 at https://doc.dovecot.org/3.0/installation_guide/upgrading/from-2.3-to-3.0/, it is mentioned that instead of the 'replicator' service (https://doc.dovecot.org/configuration_manual/replication/#replication-with-…) it is necessary to use an NFS cluster file system. Are you completely removing support for 'replication-with-dsync' starting from version 2.4? Are there any plans for built-in tools to implement an active/active or active/passive cluster in the community edition?

2 1

Debian package for bookworm
by Claudio Corvino 14 Oct '23

14 Oct '23

Hi guys, I updated to Debian 12 but I can't find repo for bookworm on https://repo.dovecot.org/. When it will be released? Thanks! -- Claudio

8 10

Dovecot behind Reverse Proxy and IP families
by Arnaud Cordier 12 Oct '23

12 Oct '23

Dear all, I am running Dovecot 2.3.20 in a Kubernetes cluster. The Dovecot container is exposed behind a Traefik load-balancer, which acts just like HAProxy would, using the Proxy Protocol in order to allow Dovecot to be aware of the real source IP of the client, as follows: Internet <-> Traefik load-balancer <---- Proxy protocol ----> Dovecot My setup works well over IPv4. Oct 12 19:11:33 imap-login: Info: Login: user=<arnaud@xxx>, method=PLAIN, rip=<my_ipv4_public_address> lip=10.42.4.21, mpid=1369531, session=<xxxx> Howevever, if the client originates from an IPv6 address, Dovecot does not seem to take the real IPv6 origin into account and fails. Oct 12 19:09:04 imap-login: Error: haproxy(v1): Client disconnected: Proxied local address is invalid (address=`10.42.4.21', rip=10.42.4.21) A network capture shows that the proxy protocol indeed sends the real IPv6 IP, that should be taken into account by dovecot: ......&.PROXY TCP6 2001:<rest_of_my_public_ip> 10.42.4.21 20200 993 The error seems to be raised in "core/src/lib-master/master-service-haproxy.c" line 553: 551 if (net_addr2ip(*fields, &local_ip) < 0 || 552 local_ip.family != family) { 553 e_error(hpconn->event, "Client disconnected: " 554 "Proxied local address is invalid " 555 "(address=`%s', rip=%s)", str_sanitize(*fields, 64), 556 net_ip2addr(real_remote_ip)); 557 return -1; 558 } 559 fields++; I suppose that the issue is related to the fact that the client originates from an IPv6 then the reverse proxy forwards the connection to Dovecot over IPv4, which results in the "local_ip.family != family" condition to be true. Why is such a restriction implemented ? It is to be noted that I implemented the exact same load-balancer architecture for postfix, which successfully handles an IPv6 real IP over an IPv4 connection. I temporarily fixed the issue by setting an IPv4 only DNS record for my imaps domain name, however, do you think that a fix could be implemented in Dovecot? Kind regards, -- --- Arnaud Cordier --------------- CryptID Freelance cybersecurity engineer - Pentester - Red teamer Tel: +33 (0)6 61 44 82 04

1 0

Create autoreply with http api
by cyril.leclerc＠mantiq.com 12 Oct '23

12 Oct '23

Hi, Is it possible to activate autoreply from http api : https://doc.dovecot.org/admin_manual/doveadm_http_api/ on mailbox ? because on evolution client we could not activate out of office, autoreply, with http api and sieve commands, is it possible to achieve it fron our web application ? thank you

1 0

doveadm(user): Error purging namespace
by Taavi Ansper 10 Oct '23

10 Oct '23

Hi I have an issue with doveadm: doveadm(user): Warning: mdbox /home/user/mdbox/storage: Inconsistency in map index (227,40 != 227,56) doveadm(user): Warning: fscking index file /home/user/mdbox/storage/dovecot.map.index doveadm(user): Warning: mdbox /home/user/mdbox/storage: rebuilding indexes doveadm(user): Error: Purging namespace '' failed: BUG: Unknown internal error Why does this happen and how can it be resolved? User is using thunderbird as the mail client. -- Taavi Ansper taavi.ansper(a)cyber.ee

2 1

spool move/rename question
by Dave McGuire 09 Oct '23

09 Oct '23

Hi folks. Our mail server's spools are structured like this: /var/mail/<domain>/<user> We have an existing user with a lot of mail that we need to move from one domain to another. Our mail system is database-backed so changing the account is trivial, but can I just move the <user> directory from the structure above from one <domain> directory to another and expect everything to be ok? Or is there a better approach? (of course I'll do a backup first) Thanks, -Dave -- Dave McGuire, AK4HZ New Kensington, PA

2 3

qp and Invalid quoted-printable input trailer: '=' not followed by two hex digits
by Arkadiusz Miśkiewicz 09 Oct '23

09 Oct '23

I have a mail (attached) for which dovecot reports: imap(test): pid=<32688> session=<UOVJ/0UHlM3B7y+g>, Error: Mailbox INBOX.test: UID=1: read(<binary stream of mailbox INBOX.test UID 1>) failed: read(/var/mail/test/.test/cur/1695887652.M710714P17846.mbox13:2,RS) failed: Invalid quoted-printable input trailer: '=' not followed by two hex digits and I fail to see why. There is = used at the end of lines as soft-line break. Also if you delete "przez system Spa=" it works. If you lave it and delete "<br>=" line it also works. Doesn't seem to be consistent. Is dovecot too restrictive here? dovecot 2.3.20 and 2.3.21 -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

bug report: lmtp fails on root-squashed NFS filesystem
by Anne Bennett 09 Oct '23

09 Oct '23

Hi, all. I'm trying to set up Postfix with dovecot LTMP delivery on a host where the user files (/var/spool/mail as well as home directories) are on NFS filesystems, which are exported root-squashed to the mail server. I definitely don't want to give the mail server root permissions on the user files. LMTP delivery fails with this logged message (e.g.): Nov 16 17:51:36 lust dovecot: lmtp(anne)<16830><mkkzEPg1lGG+QQAAs/mAJw>: msgid=<202111162229.1AGMTfAO024765(a)vindemiatrix.encs.concordia.ca>: save failed to INBOX: Read-only mbox I found this posting where someone else had a similar problem and traced it in some detail back in 2019: https://dovecot.org/list/dovecot/2019-February/114611.html but apparently no one answered the fellow. In order to check that this is indeed the same problem, I temporarily changed the INBOX definition to make it write into /var/tmp/ (on a local filesystem), and delivery worked. I then temporarily changed the INBOX definition to make it write into an NFS filesystem with root NOT squashed, and again it worked (after I chmodded the directory to 1777 to allow any user to create a file). I believe that the person who wrote the above posting is correct: at some point, file access is (incorrectly) checked as root instead of as the target user. This is a bit of a showstopper for me. Any plans to address this? I attach the output of "dovecot -n", fwiw, but I don't think that this is a configuration problem... Anne. -- Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8 anne(a)encs.concordia.ca +1 514 848-2424 x2285

2 4

Dovecot services not starting
by Jose David Bravo A 08 Oct '23

08 Oct '23

Hi, I'm running dovecot 2.3.16 on Ubuntu 22.04.2. But when I start dovecot, I can only see that the services are failing to start. It don't show any additional error about why it's failing, may be because the log service is not running? Oct 06 15:19:00 master: Error: service(log): command startup failed, throttling for 2.000 secs Oct 06 15:19:45 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Oct 06 15:19:53 master: Error: service(pop3-login): command startup failed, throttling for 2.000 secs Oct 06 15:21:45 master: Error: service(imap-login): command startup failed, throttling for 4.000 secs Oct 06 15:21:53 master: Error: service(pop3-login): command startup failed, throttling for 4.000 secs Oct 06 15:23:45 master: Error: service(imap-login): command startup failed, throttling for 8.000 secs Oct 06 15:23:53 master: Error: service(pop3-login): command startup failed, throttling for 8.000 secs Oct 06 15:25:45 master: Error: service(imap-login): command startup failed, throttling for 16.000 secs Oct 06 15:25:53 master: Error: service(pop3-login): command startup failed, throttling for 16.000 secs Oct 06 15:27:45 master: Error: service(imap-login): command startup failed, throttling for 32.000 secs Oct 06 15:27:53 master: Error: service(pop3-login): command startup failed, throttling for 32.000 secs Oct 06 15:28:23 master: Error: service(stats): command startup failed, throttling for 2.000 secs Oct 06 15:28:25 master: Error: service(stats): command startup failed, throttling for 4.000 secs Oct 06 15:29:44 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Oct 06 15:29:53 master: Error: service(pop3-login): command startup failed, throttling for 60.000 secs Is there any option that I can run those services manually so I can see what's going on and why those are not stating? or any other option to debug it? This is my current config: # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.14.0-284.11.1.el9_2.x86_64 x86_64 Ubuntu 22.04.2 LTS # Hostname: xxxxxx auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_mechanisms = PLAIN LOGIN auth_verbose = yes base_dir = /var/run/dovecot default_client_limit = 4096 default_process_limit = 500 default_vsz_limit = 640 B deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, delivery_time=%{delivery_time}ms, %$ dict { acl = mysql:/etc/dovecot/dovecot-share-folder.conf lastlogin = mysql:/etc/dovecot/dovecot-last-login.conf quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf } first_valid_uid = 2000 imap_hibernate_timeout = 30 secs imap_max_line_length = 2 M last_valid_uid = 2000 listen = * login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c %k mail_attribute_dict = file:%Lh/dovecot-attributes mail_debug = yes mail_gid = 2000 mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/ mail_plugins = acl mail_log mailbox_alias notify quota mail_uid = 2000 mailbox_list_index_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace { inbox = yes location = mailbox Archive { auto = no special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } mailbox "Deleted Messages" { auto = no autoexpunge = 60 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe autoexpunge = 60 days special_use = \Junk } mailbox "Junk E-mail" { auto = no autoexpunge = 60 days special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = no autoexpunge = 60 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 60 days special_use = \Trash } prefix = separator = / type = private } namespace { list = children location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%Ld/%%Ln prefix = Shared/%%u/ separator = / subscriptions = yes type = shared } passdb { args = /etc/dovecot/dovecot-master-users driver = passwd-file master = yes } passdb { args = /opt/iredmail/custom/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { acl = vfile acl_shared_dict = proxy::acl imapsieve_mailbox1_before = file:/opt/iredmail/bin/dovecot/sieve/report_spam.sieve imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/opt/iredmail/bin/dovecot/sieve/report_ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * imapsieve_url = sieve://127.0.0.1:4190 last_login_dict = proxy::lastlogin last_login_key = # hidden, use -P to show it mail_log_events = delete undelete expunge copy save mailbox_create mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from subject flags mailbox_alias_new = Sent Messages mailbox_alias_new2 = Sent Items mailbox_alias_old = Sent mailbox_alias_old2 = Sent quota = dict:user::proxy::quotadict quota_grace = 50M quota_rule = *:storage=1G quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u sieve = ~/sieve/dovecot.sieve sieve_before = /var/vmail/sieve/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /var/vmail/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_max_redirects = 30 sieve_pipe_bin_dir = /opt/iredmail/bin/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = recipient sieve_vacation_send_from_recipient = yes } protocols = pop3 imap sieve lmtp service anvil { process_limit = 1 unix_listener anvil-auth-penalty { group = vmail mode = 0660 user = vmail } } service auth { client_limit = 4096 inet_listener { port = 12346 } process_limit = 1 unix_listener /var/spool/postfix/private/dovecot-auth { group = vmail mode = 0666 user = vmail } unix_listener auth-master { group = vmail mode = 0666 user = vmail } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0660 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = vmail user = vmail } } service imap-login { client_limit = 0 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 0 service_count = 0 } service imap { process_limit = 4096 unix_listener imap-master { group = vmail mode = 0666 user = vmail } } service lmtp { executable = lmtp -L inet_listener lmtp { port = 24 } process_min_avail = 5 user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { client_limit = 0 inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } process_limit = 0 service_count = 0 } service pop3 { process_limit = 4096 } service quota-status { client_limit = 1000 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /opt/iredmail/bin/dovecot/quota_warning.sh unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } service stats { inet_listener stats { address = 0.0.0.0 port = 24242 } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </opt/iredmail/ssl/cert.pem ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes syslog_facility = local5 userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep imap_metadata = yes mail_max_userip_connections = 30 mail_plugins = acl mail_log mailbox_alias notify quota imap_quota imap_acl imap_sieve last_login zlib } protocol pop3 { mail_max_userip_connections = 30 mail_plugins = acl mail_log mailbox_alias notify quota last_login zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } protocol lda { lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_plugins = acl mail_log mailbox_alias notify quota sieve last_login } protocol lmtp { lmtp_save_to_detail_mailbox = yes mail_plugins = acl mail_log mailbox_alias notify quota sieve last_login recipient_delimiter = + } Thank you! [ http://www.colombiahosting.com/ ] Jose Bravo

4 4

sieve processing - enable/disable per user?
by Arkadiusz Miśkiewicz 07 Oct '23

07 Oct '23

Hi. I keep users in database and would like to enable/disable sieve for them per user. What's the approach for that? I'm looking at the sieve options and user_query setting but don't see anything that would make this possible. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

3 5

Shared mailboxes and indexes
by Francis Augusto Medeiros-Logeay 06 Oct '23

06 Oct '23

Hi, I googled a bit to see if I understand it, but no, I haven’t got anything that explains this: What’s exactly the difference between INDEX and INDEXPVT for shared mailboxes? Why are they pointing to the same folder on Dovecot example (https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… Best, Francis

1 0

Pay Someone to Take My Online Course?1
by xotawa2329＠hapincy.com 06 Oct '23

06 Oct '23

[b]Pay Someone to Take My Online Course?[/b] Different understudies who battle with reworking school, work, and family obligations select online class tutors to assist them with finishing their tests and complete their coursework. In any case, some solicitation the ethicality of this planning. While [url=https://onlineclassservices.com/nurs-fpx-4040-assessment-4-attempt-1-in… FPX 4040 Assessment 4[/url] has every one of the reserves of being enticing, it goes with two or three serious dangers. This article will examine a piece of the things you ought to remember going before enlisting an online class help association. It's clearly a fact that online classes can be truly troublesome, particularly for working professionals who have a clamoring plan. Oftentimes they are searching for someone to take a whole course or individual tasks for them, to assist with managing their grades and moderate their strain. Nonetheless, be wary of affiliations that guarantee too wonderful to be authentic. They could charge you enormous totals for their associations and end up not conveying. The best technique for guaranteeing that you are getting anything that would be fair is to use an online class tutor who offers an inadequate responsibility. Additionally, review that different schools consider paying someone to take an online class to swindle. Therefore, whenever got, you could go facing silly outcomes like besieging the course, scholarly suspension or even send off. To this end picking a fair relationship with a showed history is crucial. The association is clear: present your mentioning and survey offers from qualified educated authorities. Then enlist the one that is reasonable for yourself and store maintains in [url=https://onlineclassservices.com/nurs-fpx-4050-assessment-1-attempt-3-pr… FPX 4050 Assessment 1[/url] scrow until your assignment is finished. Online classes are eminent among understudies who need to save time on education and spotlight more on work or other private issues. These merge understudies who are taking courses while working and attempting to change family and profession responsibilities, military understudies on sending, and understudies with genuine inadequacies or sickness that make it pursuing for them to go to classes. Unfortunately, there are many tricks that confirmation to take online courses for you. These affiliations charge ridiculous totals and don't complete their obligations. They may also hand you over to your school. Tolerating that they do, you could be killed from your underwriting project or even suspended or removed from school. This isn't the very thing that you truly need for your business and future. Therefore, you genuinely need to track down serious areas of strength for a that offers a fair cost and mind blowing results. To this end you ought to search for a [url=https://onlineclassservices.com/nurs-fpx-4050-assessment-2-attempt-1-et… FPX 4050 Assessment 2[/url] affiliation that has an inadequate responsibility and splendid customer association. Various individuals decide to use a professional to take their online class since they need the opportunity to go to it very close. They could be working the whole day, supervising family issues, or fighting disease and disappointments that log jam their review tendencies. These professionals can assist you with fulfilling time necessities, stay away from imaginative theft, and set free your nights to zero in on work or other unwinding works out. They may comparatively have the decision to help you with beating any learning handicaps you have. Copyright infringement suggests utilizing someone else's words and thoughts without their endorsement. It is viewed as a kind of cheating and can accomplish a delicate grade or even send off from school. It is difficult to ensure that a used professional won't phony. This is on the grounds that educational foundations don't have [url=https://onlineclassservices.com/nurs-fpx-4900-assessment-1-assessing-th… FPX 4900 Assessment 1 Assessing the Problem[/url] assets for check whether understudies are authentic or not. This truly expects that tolerant you are gotten, you will probably lose the cash you paid to have someone take your class. There's no veritable strategy for remaining caution assuming the solitary you enroll to take your online course will tell the truth and dependable. They probably won't be in a tantamount state as you. Moreover, they apparently won't be as dedicated to finishing the class for you as you are. They may very well be doing the base extent of work expected to get reviewed and a brief time frame later vanish. MORE [url=https://dev.gajim.org/gajim/website/-/issues/35#note_211778]Facebook is a powerful tool for business[/url] [url=https://xtremepape.rs/members/horridhenry7860.397211/about]Mobile Application Development Services[/url] [url=https://xtremepape.rs/members/samfarrid4563.397213/about]best digital marketing agencies[/url]

5 5

Is XOAUTH2 support broken in 2.3.21?
by Christian Rößner 05 Oct '23

05 Oct '23

Hi, I use Roundcube with OIDC. Everything works fine in Dovecot 2.3.20, but broke in 2.3.21. Downgrading to 2.3.20 makes it work again, so it is introduced in the newer release. Error (2.3.21): ``` Oct 4 11:03:57 mx dovecot[558531]: imap-login: Disconnected: Connection closed (client didn't finish SASL auth, waited 1 secs): user=<christian(a)roessner.email>, orig_user=<christian(a)roessner.email>, method=XOAUTH2, rip=192.168.0.4, lip=192.168.0.2, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) ``` Here is an example with 2.3.20: Success (2.3.20): ``` Oct 4 11:17:21 mx dovecot[889914]: imap-login: Login: user=<christian(a)roessner.email>, orig_user=<christian(a)roessner.email>, method=XOAUTH2, rip=192.168.0.4, lip=192.168.0.2, mpid=891874, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) ``` Kind regards Christian Rößner -- Rößner-Network-Solutions Zertifizierter ITSiBe / CISO Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP fingerprint: 658D 1342 B762 F484 2DDF 1E88 38A5 4346 D727 94E5

3 12

Re: How to reduce the number of UNIX sockets?
by Joseph Tam 05 Oct '23

05 Oct '23

From: Steve Litt <slitt(a)troubleshooters.com> > Recently I've been getting the dreaded X error "Maximum number of > clients exceeded", so I performed an lsof -U to find who was using > UNIX sockets. This uncovered a buggy looping program I wrote using up > gobs of UNIX sockets, along with some browsers, dbus-daemon, electron > (used by vscode), smbd, and Dovecot, which uses 36 UNIX sockets. Only 36? The number of sockets seems to scale proportionally with the number of users. The login process of my service easily consumes several hundred sockets and could on occasions run into the thousands. (See also my previous posts on socket starvation.) Each client connection will consume a few sockets -- it uses maybe a few more than some applications do as they separate privileged daemons from worker daemons, and pass data around via sockets, but socket use if within reason. > I can kill dbus-daemon and the buggy program I wrote, minimize use of > browsers, disable smbd except when I (rarely) need it, but can you > think of things I can do to reduce the number of UNIX sockets used by > Dovecot on my machine? You can limit the number of clients per IP (e.g. mail_max_userip_connections) to lower the number of concurrent mailboxes that are open. Or use the idle process facility to park inactive connections (not sure if that frees sockets). Or cap the number of clients (process_limit, service_count, etc.), but if you're bumping up against those limits, you've either underprovisioned your service or you have something misconfigured. (Again, see my previous post on service_limit.) Maybe you need to *increase* those limits if you're hitting some client limit in regular use. From what you describe, you resolved the cause of your socket starvation whose cause was not dovecot. I'm not sure what you hope to gain by saving a few sockets that dovecot uses just to make headroom for a buggy script. Joseph Tam <jtam.home(a)gmail.com>

1 0

How to reduce the number of UNIX sockets?
by Steve Litt 04 Oct '23

04 Oct '23

Hi all, I'm using Dovecot version 2.3.21 on an up to date Void Linux on a 6 core 12 thread Ryzen with 48GB RAM, 1TB NVMe, and 12TB of 7200 RPM spinning rust hard drives. Recently I've been getting the dreaded X error "Maximum number of clients exceeded", so I performed an lsof -U to find who was using UNIX sockets. This uncovered a buggy looping program I wrote using up gobs of UNIX sockets, along with some browsers, dbus-daemon, electron (used by vscode), smbd, and Dovecot, which uses 36 UNIX sockets. I can kill dbus-daemon and the buggy program I wrote, minimize use of browsers, disable smbd except when I (rarely) need it, but can you think of things I can do to reduce the number of UNIX sockets used by Dovecot on my machine? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

1 0

Plugin to cleanup/remove unused user defined keywords(IMAP PERMANENTFLAGS) possible ?
by sergey＠srgdev.com 03 Oct '23

03 Oct '23

I found a reference to a similar issues here: https://www.dovecot.org/list/dovecot/2010-March/047925.html I know IMAP rfc say nothing about removing the keywords/PERMANENTFLAGS (they can only be added https://www.rfc-editor.org/rfc/rfc3501.html#page-64) , therefore I wonder if it is possible to create a Dovecot plugin to accomplish this task ? Technically it is possible to do now via the following steps: 1. Ensure the "unwanted" user defined keyword/flag is remove from all messages in a folder (Folder A) 2. Create a temporary folder (Folder A_temp) 3. Move all messages from Folder A -> Folder A_temp 4. Delete Folder A 5. Rename Folder A_temp -> Folder A As you can see this highly inefficient and awkward and even if the unwanted keyword does NOT appear in Folder A anymore , it still can be found in '~/Maildir/dovecot-keywords' file Alternatively, if it is hard to create a plugin that would remove the keyword for good, would something like this be easier: 1. Define a list of "allowed" user defined keywords 1a. Perhaps this list can be defined via METADATA extension on per folder basis 2. Reject(or discard) "not allowed" keyword sent via the +FLAGS / +FLAGS.SILENT commands Any helpful plugin example or code references would be greatly appreciated. Thank you very much, Sergey Mosin

1 0

Dovecot List server
by Paul Enlund 03 Oct '23

03 Oct '23

Hi Is there a contact address for operation of this list server. I have some observations regarding ARC signing to share. Regards Paul

2 1

Ping
by Paul Enlund 03 Oct '23

03 Oct '23

just a test sorry for noise _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Compression: all or nothing?
by Alex King 03 Oct '23

03 Oct '23

Using 2.3.13 (89f716dc2) (debian package), with mdbox storage. I considering adding the zlib plugin. I understand that reading mail can cope with either compressed or uncompressed mailboxes. I'm wondering if I can leave the main storage uncompressed, while having the alternate storage compressed. There does not seem to be a way to configure this, from https://doc.dovecot.org/settings/plugin/zlib-plugin/ it seems compression (on saving emails) is an all-or-nothing option? Can I leave zlib_save unset in my main configuration, and have doveadm use some alternate configuration with zlib_save set? It doesn't look hopeful because I don't see the ability to use a different config at https://wiki.dovecot.org/Tools/Doveadm/Altmove. Perhaps I would need multiple copies of the daemon running? Or is it better just to compress everything? I plan to store older mails (perhaps 3months+) in the alternative storage, and was thinking it would be nice to have those compressed, while I don't need to compress the main store. Any feedback welcome. Thanks, Alex

2 2

Ping
by Paul Enlund 02 Oct '23

02 Oct '23

just a test sorry for noise

1 0

Re: Changed separator, sub folders not showing new e-mail
by Francis Augusto Medeiros-Logeay 02 Oct '23

02 Oct '23

I found the answer here: https://apple.stackexchange.com/questions/441313/no-mailbox-doesnt-exist-se… Apparently on Mac one needs to update the separator on a file, since it doesn’t seem that the Mail.app does it for itself. On the iPhone it happened automatically. Best, Francis

1 0

Changed separator, sub folders not showing new e-mail
by Francis Augusto Medeiros-Logeay 02 Oct '23

02 Oct '23

Hi, I recently changed the mailbox separator from '.' to '/' so that I could have shared mailboxes working. However, while the mailboxes show fine on Roundcube and on other web-based e-mail clients, on the Mail.app on my Mac I don't get newer messages on those sub folders. For example, I have a subfolder Test. Mails filtered to be dropped there, show fine. But I have one called Lists, with a sub folder called "Dovecot". I can't read mails that are under "Lists/Dovecot". Can anyone help? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

1 0

Separators and shared namespaces
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Hi Martin, I had a similar problem: https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/DNHM3… It seemed to me that using ‘.’ truncated the domain name when that was used in the paths, such as when using %d. Best, Francis

2 1

How to use http api doveadm to manage acl permissions
by cyril.leclerc＠mantiq.com 28 Sep '23

28 Sep '23

I started the http api on dovecot configuration but following the documentation available here : https://doc.dovecot.org/admin_manual/doveadm_http_api/ I dont see anything regarding the acl permissions ? do we have to use a specific command ? how to manage a user acl permissions ( change the content of dovecot-acl file ?

3 10

Re: Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Hi, I have read elsewhere that the Maildir shouldn’t be at the home. But that’s how it worked for me since the start. I wonder if I could either change the location of these .dovecot.lda-dupes, or if I could change home without having to move the mailboxes of all the users. Today I have this: On my dovecot-sql.conf.ext: iterate_query = SELECT username AS user FROM mailbox user_query = SELECT CONCAT('/var/mail/vmail/',maildir) AS home, \ CONCAT('maildir:/var/mail/vmail/',maildir,':INDEX=/var/vmail-index/index/%d/%n:CONTROL=/var/vmail-index/control/%d/%n') AS mail, \ 5000 AS uid, 5000 AS gid, CONCAT('*:bytes=',quota) AS quota_rule \ FROM mailbox WHERE username = '%u' AND active = 1 password_query = SELECT username AS user,password FROM mailbox \ WHERE username = '%u' AND active=‘1' On my 10-mail.conf mail_location = maildir:/var/mail/vmail/%d/%n:INDEX=/var/vmail-index/index/%d/%n:CONTROL=/var/vmail-index/control/%d/%n If I add `Maildir` to the mail_location and to the mail user_query, will I have to move mailboxes, or the only thing I have to do is to add “Maildir” when I use %h/%%h? Best, Francis

1 0

Re: Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 28 Sep '23

28 Sep '23

Never mind, I found it. I had to add `replication_dsync_parameters`, with the default values, but with `-x shared` to exclude the namespace. Best, Francis

1 0

Dovecot lda-dupes
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, Since I enabled shared mailboxes I'm having these errors: Sep 27 21:22:41 doveadm(francis(a)med-lo.eu): Error: Failed to access mailbox dovecot/lda-dupes: stat(/var/mail/vmail/med-lo.eu/francis/.dovecot.lda-dupes/tmp) failed: Not a directory And replication stopped. How can I fix this? Best, Francis

1 0

Separators and shared namespaces
by martin f krafft 27 Sep '23

27 Sep '23

Hello, I am running Dovcecot 2.3.19 on Debian, and I am trying to get shared to work. It's working if I do this: ``` namespace { type = shared separator = / prefix = Team/%%u/ location = maildir:%%h/Maildir:INDEX=%h/Maildir/Team/%%u:INDEXPVT=%h/Maildir/Team/%%u subscriptions = no list = children } ``` After setting some ACLs, I now have the following in `LIST` output: ``` … . LIST "" * * LIST (\HasNoChildren) "/" INBOX […] * LIST (\Noselect \HasChildren) "/" Team/rechnungseingang(a)example.org * LIST (\HasNoChildren) "/" "Team/rechnungseingang(a)example.org/Archiv bearbeitete Rechnungen" . OK List completed (0.003 + 0.000 + 0.007 secs). ``` However, since I am using Maildir, the default separator is `.`, and so I have to change the separator for the `inbox` namespace, which makes me feel uneasy. The system still uses `.dotted.notation` on the filesystem despite the namespace change, and subfolders and all still work, but it still rubs me the wrong way to do this. And yet, when I try to use `.` like this: ``` separator = . prefix = Team.%%u. location = maildir:%%h/Maildir:INDEX=%h/Maildir/.Team,%%u:INDEXPVT=%h/Maildir/.Team.%%u ``` then nothing shows up in `LIST` output. Any idea why this might be? Thanks, -- martin krafft | https://matrix.to/#/#madduck:madduck.net "den stil verbessern, das heißt den gedanken verbessern." - friedrich nietzsche {: .blockquote } spamtraps: madduck.bogus(a)madduck.net {: .hidden }

2 2

Re: Separators and shared namespaces
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, When I used a ‘.’ as a separator, it seemed to truncate paths with the domain name, such as those with %%d. That happened only to shared namespaces. Best, Francis

1 0

Exclude shared mailboxes from replication
by Francis Augusto Medeiros-Logeay 27 Sep '23

27 Sep '23

Hi, I was wondering if it is possible to exclude shared mailboxes from replication. I have userb(a)mydomain.com sharing mailboxes to usera(a)mydomain.com. However, since both mailboxes already replicate to a backup server, I wonder if it is possible to exclude the replicated mailboxes from syncing. Best, Francis

1 0

is dovecot 2.3.20 compatible with YESCRYPT?
by Andrew Hoff 26 Sep '23

26 Sep '23

To Whom It May Concern, Fedora 38 uses YESCRYPT by default to create the passwords stored in "shadow". The prefix is "$y$". Ref: https://doc.dovecot.org/configuration_manual/authentication/password_scheme… The nearest supported password scheme is blowfish. Can dovecot 2.3.20 read passwords created with YESCRYPT? Regards, -- Andrew Hoff 6/10 Middle Road Maribyrnong 3032 Victoria Australia Tel: 0393185581 (unreachable outside of Australia) Mob: 0400966178 Email: andrew.hoff(a)bigpond.com

2 2

Re: expunge & sh error
by Joseph Tam 26 Sep '23

26 Sep '23

From: "Данила Колесников" <d1kolesnikov(a)gmail.com> > I would like to expunge Inbox mailbox every 60 days > This mailbox is not in the config any I try to use "doveadm expunge". > But my sh configs doesn't works: Fatal: Invalid search date parameter: 60d > If I enter the contents of the config directly into the console - > everything works correctly > the same code in sh - ends with an error. This sounds like a shell parsing error rather than a dovecot bug. What is the exact command you are using? Are you trying to empty your INBOX every 60d, or rather, remove messages older than 60days? If the former, you can probably just delete the entire INBOX folder or mailbox via filesystem commands as an alternative. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

It works everywhere now. I guess it just needed its sweet time.

1 0

Re: All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

I found what the problem was. It seems that using ‘.’ as a separator worked. But somehow folders and domain names with dots got messed up: maildir++: root=/var/mail/vmail/francisaugusto/francis, index=/var/mail/vmail/med-lo.eu/francis/shared/index/francis@francisaugusto, indexpvt=/var/mail/vmail/med-lo.eu/francis/shared/francis@francisaugusto, control=, inbox=/var/mail/vmail/francisaugusto/francis, alt= Sep 25 19:10:57 imap(francis(a)med-lo.eu)<58061><skunigB>: Debug: Namespace shared.francis@francisaugusto.: Creating storage despite: Root mail directory doesn't exist: /var/mail/vmail/francisaugusto/francis You see, my domain is francisaugusto.com <http://francisaugusto.com/>, but it got truncated. I changed the separator to ‘/‘ on the Inbox namespace and on the shared one, and voila, it worked. I can see my shared mailboxes everywhere. But on Apple Mail (both on the Mac and on the iPhone), the shared mailboxes show no message. Any clue why?

1 0

Sieve vacation function sends auto-reply with generic From: Address
by Thomas Boroske 25 Sep '23

25 Sep '23

Good day to you all. I have a question regarding the dovecot sieve vacation function that I am unable to answer myself by reading the documentation. A while ago we moved our dovecot server to a newer system (and newer dovecot version 2.3.16 ). This worked mostly fine, except there is now an issue with the auto-reply emails send from sieve vacation scripts. While the sending of the auto reply generally works fine, the emails always appear to come from the "sysgroup(a)ida.ing.tu-bs.de" address rather than the original recipient of the message. This is bad since the recipient of the auto reply then has no idea who the person on vacation actually is (unless there is a name in the message body). The sieve scripts are managed by roundcube webmail, an example entry for a vacation rule looks like this: require ["vacation"]; # rule:[Vacation] if true { vacation :days 7 :subject "Nicht im Büro" :from "tbtest(a)ida.ing.tu-bs.de" "Ich bin nicht da!"; } This looks ok to me. The problem is that the "tbtest" address is not used in the generated reply, instead sysgroup(a)ida.ing.tu-bs.de is used as a from address for all recipients. Note that the sysgroup@ address appears nowhere in the dovecot config, but it does in /etc/postfix/sender-canonical like that: root(a)ida.ing.tu-bs.de sysgroup(a)ida.ing.tu-bs.de @ida.ing.tu-bs.de sysgroup(a)ida.ing.tu-bs.de @net.ida sysgroup(a)ida.ing.tu.bs.de The /etc/dovecot/conf.d/90-sieve.conf is mostly on default values, the remaining config settings are these: plugin { sieve = file:~/Maildir/sieve;active=~/Maildir/.dovecot.sieve sieve_extensions = +editheader #Send vacation auto responder with correct Address sieve_vacation_send_from_recipient = yes sieve_vacation_use_original_recipient = no } I have attached the output of "dovecot -n" below. Many thanks for any ideas on what could be the issue! Kind regards, Thomas -- Dipl. Inf. Thomas Boroske Institute of Computer and Network Engineering TU Braunschweig Hans-Sommer-Str. 66, D-38106 Braunschweig, Germany www.ida.ing.tu-bs.de

2 2

All list=yes namespaces must use the same separator - don't they?
by Francis Augusto Medeiros-Logeay 25 Sep '23

25 Sep '23

Hi, I am trying to configure shared mailboxes, so I enabled the acl and the imap_acl plugins. But I got the "All list=yes namespaces must use the same separator" error when I added this: namespace { type = shared #separator = # Mailboxes are visible under "shared/user@domain/" # %%n, %%d and %%u are expanded to the destination user. prefix = shared/%%u/ # Mail location for other users' mailboxes. Note that %variables and ~/ # expands to the logged in user's data. %%n, %%d, %%u and %%h expand to the # destination user's data. location = maildir:/var/mail/vmail/%%d/%%n:INDEX=/var/mail/vmail-index/index/%%d/%%n:INDEXPVT=/var/mail/vmail-index/index/%%d/%%n # Use the default namespace for saving subscriptions. subscriptions = no # List the shared/ namespace only if there are visible shared mailboxes. list = children } I don't have any separator configured explicitly, and when I see the config, the value is empty. So I don't really know what is the problem here. Any hints? Best, Francis -- Francis Augusto Medeiros-Logeay Oslo, Norway

1 0

expunge & sh error
by Данила Колесников 24 Sep '23

24 Sep '23

Hello! I would like to expunge Inbox mailbox every 60 days This mailbox is not in the config any I try to use "doveadm expunge". But my sh configs doesn't works: Fatal: Invalid search date parameter: 60d If I enter the contents of the config directly into the console - everything works correctly the same code in sh - ends with an error. It is bug or I do mistake? root@mail:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-84-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mail.onelec.ru auth_mechanisms = plain login auth_verbose = yes base_dir = /run/dovecot/ disable_plaintext_auth = no log_path = /var/log/dovecot.log login_greeting = Mail Delivery Agent mail_access_groups = mail mail_location = maildir:%h/mail/%d/%n mail_privileged_group = mail namespace { inbox = yes list = yes location = mailbox Archive { auto = subscribe autoexpunge = 30 days special_use = \Archive } mailbox "Deleted Messages" { auto = no autoexpunge = 1 weeks special_use = \Trash } mailbox Drafts { auto = subscribe autoexpunge = 1 weeks special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 1 weeks special_use = \Junk } mailbox Sent { auto = subscribe autoexpunge = 90 days special_use = \Sent } mailbox "Sent Mail" { auto = no autoexpunge = 90 days special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 90 days special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 1 weeks special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 1 weeks special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } plugin { quota = maildir:User quota } protocols = imap pop3 service auth { extra_groups = mail unix_listener auth-client { group = mail mode = 0660 user = dovecot } user = dovecot } service stats { unix_listener stats-writer { group = mail mode = 0660 user = dovecot } } ssl_cert = </usr/local/hestia/ssl/certificate.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota } local_name mail.bearlion.ru { ssl_cert = </home/bearlion/conf/mail/bearlion.ru/ssl/bearlion.ru.pem ssl_key = # hidden, use -P to show it } local_name mail.onelec.ru { ssl_cert = </home/onelec/conf/mail/onelec.ru/ssl/onelec.ru.pem ssl_key = # hidden, use -P to show it } local_name mail.radiokey.ru { ssl_cert = </home/radiokey/conf/mail/radiokey.ru/ssl/radiokey.ru.pem ssl_key = # hidden, use -P to show it }

2 1

possible doveadm expunge bug
by Noel Butler 24 Sep '23

24 Sep '23

In my boredom, I was cleaning up my own public mailbox, do I really need lists/newsletters/forums posts from the 90's .. I think not, but lets still keep 5 years and expunge the rest... or try to... but expunge doesnt want too... This error or lack of action, occurs on any mailbox, as an example doveadm expunge -u my@email mailbox Lists.FreeRadius SAVEDBEFORE $ now for $, pick your value 5 y/Y for years doesn't appear to exist, so converting it into 30 odd weeks, 30w or 30W did nothing, but rough convert it down to days 1800D appears to do something - showing a delay before returning to command line, but in reality it does nothing, 1800, 1500, 1200, nothing, only when I drop it to 1000D does it actually work, which is not suitable, since I'd like to keep 5 years worth. Running doveadm -Dv exp... shows no errors just usual debug output about the base modules, quota stuff, and opening mailbox message followed then by user session closed, nothing at all anywhere that points to an error for executing this task, I did deliberately break it by altering the mailbox name to test and it rightfully did report the error the mailbox doesn't exist. I thought it might be size related, freeradius one of the smaller lists having about 150k to nanog the biggest with over 400k message, but I have others, like monthly newsletters with over 20yrs worth, but only 250 to 300 messages in their mailboxes that also fail, so it can't be barfing out at the size. Aki, any ideas? Or have I have hit a ridiculously low 1000D hard coded limit? ...and I know some troll will comment, so let me say yes I know I can and will likely have to use nix's "find" to actually cull them, but if doveadm has an expunge option, it should do what it is asked of it :) # doveconf -a # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.15.117 x86_64 Slackware 15.0 ext4 - Yes I know 2.3.21 was released 2 days ago, but I'm not seeing anything in changelog/NEWS that's related -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

2 2

Dovecot OIDC question
by dovecot＠deeztek.net 23 Sep '23

23 Sep '23

Exploring the possible use of SSO using OIDC with Dovecot. Trying to understand the functionality of OIDC as it pertains to e-mail clients like Thunderbird, Outlook etc... My OIDC provider will authenticate a user by intercepting the connection attempt to the resource, present a login screen and after success it will redirect to the resource. When it comes to e-mail clients, how would that process work if at all? Thanks

1 0

2.3.21 broke XOAUTH authentication against Keycloak
by tj＠interseclab.org 23 Sep '23

23 Sep '23

I have Roundcube and Dovecot2 setup to authenticate against Keycloak using the XOAUTH2 method, as follows: introspection_url = https://[...]/realms/[...]/protocol/openid-connect/token/introspect introspection_mode = post username_attribute = email client_id = [...] client_secret = [...] tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt Since upgrading to 2.3.21 XOAUTH2 fails to authenticate with: dovecot: auth: Error: oauth2([...],[...],<[...]>): oauth2 failed: Introspection failed: No username returned WARN [org.keycloak.events] (executor-thread-45) type=INTROSPECT_TOKEN_ERROR, realmId=[...], clientId=null, userId=null, ipAddress=[...], error=client_not_found WARN [org.keycloak.events] (executor-thread-45) type=INTROSPECT_TOKEN_ERROR, realmId=[...], clientId=null, userId=null, ipAddress=[...], error=invalid_request, detail='Authentication failed.' Downgrading to 2.3.20 fixes the issue. I believe this change is to blame: lib-oauth2: Dovecot would send client_id and client_secret as POST parameters to the introspection server. These need to be optionally in Basic auth instead. Is there anything I should change in my Keycloak/Dovecot config or is this a bug?

2 1

Change location where .dovecot.lda-dupes* file/dir are created
by sahsanu 22 Sep '23

22 Sep '23

Hello, I'm using Dovecot 2.3.19.1 and Pigeonhole 0.5.19 on Debian 12.1 and I'm trying to use sieve extensions vacation and redirect but I'm having issues because of the creation of file /home/USER/.dovecot.lda-dupes and dir /home/USER/.dovecot.lda-dupes.locks The error in logs is pretty clear, lda doesn't have perms to create any of them because /home/USER/ is owned by root # namei -mo /home/user2/ f: /home/user2/ drwxr-xr-x root root / drwxr-xr-x root root home drwxr-xr-x root root user2 I'm using Hestia Control Panel and it chroot the users and that is the reason the user's home is owned by root. Mail users are virtual and the maildir home is /home/user2/mail/domain2.tld/postmaster (%h/mail/%d/%n) but the .dovecot.lda-dupes* file and dir are trying to use /home/user2/ instead of /home/user2/mail/domain2.tld/postmaster/ where they have perms and that should solve the issue. So, the question, is there any way to create .dovecot.lda-dupes* file/dir in virtual user's home %h/mail/%d/%n instead of user's home %h? or, is there any other solution/workaround where I don't need to change /home/USER/ owner/perms? If you want to check them, below are the logs and my dovecot conf. Appreciate your support. Best regards, sahsanu This is the sieve log using vacation extension: sieve: info: started log at 2023-09-21 13:17:06 +0200. error: msgid=<102288b1348f270d83363f71bb7bcc81(a)example.com>: vacation action: failed to check for duplicate vacation response: internal error occurred: refer to server log for more information. [2023-09-21 13:17:06]. This is the dovecot log using sieve vacation extension: Sep 21 13:17:06 lda(postmaster(a)domain2.tld)<2711250><SHdgDzImDGXSXikAElSLcQ>: Error: duplicate db: transaction: file_dotlock_open(/home/user2/.dovecot.lda-dupes) failed: Permission denied Sep 21 13:17:06 lda(postmaster(a)domain2.tld)<2711250><SHdgDzImDGXSXikAElSLcQ>: Error: duplicate db: transaction: Failed to lock /home/user2/.dovecot.lda-dupes.locks/duplicate.lock.ea887f77f1f61464f902ada5e7bfb022: mkdir_parents(/home/user2/.dovecot.lda-dupes.locks) failed: Permission denied This is the sieve log using redirect extension: sieve: info: started log at 2023-09-21 16:51:46 +0200. error: msgid=<8f1cdb9c-0997-4e32-a28f-65e5f3f8dca6.maildroid@localhost>: redirect action: failed to check for duplicate forward: internal error occurred: refer to server log for more information. [2023-09-21 16:51:46]. This is the dovecot log using sieve redirect extension: Sep 21 16:51:46 lda(postmaster(a)domain2.tld)<2785960><03j9DoJYDGWogioAElSLcQ>: Error: duplicate db: transaction: file_dotlock_open(/home/user2/.dovecot.lda-dupes) failed: Permission denied Sep 21 16:51:46 lda(postmaster(a)domain2.tld)<2785960><03j9DoJYDGWogioAElSLcQ>: Error: duplicate db: transaction: Failed to lock /home/user2/.dovecot.lda-dupes.locks/duplicate.lock.291440db1d5e4457ecf50cd02882634b: mkdir_parents(/home/user2/.dovecot.lda-dupes.locks) failed: Permission denied Dovecot conf: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.0-12-amd64 x86_64 Debian 12.1 # Hostname: server.domain1.tld auth_mechanisms = plain login auth_verbose = yes base_dir = /run/dovecot/ log_path = /var/log/dovecot.log login_greeting = Mail Delivery Agent mail_access_groups = mail mail_attribute_dict = file:%h/mail/%d/%n/dovecot-attributes mail_location = maildir:%h/mail/%d/%n mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve namespace { inbox = yes list = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = no special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Mail" { auto = no special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = scheme=MD5-CRYPT username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } plugin { imapsieve_mailbox1_before = file:/var/mail/sieve/report_spam.sieve imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/mail/sieve/report_ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * imapsieve_url = sieve://127.0.0.1:4190 quota = maildir:User quota sieve = file:~/mail/%d/%n/sieve;active=~/mail/%d/%n/dovecot.sieve sieve_extensions = +notify +imapflags sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_send_from_recipient = yes } protocols = imap sieve service auth { extra_groups = mail unix_listener auth-client { group = mail mode = 0660 user = dovecot } unix_listener auth-master { group = mail mode = 0660 user = dovecot } user = dovecot } service managesieve-login { inet_listener sieve { port = 4190 } } service stats { unix_listener stats-writer { group = mail mode = 0660 user = dovecot } } ssl_cert = </usr/local/hestia/ssl/certificate.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES256-SHA256 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = username_format=%n /etc/exim4/domains/%d/passwd driver = passwd-file } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = " quota sieve" } protocol imap { mail_plugins = quota imap_quota imap_sieve } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 64 k } protocol pop3 { mail_plugins = quota } local_name domain1.tld { ssl_cert = </home/user1/conf/mail/domain1.tld/ssl/domain1.tld.pem ssl_key = # hidden, use -P to show it } local_name mail.domain1.tld { ssl_cert = </home/user1/conf/mail/domain1.tld/ssl/domain1.tld.pem ssl_key = # hidden, use -P to show it } local_name domain2.tld { ssl_cert = </home/user2/conf/mail/domain2.tld/ssl/domain2.tld.pem ssl_key = # hidden, use -P to show it } local_name mail.domain2.tld { ssl_cert = </home/user2/conf/mail/domain2.tld/ssl/domain2.tld.pem ssl_key = # hidden, use -P to show it }

2 4

State of wiki.dovecot.org?
by Sebastian Philipp 20 Sep '23

20 Sep '23

Hi all I just noticed that wiki.dovecot.org is no longer available, and instead redirects to a message stating that the documentation can now be found at doc.dovecot.org. However, there's was quite a lot of information on wiki.dovecot.org that is not available on doc.dovecot.org. One such example is the setup guide for a Dovecot Director cluster [1]. The "corresponding" page on doc.dovecot.org [2] even starts with the following sentence: > See http://wiki.dovecot.org/Director for more details. Are there plans to migrate such pages to doc.dovecot.org as well? If not, could the Wiki be restored? Of course it's possible to access the Wiki contents via web.archive.org, but that's rather cumbersome and slow. Thanks and regards Sebastian [1]: http://web.archive.org/web/20230212020603/https://wiki2.dovecot.org/Director [2]: https://doc.dovecot.org/configuration_manual/director_settings -- Adfinis AG Sebastian Philipp, Systems Engineer GPG Key ID: 0x8C920482C5CDA5FB Güterstrasse 86 | CH-4053 Basel Office: 061 500 31 31 www.adfinis.com

2 1

New Dovecot release?
by Taavi Ansper 20 Sep '23

20 Sep '23

Hi When will there be a new dovecot release. The 2.3.21 version borked our users with large amount of folders (i think over 255 folders) doveadm(REDACTED_USER): Error: /proc/self/status is larger than expected I can't find the debian bug report (or was it mentioned in this same mailing list), but somebody else has mentioned the same issue. I hope this gets fixed in the next version. -- Taavi Ansper taavi.ansper(a)cyber.ee

3 6

dovecot username with domain
by Michael Grant 20 Sep '23

20 Sep '23

I've been using dovecot using system usernames (my unix uname as my IMAP username). But today I tried New Outlook which requires the imap username match my email address. Is there some way to tell dovecot that username@host is the same as uname? (where username@host is an email address and uname is a unix login which might be completely different). Michael Grant

5 7

Logging for doveadm index?
by Shawn Heisey 15 Sep '23

15 Sep '23

I have dovecot using Solr for FTS. Dovecot version is 2:2.3.20-3+ubuntu20.04 pulled from the official APT repo. This is my reindex script: https://paste.elyograg.org/view/74accd23 The reindex script kicks off the indexing process in the background. Dovecot logs to syslog, and those logs ultimately end up in mail.log. I have not seen any logging for the FTS reindexing. Specifically I would like to see how long the process took. Getting that info from the solr logs is a manual process and I can't think of a way to properly automate it. Is this something I can easily have dovecot log? Or is there a way to have 'doveadm index' run in the foreground instead of the background so the time can be calculated by my script? Thanks, Shawn

1 0

Pigeonhole v0.5.21 released
by Aki Tuomi 15 Sep '23

15 Sep '23

Hi all! We are pleased to release v0.5.21 of Pigeonhole. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.21.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.21.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy --- - sieve: Using the deleteheader action on a message with a broken/invalid header can cause the Sieve interpreter to crash with an assert panic. This can happen e.g. when the message is missing the empty EOH line between the headers and the body of the message. Fixes: Panic: file edit-mail.c: line 820 (edit_mail_headers_parse): assertion failed: (body_offset > 0). - sieve: Pigeonhole added an extra Message-ID header during mail forwarding when the existing one was invalid. Now it adds the Message-ID only if it is entirely missing. Existing Message-ID(s) are left unchanged.

1 0

Dovecot v2.3.21 released
by Aki Tuomi 15 Sep '23

15 Sep '23

Hi all! We are pleased to release v2.3.21 of Dovecot. https://dovecot.org/releases/2.3/dovecot-2.3.21.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.21.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy --- * lib-oauth2: Allow JWT tokens to be validated with missing typ field. The typ field is left out by some key issuers to conserve space, notably kubernetes. Now missing typ is tolerated, but if present, it still must be "jwt". + auth: Auth passdb and userdb reply can contain "event_<name>=value" which will be added to login event and mail user event respectively. + lib-master: Set process title during various initialization stages to clearly describe what the process is waiting on. + lib-storage: The mail_temp_scan_interval is now fuzzed incrementing it by 0..30% based on username's hash to reduce the chance of load spikes . + lib-storage: The temp file scan has been moved from the open of the mailbox to the close, to reduce the latency perceived by users. + stats: If metric has fields specified, all these fields are exported as counters to prometheus exposition. See https://doc.dovecot.org/configuration_manual/stats/openmetrics/. - *-login: Processes might have crashed when a SSL connection disconnect s uncleanly. - acl: When plugin was loaded \HasChildren and \HasNoChildren flags were calculated incorrectly for mailboxes containing '*' and '%' in their names. - auth: Crash occured if a connection to PostgreSQL database server failed during startup. - auth: Logins with invalid passwords (e.g. unknown scheme) in passdb were failing with "password mismatch" instead of "internal error". - auth: XOAUTH2 and OAUTHBEARER mechanisms were not giving out protocol specific error message on all errors. This especially broke OIDC discovery. - dbox: When last_temp_file_scan header wasn't set (especially after dsync migration), the next mailbox open always triggers the temp file scan. This could have caused a load spike after migrations. Fixed by using the mailbox directory's atime when the header isn't set, which usually moves the scan time into the future. - dict-redis: A crash would occur on transaction rollback. - dsync: Infinite loop causing out of memory would occur when handling mailbox deletion from remote end and hierarchy separators would differ. - dsync: Incremental dsync failed for folder names ending with '%', unless BROKENCHAR was set. Also folder names with '%' elsewhere in them caused each incremental dsync to unnecessarily rename the folder to a temporary name and back. v2.3.19 regression. - imap-hibernate: If an IMAP client unhibernation timed out with "(version received)", the unhibernation could still have successfully finished later on and continued working normally. This was rather confusing, because imap-hibernate already logged that the client got disconnected. Avoid this by forcing the connection to shutdown on unhibernation timeout. - imapc: Crashed when a folder mapped through the virtual plugin disappears from the storage. - imapc: EXPUNGE, EXISTS or FETCH replies from a server for a previously selected mailbox could have been processed as if they belonged to the new mailbox currently being selected. This could have caused warnings. - lib-http: Dovecot HTTP server (doveadm, stats/openmetrics) may have disconnected HTTP clients before the response is fully sent. This happened only on busy servers where kernel's socket buffers were rather full. - lib-http: Fixed a potential crash on http-server if a client disconnected early. v2.3.18 regression. - lib-index: Index file corruption could have caused a crash. Fixes: Panic: file mail-transaction-log-view.c: line 165 (mail_transaction_log_view_set): assertion failed: (min_file_seq <= max_file_seq). - lib-index: Purging an existing >1GB cache file can crash. Now cache files still above 1GB after purging are removed. Fixes: Panic: file mail-index-util.c: line 10 (mail_index_uint32_to_offset): assertion failed: (offset < 0x40000000) - lib-lua: A HTTP client could not resolve DNS names in mail processes, because it expected "the dns-client" socket to exist in the current directory. - lib-oauth2: Dovecot would send client_id and client_secret as POST parameters to the introspection server. These need to be optionally in Basic auth instead. - lib-oauth2: JWT aud validation was not performed if aud was missing from a token, but was configured on Dovecot. - lib-oauth2: JWT key type check was too strict. - lib-oauth2: JWT token audience was not validated against client_id as required by the specification. - lib-ssl-iostream: Using the ssl_require_crl=yes setting may have caused CRL check failures for outgoing SSL/TLS connections, although it was supposed to affect checking CRLs only for client-side SSL certificates. v2.3.17 regression. - lib-sql: MySQL driver leaked memory when connection failed. - lib-storage: Various fixes when running into out of disk space. - master: Service idle_kill setting didn't work properly on busy servers. It was very unlikely that any process was idling long enough to become killed. Also the idle_kill handling code was using quite a lot of CPU on the master process when there were a lot of processes (e.g. imap). The new behavior is to track the lowest number of idling processes every idle_kill time interval and then kill that many idling processes. - mdbox: Temp file scan was done for always empty directories. - mdbox: The fdatasync() call was done in wrong parent directory when writing mails. Also on a failure it crashed instead of logging an error. - notify_status: The plugin crashes if any user initialization fails. - pop3: Sending command with the ':' character caused an assert-crash. v2.3.18 regression. Fixes: Panic: event_reason_code_prefix(): name has ':' - stats: Fix panic when a nonexistent event exporter was referenced while adding a new metric dynamically via doveadm stats add. This produces a proper error now. - stats: If process exported a lot of events and then exited, some of the last events may have become lost. - stats: Invalid Prometheus label names were created with specific histogram group_by configurations. Prometheus rejected these labels. - welcome: The plugin didn't execute in some situations that created INBOX but didn't open it, e.g. if GETMETADATA was used before the INBOX was opened.

1 0

config: Error: Conflict in setting ssl_cert found from filter
by Ján Ondrušek 15 Sep '23

15 Sep '23

Hi! I see this intermittent error with my dovecot setup. The most puzzling part is that it sometimes works and sometimes rejects connections, spitting out the log I attached in systeport (DNS). I am binding both ipv4 (TLS+SNI) and ipv6 (dedicated addresses). TLS certificates for corresponding DNS are shared across ipv4 / ipv6. Thank you, Best regards, Jan

2 3

ACL management from SQL
by cyril.leclerc＠mantiq.com 14 Sep '23

14 Sep '23

Hello, we are facing issue, we manage the shared folder from SQL table, but it was never working as we have to manage acl permission from the server itself, we want to manage permissions (read or write) from the same application we can share user mailbox but it is written in dovecot documentation that is not supported now, we tried to find a mail client that could manage it at least, but only thunderbird was able to do it (but in version 60) and not more today. We saw that roundcube could handle it but we use rainloop. 1. It is really not possible at all to manage acl permissions fron SQL like the shared box itself ? 2. I tried to set acl permissions from old version of thunderbird, when i made modification it tried to update the sharedbox table, i did not see the query executed but as we were working on a view, the update failed. Do you know what it tried to do ?

3 8

Shared mailbox listing not working
by exactoph 14 Sep '23

14 Sep '23

Hi there, Having trouble with shared mailboxes. Followed the documentation, but the IMAP LIST doesn't work for mailboxes besides "INBOX" etc. In the meantime I've switched from file based acl_shared_dict to DB based as some people had problems with it. However still no success. I can see entries in the DB, doveadm acl get ... returns that the mailbox is shared, but it is not listed in doveadm mailbox list ... My configuration: https://pastebin.com/aWnMXJ4J Help would be very appreciated!

3 2

Roundcube
by joe a 13 Sep '23

13 Sep '23

Any known issues with installing/running roundcube and dovecot on the same server?

11 22

Trouble with SMTP, TLS and dovecot.org.
by Ralph Seichter 07 Sep '23

07 Sep '23

Hello, I cannot seem to send STARTTLS protected mail to talvi.dovecot.org, and I was wondering if anybody else sees similar problems: Sep 6 22:29:10 ra postfix/smtp[15748]: SSL_connect error to talvi.dovecot.org[94.237.105.223]:25: -1 Sep 6 22:29:10 ra postfix/smtp[15748]: warning: TLS library problem: error:0A000417:SSL routines::sslv3 alert illegal parameter:../openssl-3.0.9/ssl/record/rec_layer_s3.c:1586:SSL alert number 47: Sep 6 22:29:10 ra postfix/smtp[15748]: 1AAE4BE0031: Cannot start TLS: handshake failure Sep 6 22:29:10 ra postfix/smtp[15748]: SSL_connect error to talvi.dovecot.org[2a04:3545:1000:720:acc1:5bff:fe5e:459]:25: -1 Sep 6 22:29:10 ra postfix/smtp[15748]: warning: TLS library problem: error:0A000417:SSL routines::sslv3 alert illegal parameter:../openssl-3.0.9/ssl/record/rec_layer_s3.c:1586:SSL alert number 47: Sep 6 22:29:10 ra postfix/smtp[15748]: 1AAE4BE0031: to=<dovecot(a)dovecot.org>, relay=talvi.dovecot.org[2a04:3545:1000:720:acc1:5bff:fe5e:459]:25, delay=1.6, delays=0.02/0.01/1.6/0, dsn=4.7.5, status=deferred (Cannot start TLS: handshake failure) Sep 6 22:30:05 ra postfix/smtpd[15616]: timeout after END-OF-MESSAGE from localhost[127.0.0.1] Sep 6 22:30:05 ra postfix/smtpd[15616]: disconnect from localhost[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5 The originating server uses Postfix 3.8.2 and OpenSSL library 3.0.9. To be able to send messages to dovecot.org at all, I had to use Postfix's "smtp_tls_policy_maps" setting to explicitly disable TLS for this destination domain. -Ralph

3 5

Fwd: DOvecot requires both IPv4 and IPV6 to start
by Stephen Satchell 06 Sep '23

06 Sep '23

Damn. Forgot to hit "reply all" -- my bad -------- Forwarded Message -------- Subject: Re: DOvecot requires both IPv4 and IPV6 to start Date: Mon, 4 Sep 2023 15:35:51 -0700 From: Stephen Satchell <list(a)satchell.net> Reply-To: list(a)satchell.net To: Arjen de Korte <build+dovecot(a)de-korte.org> On 9/4/23 2:40 PM, Arjen de Korte wrote: > This document was written something like two decades ago and pretty much > all arguments against IPv6 are no longer relevant anymore. In most cases > nowadays, the user experience for IPv6 will be far superior over CGNAT > connections which unfortunately become the standard due to the > increasing cost of IPv4 addresses. Running services over IPv6 may have > been experimental and prone with not so fun problems to diagnose in > 2013, but today this is no longer the case. Running a business? Subscribing to business Internet? Are IPv6 address blocks available? Does IPv6 routing work properly? OK, even though the service desk doesn't know how to answer the above questions about IPv6 correctly, the information *is* available if you dig hard enough. And it seems to work. Can you get a PTR6 record for your mail server? No. At least, not from my upstream. Begins with "A" and ends with "T". Don't even ask about reverse delegations, the blank stare will scare you. (I apologize to everyone on this list. The above diatribe more correctly lives on mailing lists for Sendmail, Postfix, Exim, and other packages that actually originate mail exchanges.)

2 1

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 06 Sep '23

06 Sep '23

I think we are off topic. We have a network policy that until such time as we have fully implemented the same security we have on our IPV4 network we simply do not allow IPV6 as it is another attack vector we are not fully upto speed on. So we block all IPV6 at the perimeter and on all switches, firewalls and routers. So if you connect to our network with a device no IP6 is configured and only IPV4 is allowed. We will get there! But that is not this issue. The issue is that dovecot is assuming that IPV6 is there and crashes out if it's not. Hacking the config to only listen on IP4 solves the problem but not while installing from standard repos to install the currently supported version. Cheers Spart

9 13

Dovecot with Postfix "no SASL authentication mechanisms"
by mangawilly＠gmail.com 05 Sep '23

05 Sep '23

Hi. Can someone help me please check what is wrong with my config? postfix is saying "no SASL authentication mechanisms" and I'm using dovecot. From what I read so far, it is related to my dovecot settings. Here are the details of my config http://paste.debian.net/1290864/

9 16

auth: Panic: file oauth2-request.c assertion failed
by Urban Loesch 05 Sep '23

05 Sep '23

Hi, I'm running a postfix smtp relay server on which users are getting authenticated trough sasl via the dovecot authentication service. This works without problems. Recently I extended my configuration to authenticate users with the PLAIN mechanism against Azure AD B2C with oauth2 in the future. Important to mention is that currently no users are stored in Azure B2C. I only prepared the hole configuration and authentiucation falls back to mysql database. Now sometimes I get the error below in my logs (not permanently): ... Dec 7 11:36:49 relay-out1 dovecot: auth: Panic: file oauth2-request.c: line 201 (oauth2_request_start): assertion failed: (oauth2_valid_token(input->token)) Dec 7 11:36:49 relay-out1 dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x3d) [0x7f399402e62d] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f399402e74e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1006eb) [0x7f399403b6eb] -> /usr/lib/dovecot/libdovecot.so.0(+0x100781) [0x7f399403b781] -> /usr/lib/dovecot/libdovecot.so.0(+0x54b7c) [0x7f3993f8fb7c] -> /usr/lib/dovecot/libdovecot.so.0(+0x4605a) [0x7f3993f8105a] -> /usr/lib/dovecot/libdovecot.so.0(oauth2_passwd_grant_start+0xfa) [0x7f3993f9870a] -> dovecot/auth(db_oauth2_lookup+0x2ca) [0x560d0804368a] -> dovecot/auth(auth_request_default_verify_plain_continue+0x2d6) [0x560d08026436] -> dovecot/auth(auth_policy_check+0x2b) [0x560d0802071b] -> dovecot/auth(+0x29f72) [0x560d0802ff72] -> dovecot/auth(auth_request_handler_auth_continue+0xf7) [0x560d0802a197] -> dovecot/auth(+0x16c62) [0x560d0801cc62] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f3994051c29] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x131) [0x7f3994053251] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x4c) [0x7f3994051ccc] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f3994051e50] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f3993fc4df3] -> dovecot/auth(main+0x415) [0x560d0801abf5] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f3993cee09b] -> dovecot/auth(_start+0x2a) [0x560d0801ad8a] ... After the error above postfix says the connection to the authentication server was lost: ... Dec 7 11:36:49 relay-out1 rolrelayout1/smtpd[1655601]: warning: domain.com[12.12.12.12]: SASL LOGIN authentication failed: Connection lost to authentication server ... I was able to make a core dump. ... # gdb /usr/lib/dovecot/auth core.auth.1654357.1670409409 GNU gdb (Debian 8.2.1-2+b3) 8.2.1 ... For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib/dovecot/auth...Reading symbols from /usr/lib/debug/.build-id/bc/f14ed9cc2dda3ee9565fbd7ccd835460008438.debug...done. done. [New LWP 1654357] [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `dovecot/auth'. Program terminated with signal SIGABRT, Aborted. #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 50 ../sysdeps/unix/sysv/linux/raise.c: Datei oder Verzeichnis nicht gefunden. (gdb) bt full #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50 set = {__val = {0, 1415, 1416, 94613970086496, 10, 139885273538955, 155, 139885273347109, 140724590457408, 118, 206158430224, 140724590457744, 140724590457536, 16888407779496842752, 94613970086472, 139885273131758}} pid = <optimized out> tid = <optimized out> ret = <optimized out> #1 0x00007f3993cec535 in __GI_abort () at abort.c:79 save_stage = 1 act = {__sigaction_handler = {sa_handler = 0x73f, sa_sigaction = 0x73f}, sa_mask = {__val = {1024, 18446744073709551615, 94613971926672, 94613971631792, 139885273108347, 94613970084312, 139885273090236, 94613970084312, 16888407779496842752, 94613970084288, 139885273346402, 140724590457744, 94613970084312, 140724590457744, 139885273346761, 94613970084312}}, sa_flags = -1811749030, sa_restorer = 0x5} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007f3993f8feaf in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at failures.c:465 backtrace = 0x560d0813e220 "/usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x3d) [0x7f399402e62d] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f399402e74e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1006eb) [0x7f39"... backtrace = <optimized out> recursed = 0 #3 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:477 status = 0 #4 0x00007f399403b781 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at failures.c:879 No locals. #5 0x00007f3993f8fb7c in i_panic (format=format@entry=0x7f399407a0e8 "file %s: line %d (%s): assertion failed: (%s)") at failures.c:530 ctx = {type = LOG_TYPE_PANIC, exit_status = 0, timestamp = 0x0, timestamp_usecs = 0, log_prefix = 0x0, log_prefix_type_pos = 0} args = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7ffcff39b4e0, reg_save_area = 0x7ffcff39b420}} #6 0x00007f3993f8105a in oauth2_request_start (set=0x560d08176150, input=0x7ffcff39b5d0, callback=0x560d08042b50 <db_oauth2_lookup_passwd_grant>, context=0x560d082ffe90, p=0x560d082b7eb0, method=0x7f399407a2c6 "POST", url=0x560d08178480 "https://xxx.b2clogin.com/xxx.onmicrosoft.com/B2C_1_ropc/oauth2/v2.0/token?s…", payload=0x560d082b7ed8, add_auth_bearer=false) at oauth2-request.c:201 __func__ = "oauth2_request_start" pool = <optimized out> req = <optimized out> #7 0x00007f3993f9870a in oauth2_passwd_grant_start (set=set@entry=0x560d08176150, input=input@entry=0x7ffcff39b5d0, username=0x560d082ffe38 "user.name", password=0x560d082ffe48 "", callback=callback@entry=0x560d08042b50 <db_oauth2_lookup_passwd_grant>, context=context@entry=0x560d082ffe90) at oauth2-request.c:351 pool = 0x560d082b7eb0 payload = 0x560d082b7ed8 #8 0x0000560d0804368a in db_oauth2_lookup (db=0x560d08176060, req=0x560d082ffe90, token=<optimized out>, request=0x560d082ffba8, callback=0x560d080370b0 <oauth2_verify_plain_continue>, context=0x560d082ffba8) at db-oauth2.c:862 input = {token = 0x560d082ffe48 "", service = 0x560d082ffe20 "smtp", local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\303\376\374\322", '\000' <repeats 11 times>, __u6_addr16 = {65219, 54012, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {3539795651, 0, 0, 0}}}, ip4 = {s_addr = 3539795651}}}, real_local_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "\303\376\374\322", '\000' <repeats 11 times>, __u6_addr16 = {65219, 54012, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {3539795651, 0, 0, 0}}}, ip4 = {s_addr = 3539795651}}}, remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "*\300\070\226", '\000' <repeats 11 times>, __u6_addr16 = {49194, 38456, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2520301610, 0, 0, 0}}}, ip4 = {s_addr = 2520301610}}}, real_remote_ip = {family = 2, u = {ip6 = {__in6_u = {__u6_addr8 = "*\300\070\226", '\000' <repeats 11 times>, __u6_addr16 = { 49194, 38456, 0, 0, 0, 0, 0, 0}, __u6_addr32 = {2520301610, 0, 0, 0}}}, ip4 = {s_addr = 2520301610}}}, local_port = 0, real_local_port = 0, remote_port = 0, real_remote_port = 0} __func__ = "db_oauth2_lookup" #9 0x0000560d08026436 in auth_request_default_verify_plain_continue (request=0x560d082ffba8, callback=0x560d0803e6f0 <plain_verify_callback>) at auth-request.c:1123 passdb = 0x560d0814da40 result = 22029 cache_key = <optimized out> error = 0x560d082ffe38 "user.name" password = 0x560d082ffe48 "" __func__ = "auth_request_default_verify_plain_continue" #10 0x0000560d0802071b in auth_policy_check (request=<optimized out>, password=<optimized out>, cb=<optimized out>, context=<optimized out>) at auth-policy.c:575 pool = <optimized out> ctx = <optimized out> #11 0x0000560d0802ff72 in mech_plain_auth_continue (request=0x560d082ffba8, data=0x560d0813d368 "user.name", data_size=30) at mech-plain.c:58 authid = <optimized out> authenid = 0x560d0813d377 "user.name" error = 0x560d0813d320 "h\323\023\b\rV" pass = 0x560d0813d388 "" i = <optimized out> len = <optimized out> count = 2 #12 0x0000560d0802a197 in auth_request_handler_auth_continue (handler=0x560d082d1ae8, args=args@entry=0x560d08268e96 "21\tdGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA") at auth-request-handler.c:738 request = 0x560d082ffba8 data = 0x560d08268e99 "dGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA" data_len = 40 buf = 0x560d0813d320 id = 21 #13 0x0000560d0801cc62 in auth_client_handle_line (line=0x560d08268e91 "CONT\t21\tdGhvbWFzLmZlcnJhcmkAdGhvbWFzLmZlcnJhcmkA", conn=0x560d08276d30) at auth-client-connection.c:228 No locals. #14 auth_client_input (conn=<optimized out>) at auth-client-connection.c:311 _data_stack_cur_id = 3 line = <optimized out> ret = <optimized out> #15 0x00007f3994051c29 in io_loop_call_io (io=0x560d0826f240) at ioloop.c:737 ioloop = 0x560d08145f80 t_id = 2 __func__ = "io_loop_call_io" #16 0x00007f3994053251 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x560d08145f80) at ioloop-epoll.c:222 ctx = 0x560d08148600 events = <optimized out> event = 0x560d08148680 list = 0x560d082ae620 io = <optimized out> tv = {tv_sec = 0, tv_usec = 315566} events_count = <optimized out> msecs = <optimized out> ret = <optimized out> i = 0 j = <optimized out> call = <optimized out> __func__ = "io_loop_handler_run_internal" #17 0x00007f3994051ccc in io_loop_handler_run (ioloop=0x560d08145f80) at ioloop.c:789 __func__ = "io_loop_handler_run" #18 0x00007f3994051e50 in io_loop_run (ioloop=0x560d08145f80) at ioloop.c:762 __func__ = "io_loop_run" #19 0x00007f3993fc4df3 in master_service_run (service=0x560d08145dd0, callback=<optimized out>) at master-service.c:869 No locals. #20 0x0000560d0801abf5 in main (argc=<optimized out>, argv=<optimized out>) at main.c:393 c = <optimized out> ... And "doveconf -n": ... # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-18-amd64 x86_64 Debian 10.13 # Hostname: relay-out1.domain.com auth_cache_negative_ttl = 0 auth_cache_size = 40 M auth_cache_ttl = 30 days auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_%@ auth_username_translation = %@ auth_verbose = yes auth_verbose_passwords = plain auth_worker_max_count = 100 disable_plaintext_auth = no namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-oauth2.plain.conf.ext driver = oauth2 mechanisms = plain login } passdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } userdb { args = /etc/dovecot/dovecot-sql-account.conf driver = sql } ... System OS is Debian 10, Dovecot installed from dovecot repository. Many thanks Urban

1 1

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 04 Sep '23

04 Sep '23

Hello, I hope this is the right place to start. Ubuntu server the default listener configuration in dovecot.conf uses both IP4 and IP6 on systems that have IP6 disabled dovecot will not start. Is it possible to set the default to: listen = * to only bind to IP4 for installation and initial start. Rather than listen = *, :: which tries to bind to a non existent IP6 stack. Or simply fallback to ip4 if ip6 is not available. Thank you

6 5

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 04 Sep '23

04 Sep '23

IPV6 is disabled in the grub command line. So before the OS boots. So there is no IPV6 support in the system. Unless one enables it in the Grub bootloader. Cheers

1 0

DOvecot requires both IPv4 and IPV6 to start
by TWHG Technical 04 Sep '23

04 Sep '23

I have tried replying twice. We have IPV6 disabled for security reasons on all server builds. An installer script failed which is how we caught this issue. We can see it is due to the config line. A graceful fallback to IPV4 if the IPV6 stack is not available would seem to be an elegant solution that would make dovecot resilient in all circunstances. Cheers Spart

4 3

no such user but Thunderbird okeys it ?
by lejeczek 04 Sep '23

04 Sep '23

Hi guys. I'm having quite bizarre situation where Dovecot logs: ... pam_unix(dovecot:auth): check pass; user unknown pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=dupa rhost=AA.BB.CC.DD imap-login: Login: user=<dupa>, method=PLAIN, rip=AA.BB.CC.DD, lip=AA.BB.CC.DD, mpid=1756629, TLS, session=<uV7OwIIEWsJdviSg>: ... but Thunderbird allows, is okey with such user & creates an account for it. I must be having my setup miss-configured - I'm hoping it's something obvious somebody could point me towards. many thanks, L.

2 5

Dovecot director and backend on same server
by Michael Cassaniti 29 Aug '23

29 Aug '23

Hi, I'm attempting to run both the director and the backend under the same configuration on the same server. When I run doveadm director map I don't get any output. I have a shared file system between servers and clients can access any server. I was running without a director in front and seeing index corruption so I'm now attempting to use a director. I enabled additional logging for now but that didn't explain much. Dovecot version: 2.3.20 (80a5ac675d) on Alpine Linux v3.18.2 Dovecot configuration (doveconf -n) with some bits removed. # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 6.1.43-0-lts x86_64 # Hostname: <REDACTED> auth_debug = yes auth_socket_path = director-userdb director_mail_servers = 192.168.252.2 192.168.252.3 192.168.252.4 192.168.252.5 192.168.252.20 director_servers = 192.168.252.2 192.168.252.3 192.168.252.4 192.168.252.5 192.168.252.20 imap_hibernate_timeout = 5 secs log_debug = events=* login_trusted_networks = 192.168.252.0/24 mail_debug = yes mail_fsync = always mail_gid = vmail mail_location = maildir:~/Maildir:LAYOUT=fs mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = acl quota mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mmap_disable = yes namespace inbox { inbox = yes location = mailbox Bin { auto = subscribe autoexpunge = 30 days special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile quota = maildir:quota quota_rule = *:storage=5G quota_rule2 = Bin:ignore quota_rule3 = Spam:ignore sieve = file: ~/sieve;active=~/dovecot.sieve sieve_plugins = sieve_imapsieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-admin { mode = 0600 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director } service imap { user = vmail } service ipc { unix_listener ipc { user = dovecot } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/<REDACTED>/fullchain.pem ssl_cipher_list = HIGH:!SSLv3:!aNULL ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = acl quota sieve } protocol imap { mail_plugins = acl quota imap_acl imap_quota imap_sieve imap_zlib } Regards, Michael Cassaniti

1 0

[bug] dovecot passes zero byte input stream when passing email with .eml attachment to apache tika parser, causes 'SEVERE' error
by pgnd 29 Aug '23

29 Aug '23

revisiting a prior, never resolved issue tika 2.4.1 'Text extraction failed' errors when dovecot+fts 2.3.19.1 passes embedded *.eml (message/rfc822) files ; org.apache.tika.parser.mail.RFC822Parser or dovecot ? https://dovecot.org/list/dovecot/2022-August/125085.html i now run dovecot --version 2.3.20 (80a5ac675d) with dovecot23_fts_flatcurve built 20230812 from git.HEAD on lsb_release -rd Description: Fedora release 38 (Thirty Eight) Release: 38 apache/tika 2.8.0 runs on another box dovecot passes mail to tika, via config fts_tika = http://192.0.2.20:9998/tika/ indexing & search work with simple mail passed, and with attachments ... except with .eml attachments. sending this message (plain txt email, with .eml as attachment) Content-Type: multipart/mixed; boundary="------------O6z0p865JVYqnvxPyzc0aSLA" Message-ID: <0b7f5053-05b5-4b4f-8c7e-4a640b79a5f4(a)fastmail.fm> Date: Sat, 12 Aug 2023 19:37:44 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: tika test This is a multi-part message in MIME format. --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â tika test --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: message/rfc822; name="t2.eml" Content-Disposition: attachment; filename="t2.eml" Content-Transfer-Encoding: 8bit Message-ID: <89e5914a-e928-422d-824f-5b4e90170cd7(a)fastmail.fm> Date: Sat, 12 Aug 2023 14:32:48 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: t2 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â t2 --------------O6z0p865JVYqnvxPyzc0aSLA-- from an off-site server to local postfix+dovecot instance tika & dovecot logs, journalctl -f -u tika Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.TikaLoggingFilter Request URI: http://192.0.2.20:9998/tika/ Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource /tika (message/rfc822) Aug 12 19:52:36 svr04tika[2035]: WARN [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource tika/: Text extraction failed (t2.eml) Aug 12 19:52:36 svr04tika[2035]: org.apache.tika.exception.ZeroByteFileException: InputStream must have > 0 bytes Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:185) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.ParserDecorator.parse(ParserDecorator.java:152) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.DigestingParser.parse(DigestingParser.java:57) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.parse(TikaResource.java:357) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.lambda$produceText$1(TikaResource.java:507) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.provider.BinaryDataProvider.writeTo(BinaryDataProvider.java:177) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.utils.JAXRSUtils.writeMessageBody(JAXRSUtils.java:1651) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.serializeMessage(JAXRSOutInterceptor.java:249) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.processResponse(JAXRSOutInterceptor.java:122) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.handleMessage(JAXRSOutInterceptor.java:84) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.interceptor.OutgoingChainInterceptor.handleMessage(OutgoingChainInterceptor.java:90) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:247) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:79) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:190) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:191) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.Server.handle(Server.java:516) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at java.lang.Thread.run(Thread.java:1623) [?:?] Aug 12 19:52:36 svr04tika[2035]: Aug 12, 2023 7:52:36 PM org.apache.cxf.jaxrs.utils.JAXRSUtils logMessageHandlerProblem Aug 12 19:52:36 svr04tika[2035]: SEVERE: Problem with writing the data, class org.apache.tika.server.core.resource.TikaResource$$Lambda$387/0x00000008012a9300, ContentType: text/plain tail -f /var/log/dovecot/*log | grep http-client 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998 (shared): Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer pool created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Setting up connection to 192.0.2.20:9998 (1 requests pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Linked queue http://192.0.2.20:9998 (1 queues linked) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Started new connection to 192.0.2.20:9998 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Submitted (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Waiting for request to finish 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Making new connection 1 of 1 (0 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connecting 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Waiting for connect (fd=28) to finish for max 0 msecs 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: HTTP connection created (1 parallel connections exist) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Client connected (fd=28) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connected 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Ready for requests 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Using 1 idle connections to handle 1 requests (1 total connections ready) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Connection to peer 192.0.2.20:9998 claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Sent header 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No more requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Got 422 response for request [Req1: PUT http://192.0.2.20:9998/tika/] Unprocessable Entity (took 3 ms + 106 ms in queue) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Finished 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Dropping request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host is idle (timeout = 100 msecs) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Free (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: No more requests queued; going idle (timeout = 100 msecs) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Idle host timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Unlinked queue http://192.0.2.20:9998 (0 queues linked) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Idle connection timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection close 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection disconnect 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Disconnected: Connection closed (fd=28) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Detached peer 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Lost a connection (0 queues linked, 0 connections left, 0 connections pending, 0 requests pending, 0 requests urgent) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Dropping peer now 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer close unclear 2 me whether this is a bug in dovecot or in tika, or a matter of (mis)config. ?? _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org

2 3

Dovecot, mail_crypt, global keys, permissions
by David Mehler 28 Aug '23

28 Aug '23

Hello, I'm using Dovecot v2.3 with the mail_crypt plugin and global keys. I am seeing this error immediately after imap login then after this error imap logs out. I'm hoping this is a simple permissions problem and the key can not be read rather than an underlying configuration issue. I do not know what this UID 5395 refers to. 2023-08-11T04:14:14.539308-04:00 hostname dovecot: imap(username(a)domain.org)<492738><zO4WTKECnvRoDWll>: Error: Mailbox INBOX: UID=5395: read() failed: read(/var/mail/mailboxes/domain.org/username/mail/mailboxes/INBOX/dbox-Mail… failed: Private key not available: mailbox_attribute_get(INBOX, /priv/vendor/vendor.dovecot/pvt/crypt/privkeys/e9f195fe9fd1953d08e815ba6fda9b6c5ae1ed692c9adade2f958c322552cbb0) failed: Mailbox attributes not enabled (FETCH BODY[HEADER]) #ls -ld crypt drwxr-xr-x 2 root root 4096 Jul 25 08:52 crypt/ # cd crypt #ls -l * -r-------- 1 root root 241 Jul 25 15:43 master.key -rw-r--r-- 1 root root 178 Jul 25 15:43 master.pub Thanks. Dave.

2 5

Bug - doveadm backup out-of-memory kill/crash when no separators set
by James Harrison 26 Aug '23

26 Aug '23

Hi, I hit a fun issue with doveadm when migrating from dovecot 2.2.36 (1f10bfa63) to 2.3.19.1 (9b53102964) (CentOS 7 to Debian 12). When running doveadm -v -D backup -R -u "user@name" tcp:localhost:1234, I found that the first sync would always work, but subsequent runs of the command would cause doveadm to reach a subfolder (Archives/2008 in the example below) and then silently mmap() increasing powers of 2 before the OOM killer finally got it. Deleting the source folder caused it to remain stuck on the same folder, but for the deletion event. I switched memory overcommit off to force a crash, and got a gdb backtrace: #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44 #1 0x00007ffff786bd9f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78 #2 0x00007ffff781cf32 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007ffff7807472 in __GI_abort () at ./stdlib/abort.c:79 #4 0x00007ffff7b4ffae in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #5 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #6 0x00007ffff7bfa081 in default_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:485 #7 0x00007ffff7b5017c in i_panic (format=0x7ffff7c5d748 "data stack: Out of memory when allocating %zu bytes") at ../lib/failures.c:530 #8 0x00007ffff7b4f67f in mem_block_alloc (min_size=min_size@entry=16) at ../lib/data-stack.c:386 #9 0x00007ffff7bf8b60 in t_malloc_real (size=<optimized out>, permanent=<optimized out>) at ../lib/data-stack.c:492 #10 0x00007ffff7c348f1 in t_strdup_until (start=start@entry=0x55555565f440, end=end@entry=0x55555565f448) at ../lib/strfuncs.c:270 #11 0x00005555555adc62 in convert_name_to_remote_sep (name=0x55555565f440 "Archives/2008", tree=0x55555564e188) at dsync/dsync-mailbox-tree.c:270 #12 dsync_mailbox_tree_build_name128_remotesep_hash (tree=0x55555564e188) at dsync/dsync-mailbox-tree.c:315 #13 dsync_mailbox_tree_find_delete (tree=0x55555564e188, del=0x5555556469f0) at dsync/dsync-mailbox-tree.c:405 #14 0x00005555555a4195 in dsync_brain_mailbox_tree_add_delete (tree=0x55555564e188, other_tree=0x55555564f5f8, other_del=0x5555556469f0, node_r=0x7fffffffe350, status_r=0x7fffffffe348) at dsync/dsync-brain-mailbox-tree.c:504 #15 0x00005555555a44cd in dsync_brain_recv_mailbox_tree_deletes (brain=0x55555564b2d8) at dsync/dsync-brain-mailbox-tree.c:590 #16 0x00005555555a5365 in dsync_brain_run_real (brain=brain@entry=0x55555564b2d8, changed_r=changed_r@entry=0x7fffffffe453) at dsync/dsync-brain.c:709 #17 0x00005555555a59f9 in dsync_brain_run (changed_r=0x7fffffffe453, brain=0x55555564b2d8) at dsync/dsync-brain.c:752 #18 dsync_brain_run (changed_r=0x7fffffffe453, brain=0x55555564b2d8) at dsync/dsync-brain.c:740 #19 dsync_brain_run_io (context=<optimized out>) at dsync/dsync-brain.c:113 #20 dsync_brain_run_io (context=0x55555564b2d8) at dsync/dsync-brain.c:100 #21 0x00005555555b23df in dsync_ibc_stream_input (ibc=0x555555646720) at dsync/dsync-ibc-stream.c:232 #22 0x00007ffff7c11cd9 in io_loop_call_io (io=0x5555556418f0) at ../lib/ioloop.c:737 #23 0x00007ffff7c13aa2 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55555560bf40) at ../lib/ioloop-epoll.c:222 #24 0x00007ffff7c13b50 in io_loop_handler_run (ioloop=ioloop@entry=0x55555560bf40) at ../lib/ioloop.c:789 #25 0x00007ffff7c13d10 in io_loop_run (ioloop=0x55555560bf40) at ../lib/ioloop.c:762 #26 0x000055555558b22e in cmd_dsync_run_remote (user=0x555555637248) at ./src/doveadm/doveadm-dsync.c:543 #27 cmd_dsync_run (_ctx=0x55555561f288, user=0x555555637248) at ./src/doveadm/doveadm-dsync.c:750 #28 0x000055555558bd12 in doveadm_mail_next_user (ctx=0x55555561f288, error_r=0x7fffffffe818) at ./src/doveadm/doveadm-mail.c:464 #29 0x000055555558cf45 in doveadm_mail_cmd_exec (wildcard_user=0x0, ctx=0x55555561f288) at ./src/doveadm/doveadm-mail.c:659 #30 doveadm_cmd_ver2_to_mail_cmd_wrapper (cctx=0x7fffffffe970) at ./src/doveadm/doveadm-mail.c:988 #31 0x0000555555597622 in doveadm_cmd_run_ver2 (argc=5, argv=0x55555560ba38, cctx=cctx@entry=0x7fffffffe970) at ./src/doveadm/doveadm-cmd.c:465 #32 0x0000555555597697 in doveadm_cmd_try_run_ver2 (cmd_name=<optimized out>, argc=<optimized out>, argv=<optimized out>, cctx=0x7fffffffe970) at ./src/doveadm/doveadm-cmd.c:363 #33 0x000055555557919a in main (argc=<optimized out>, argv=<optimized out>) at ./src/doveadm/doveadm.c:361 Neither server had a separator set in the inbox namespace. Having identified the convert_name_to_remote_sep function as the likely trigger point I set the separator to / on both ends, and doveadm backup now runs without issue. Can provide config if helpful but I think probably irrelevant to this one - the namespace config is the default other than the separator item. May be worth mentioning that having the separator set can avoid this condition in the doveadm backup docs - this took me a while to figure out! -- Cheers, James Harrison

2 1

Stop Logging to Syslog
by Asai 25 Aug '23

25 Aug '23

Greetings, My logging config is as follows: # doveadm log find Debug: /var/log/dovecot-debug.log Info: /var/log/dovecot.log Warning: /var/log/dovecot.log Error: /var/log/dovecot.log Fatal: /var/log/dovecot.log However, I'm still getting logs in /var/log/messages which I don't want. I've looked into /etc/rsyslog.conf for clues, but can't find anything that would point to Dovecot logging to /var/log/messages. Can anyone point me in the right direction here? Thank you, Asai

2 1

libdovecot-storage.so.0.0.0 [.] maildir_filename_base_hash with high cpu load
by habi li 25 Aug '23

25 Aug '23

[image: image.png] we find the libdovecot-storage.so cpu so high ,can you help me

3 2

sievec: Misleading error message
by Horst Prote 25 Aug '23

25 Aug '23

Hi, in a sieve script I just made a syntax error and got this error message on calling sievec: error: the else command must follow an if or elseif command. My first thougth was "Are you kidding me!" as I used "elseif". But then I realized that the correct syntax is "elsif". So I think that error message should be corrected to error: the else command must follow an if or elsif command. Thanks, Horst

3 2

Re: Question about namespaces
by Peter Wienemann 22 Aug '23

22 Aug '23

Hi J, On 21.08.23 21:08, J Doe wrote: > My current dovecot.conf is rather basic when it comes to namespaces - I > have one private namespace per user: > > namespace inbox { > type = private > separator = / > inbox = yes > hidden = no > list = yes > subscriptions = yes > } > > I have some users who connect via more than one client - for instance, > some use Apple Mail in addition to Roundcube. I have noticed that > different mail clients sometimes create similar mailboxes, such as Trash > and Deleted Items. I would like the same mailboxes across any client, > so I am wondering if there is a way in Dovecot to specify the folders > and have the *client* not create them. For instance, a config in > dovecot.conf that specifies a Trash folder and the mail clients cannot > create "Deleted Items", etc. in addition to this. > > Is this possible ? this can be done using the settings in https://github.com/dovecot/core/blob/main/doc/example-config/conf.d/15-mail… Best regards, Peter

2 1

dovecot 2.4 issue with openssl >= 3.0.8
by Michal Hlavinka 22 Aug '23

22 Aug '23

Hi, I've started testing main git branch and found an issue with openssl 3. Test suite fails: test_load_v1_key ........................................... : ok test-crypto.c:445: Assert failed: ret == TRUE test-crypto.c:446: Assert failed: error == NULL Panic: file dcrypt-openssl3.c: line 2917 (dcrypt_openssl_public_key_type): assertion failed: (key != NULL && key->key != NULL) Error: Raw backtrace: test-crypto(+0x5af01) [0x55951b667f01] -> test-crypto(backtrace_get+0x2f) [0x55951b66877f] -> test-crypto(+0x31291) [0x55951b63e291] -> test-crypto(+0x312d5) [0x55951b63e2d5] -> test-crypto(+0x16025) [0x55951b623025] -> libdcrypt_openssl.so(+0x70ff) [0x7f5a995b60ff] -> test-crypto(+0x2a17b) [0x55951b63717b] -> test-crypto(+0x3055d) [0x55951b63d55d] -> test-crypto(test_run+0x6c) [0x55951b63d61c] -> test-crypto(main+0x4e) [0x55951b62b66e] -> libc.so.6(+0x27b4a) [0x7f5a995eeb4a] -> libc.so.6(__libc_start_main+0x8b) [0x7f5a995eec0b] -> test-crypto(_start+0x25) [0x55951b62b7e5] The issue is caused by change in openssl >= 3.0.8 in lib-dcryt/dcrypt-openssl3.c method ec_key_get_pub_point_hex(...) in old version (for openssl 1.x) it uses compressed format: EC_POINT_point2hex(g, p, POINT_CONVERSION_COMPRESSED, NULL); in openssl3 version it uses EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, buf, sizeof(buf), &len); but key is created in dcrypt_evp_pkey_from_point(...) with OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT, "uncompressed" this was working in openssl pre 3.0.8 as compression format was ignored when dumping data and used always compressed format. From https://www.openssl.org/docs/man3.0/man7/EVP_KEYMGMT-EC.html """ Before OpenSSL 3.0.8, the implementation of providers included with OpenSSL always opted for an encoding in compressed format, unconditionally. Since OpenSSL 3.0.8, the implementation has been changed to honor the OSSL_PKEY_PARAM_EC_POINT_CONVERSION_FORMAT parameter, if set, or to default to uncompressed format.""" I don't see simple way how to force compressed format just for dumping data without effecting the key itself. Method that can be used with compression format argument is EC_POINT_point2hex but it requires quite lengthy extraction of EC_POINT first. I've tried this for testing with: static const char *ec_key_get_pub_point_hex(const EVP_PKEY *pkey) { if (!EVP_PKEY_is_a(pkey, "EC")) return NULL; size_t len; EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME, NULL, 0, &len); buffer_t *parambuf = t_buffer_create(len+1); EVP_PKEY_get_utf8_string_param(pkey, OSSL_PKEY_PARAM_GROUP_NAME, (char *)parambuf->data, len+1, &len); int nid = OBJ_txt2nid(parambuf->data); EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, NULL, 0, &len); parambuf = t_buffer_create(len+1); EVP_PKEY_get_octet_string_param(pkey, OSSL_PKEY_PARAM_PUB_KEY, (unsigned char *)parambuf->data, len+1, &len); EC_GROUP *ec_grp = EC_GROUP_new_by_curve_name(nid); if (ec_grp == NULL) return NULL; EC_POINT *point = EC_POINT_new(ec_grp); if (point == NULL) { EC_GROUP_free(ec_grp); return NULL; } if (!EC_POINT_oct2point(ec_grp, point, parambuf->data, len, NULL)) return NULL; char *ret = EC_POINT_point2hex(ec_grp, point, POINT_CONVERSION_COMPRESSED, NULL); EC_GROUP_free(ec_grp); EC_POINT_free(point); return ret; } and it fixed the issue, but there may be an easier way how to achieve that. Cheers Michal Hlavinka

3 6

Question about namespaces
by J Doe 21 Aug '23

21 Aug '23

Hello, I have a question regarding namespaces. My current dovecot.conf is rather basic when it comes to namespaces - I have one private namespace per user: namespace inbox { type = private separator = / inbox = yes hidden = no list = yes subscriptions = yes } I have some users who connect via more than one client - for instance, some use Apple Mail in addition to Roundcube. I have noticed that different mail clients sometimes create similar mailboxes, such as Trash and Deleted Items. I would like the same mailboxes across any client, so I am wondering if there is a way in Dovecot to specify the folders and have the *client* not create them. For instance, a config in dovecot.conf that specifies a Trash folder and the mail clients cannot create "Deleted Items", etc. in addition to this. Is this possible ? Thanks, - J

1 0

Backing up m(d)box - rsync?
by donotspam＠fastmail.fm 19 Aug '23

19 Aug '23

Hello, I manage a small number of email accounts for a voluntary organisation on a shared hosting platform. $ dovecot --version 2.3.13 (89f716dc2) I would like to keep automated local backups, but do not have access to doveadm. I have seen a couple of forum posts where users have have suggested that using rsync to backup m(d)box folders can corrupt dovecot's indexes, but there is no further explanation, and this is apparently not a problem for maildir. Our host seems to use mdbox. Does doveadm provide some sort of transaction/locking mechanism to prevent consistency problems? Others seem to recommend using tar but I don't see what difference that should make. Given that cpanel backups (provided as tar.gz archives of the home directory) include mail/ and seem to be copies of the filesystem at a particular time (though not true "snapshots" as such), aren't these just as "safe" as an rsync-ed backup? Can anyone confirm/deny/shed any light on the issue(s), if indeed any? Many thanks, Gareth

5 7

last_login using fs:posix does not autocreate the last-login directory
by karl＠denninger.net 13 Aug '23

13 Aug '23

I am using the last_login plug-in on a relatively small system to populate the last access time for users in the directory format. I don't want to have this go into an SQL database or similar as the userbase is small and shell access to the information for other purposes is useful. I have this in the conf.d directory under the configuration dir in 20-lastlogin.conf: protocol imap { mail_plugins = $mail_plugins last_login } plugin { last_login_dict = fs:posix:prefix=/var/run/dovecot/ } This works except that while the prefix is there the "last-login" directory under the prefix gets removed on restart (as you think it might) and I can't find an example of how to have it auto-created. This results in a bunch of logged errors until I re-create that working directory under the base. Am I missing something obvious?

2 4

dovecot passes zero byte input stream when passing email with .eml attachment to apache tika parser, causes 'SEVERE' error
by pgnd 13 Aug '23

13 Aug '23

revisiting a prior, never resolved issue tika 2.4.1 'Text extraction failed' errors when dovecot+fts 2.3.19.1 passes embedded *.eml (message/rfc822) files ; org.apache.tika.parser.mail.RFC822Parser or dovecot ? https://dovecot.org/list/dovecot/2022-August/125085.html i now run dovecot --version 2.3.20 (80a5ac675d) with dovecot23_fts_flatcurve built 20230812 from git.HEAD on lsb_release -rd Description: Fedora release 38 (Thirty Eight) Release: 38 apache/tika 2.8.0 runs on another box dovecot passes mail to tika, via config fts_tika = http://192.0.2.20:9998/tika/ indexing & search work with simple mail passed, and with attachments ... except with .eml attachments. sending this message (plain txt email, with .eml as attachment) Content-Type: multipart/mixed; boundary="------------O6z0p865JVYqnvxPyzc0aSLA" Message-ID: <0b7f5053-05b5-4b4f-8c7e-4a640b79a5f4(a)fastmail.fm> Date: Sat, 12 Aug 2023 19:37:44 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: tika test This is a multi-part message in MIME format. --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â tika test --------------O6z0p865JVYqnvxPyzc0aSLA Content-Type: message/rfc822; name="t2.eml" Content-Disposition: attachment; filename="t2.eml" Content-Transfer-Encoding: 8bit Message-ID: <89e5914a-e928-422d-824f-5b4e90170cd7(a)fastmail.fm> Date: Sat, 12 Aug 2023 14:32:48 -0400 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Reply-To: sender(a)example1.com From: sender <sender(a)example1.com> Content-Language: en-US To: recipient(a)example2.com Subject: t2 Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Â t2 --------------O6z0p865JVYqnvxPyzc0aSLA-- from an off-site server to local postfix+dovecot instance tika & dovecot logs, journalctl -f -u tika Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.TikaLoggingFilter Request URI: http://192.0.2.20:9998/tika/ Aug 12 19:52:36 svr04tika[2035]: INFO [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource /tika (message/rfc822) Aug 12 19:52:36 svr04tika[2035]: WARN [qtp1472012329-175] 19:52:36,918 org.apache.tika.server.core.resource.TikaResource tika/: Text extraction failed (t2.eml) Aug 12 19:52:36 svr04tika[2035]: org.apache.tika.exception.ZeroByteFileException: InputStream must have > 0 bytes Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.AutoDetectParser.parse(AutoDetectParser.java:185) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.ParserDecorator.parse(ParserDecorator.java:152) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.parser.DigestingParser.parse(DigestingParser.java:57) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.parse(TikaResource.java:357) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.tika.server.core.resource.TikaResource.lambda$produceText$1(TikaResource.java:507) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.provider.BinaryDataProvider.writeTo(BinaryDataProvider.java:177) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.utils.JAXRSUtils.writeMessageBody(JAXRSUtils.java:1651) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.serializeMessage(JAXRSOutInterceptor.java:249) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.processResponse(JAXRSOutInterceptor.java:122) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.jaxrs.interceptor.JAXRSOutInterceptor.handleMessage(JAXRSOutInterceptor.java:84) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.interceptor.OutgoingChainInterceptor.handleMessage(OutgoingChainInterceptor.java:90) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:307) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:265) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPDestination.doService(JettyHTTPDestination.java:247) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.apache.cxf.transport.http_jetty.JettyHTTPHandler.handle(JettyHTTPHandler.java:79) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:190) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:191) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.Server.handle(Server.java:516) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) ~[tika-server-standard-2.8.0.jar:2.8.0] Aug 12 19:52:36 svr04tika[2035]: at java.lang.Thread.run(Thread.java:1623) [?:?] Aug 12 19:52:36 svr04tika[2035]: Aug 12, 2023 7:52:36 PM org.apache.cxf.jaxrs.utils.JAXRSUtils logMessageHandlerProblem Aug 12 19:52:36 svr04tika[2035]: SEVERE: Problem with writing the data, class org.apache.tika.server.core.resource.TikaResource$$Lambda$387/0x00000008012a9300, ContentType: text/plain tail -f /var/log/dovecot/*log | grep http-client 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998 (shared): Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer pool created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer created 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Setting up connection to 192.0.2.20:9998 (1 requests pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Linked queue http://192.0.2.20:9998 (1 queues linked) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Started new connection to 192.0.2.20:9998 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Submitted (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Waiting for request to finish 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Making new connection 1 of 1 (0 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connecting 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Waiting for connect (fd=28) to finish for max 0 msecs 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: HTTP connection created (1 parallel connections exist) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Client connected (fd=28) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connected 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Ready for requests 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Successfully connected (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Using 1 idle connections to handle 1 requests (1 total connections ready) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Connection to peer 192.0.2.20:9998 claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Claimed request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Sent header 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No more requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Got 422 response for request [Req1: PUT http://192.0.2.20:9998/tika/] Unprocessable Entity (took 3 ms + 106 ms in queue) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Finished 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Dropping request [Req1: PUT http://192.0.2.20:9998/tika/] 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host is idle (timeout = 100 msecs) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: request [Req1: PUT http://192.0.2.20/tika/] Free (requests left=1) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: No requests to service for this peer (1 connections exist, 0 pending) 2023-08-12 19:52:36 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: No more requests queued; going idle (timeout = 100 msecs) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Idle host timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: host 192.0.2.20: Host session destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: queue http://192.0.2.20:9998: Destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Unlinked queue http://192.0.2.20:9998 (0 queues linked) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Idle connection timed out 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection close 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection disconnect 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Disconnected: Connection closed (fd=28) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Detached peer 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Lost a connection (0 queues linked, 0 connections left, 0 connections pending, 0 requests pending, 0 requests urgent) 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: conn 192.0.2.20:9998 [1]: Connection destroy 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Dropping peer now 2023-08-12 19:52:37 indexer-worker(recipient(a)example2.com)<lrVsHUQb2GR1dgAA+IOfAw:xKZLMEQb2GR3dgAA+IOfAw>: Debug: http-client: peer 192.0.2.20:9998: Peer close unclear 2 me whether this is a bug in dovecot or in tika, or a matter of (mis)config. ??

1 0

sso / sharing authenticated sessions how does it work
by Marc 12 Aug '23

12 Aug '23

I am totally not experienced with setting up sso etc. I was wondering if/how it is possible to share an authenticated session between dovecot and the mail client with the webmail so a user does not need to login again.

1 0

Dovecot submission panics on SMTP RCPT error
by IB Development Team 10 Aug '23

10 Aug '23

Hi, If SMTP server rejects RCPT with message aaa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd when submitting message via dovecot submisstion server, dovecot panics: 2023-08-10 17:10:04 myhost exim[...] rejected RCPT <[...]>: aa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd 2023-08-10 17:10:04 myhost dovecot: submission(test)<7274><bAOu/ZICuuDAqHoB>: Panic: file smtp-server-reply.c: line 625 (smtp_server_reply_send_real): assertion failed: (text[0] == '-') 2023-08-10 17:10:04 myhost dovecot: submission(test)<7274><bAOu/ZICuuDAqHoB>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f64c8e484e2] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f64c8e485fe] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc49b) [0x7f64c8e5449b] -> /usr/lib/dovecot/libdovecot.so.0(+0xfc531) [0x7f64c8e54531] -> /usr/lib/dovecot/libdovecot.so.0(+0x53aee) [0x7f64c8dabaee] -> /usr/lib/dovecot/libdovecot.so.0(+0x4751c) [0x7f64c8d9f51c] -> /usr/lib/dovecot/libdovecot.so.0(+0x7b605) [0x7f64c8dd3605] -> /usr/lib/dovecot/libdovecot.so.0(+0x122171) [0x7f64c8e7a171] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f64c8e69f59] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f64c8e6b592] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f64c8e6a000] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f64c8e6a1c0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f64c8de04e3] -> dovecot/submission(main+0x4df) [0x562f3ac7c11f] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f64c8ba4d0a] -> dovecot/submission(_start+0x2a) [0x562f3ac7c1aa] Error message is configured in exim4.conf with begin routers mytestrouter: [...] cannot_route_message = aa bbbbbbbbbb ccccccc dd eeeeeeeeeeee ffffffffffff gggggggggg hh iiiiii jj kk llll mmmmmmmmmm nnn o ppppppppppppppp rrrrrr ssssss t uuuu w xxxxxxx yyyyyy zzzzzzzz aa bbbbbbbbbbb cccccccc dd eeeeee fff gggggg hhhhhhh iiiiiiii jj kkkkkk ll mm nnnn ooooo ppppppp qqqq r ssss tttttt uuuuuuuuuuuuu www xxx yyyyyyy zzzzz aaaaa bbbbbbbbb ccc ddddddd Dovecot installed from up-to-date Debian 11 package: # dpkg -s dovecot-core | grep Version Version: 1:2.3.13+dfsg1-2+deb11u1 -- Regards, Paweł Bogusławski IB Development Team E: dev(a)ib.pl

2 2

Dovecot and Thunderbird 15
by Elise 10 Aug '23

10 Aug '23

Hi, I recently had some issues with Thunderbird 15 when removing e-mail. With my other mailclient Outlook I could without any issue. As I don't grand POP3 mail pickup, I disabled that in dovecot.conf #service pop3-login { # inet_listener pop3 { # address = 10.10.10.52 # } # inet_listener pop3s { # address = 10.10.10.52 # } #} Enabling the above and restarting Dovecot solved the issue. Is it TB related or do I overlook a config parameter? E.

2 3

Question about custom flags
by d.meister-braeuer＠heinlein-support.de 09 Aug '23

09 Aug '23

Hello all, RFC3501 describes among other things that custom flags can be set for mails. These can be allowed or forbidden in the server: "Servers MAY permit the client to define new keywords in the mailbox". When I am on our server, it also looks like dovecot basically allows this: a select INBOX FLAGS (\Answered \Flagged \Deleted \Seen \Draft $Forwarded Old $ITipAnalyzed $ITipProcessed Forwarded NonJunk $cl_1 $cl_2 $cl_3) OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft $Forwarded Old $ITipAnalyzed $ITipProcessed Forwarded NonJunk $cl_1 $cl_2 $cl_3 \*)] Flags permitted. The only option that goes in this direction is this one: mail_max_keyword_length But basically describes something else as well, if I see it correctly. Is there a way to prevent dovecot from giving custom flags, or what is the name of the parameter where you can set this? Best

1 0

Outlook not showing all email in inbox at random
by David Koski 09 Aug '23

09 Aug '23

I manage IT for a small office with about 10 workstations. Dovecot has been installed for years and is now at 2.3.4.1-5 (Debian). I just discovered that the user cannot see many emails in the inbox. I was alerted when email was not appearing to be coming in for many hours. Other users observed the same thing. On investigation, I noticed many inbox emails missing in the Outlook GUI from times past that were on the server. It appears to be a broken client (Outlook 2019) to me but troubleshooting has yielded no solid leads. The profile and OST files have been re-created many times with no change in outcome. Each time, the inbox does not synchronize about 40 most recent emails but does for the last one for the day before and many before that. It may well be an Outlook issue so I'm looking for information to work around an Outlook bug if necessary. Thunderbird works perfectly. Also, interestingly, I can copy email from Thunderbird (or move emails on the server) to a temporary directory form the inbox, then move them back and they will appear if I don't move too many at a time. Regards, David Koski dkoski(a)sutinen.com

4 7

Application to automate mail-crypt plugin with user keys
by Benedikt Zumtobel 08 Aug '23

08 Aug '23

Hi everyone, I run a very small (about 10 users) mailserver setup with the mail-crypt plugin activated and wanted to transition from a global key setup to user keys. Since I couldn't find a satisfying solution to reencrypt mailboxes when users change their password I started writing a script that ended up being a small webservice giving users a simple selfservice portal to change their password. I consider it pretty much done by now and it's public on github. Maybe it's useful for somebody else. However its use case is very narrow since I initially wrote this just for myself. It does only support a Postgres user store for instance. The main reason, however, for this post is me wondering if anybody would bother to give me some feedback. Especially for the following aspects: I execute doveadm from within my application. The advantage is that I can keep the code very light (~650 lines of code) while at the same time don't have to care about the crypto stuff which I wouldn't dare trying anyways. The disadvantage of this approach is that I had to write a doveadm wrapper that needs the setuid bit to execute doveadm mailbox commands. I consider this a bit hacky but a better solution didn't come to my mind. Another aspect is the password that is being used to encrypt the private key. When creating a new user in the database I generate a unique salt. This salt is prefixed to the user's clear text password and the resulting string is run trough the sha3-512 hash function. The output is the mail_crypt_private_password. You find the project here: https://github.com/nonce9/pwch Criticism is welcome. Benedikt

4 3

Dovecot bug submit - Dovecot stats
by Brent Clark 07 Aug '23

07 Aug '23

Good day Guys Just a brief background, Im looking to enable and run doveadm stats, as per https://doc.dovecot.org/configuration_manual/stats/ When I run the command: doveadm stats add --description "IMAP SELECT commands" --exporter log-exporter --exporter-include "name timestamps" --fields "bytes_in bytes_out" --group-by "cmd_name tagged_reply_state" imap_cmd_select "event=imap_command_finished AND name=SELECT" I get: ==> /var/log/mail.info <== Aug 3 05:52:36 bullseye dovecot: stats: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f08c7097582] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f08c709769e] -> /usr/lib/dovecot/libdovecot.so.0(+0x1022fb) [0x7f08c70a42fb] -> /usr/lib/dovecot/libdovecot.so.0(+0x102391) [0x7f08c70a4391] -> /usr/lib/dovecot/libdovecot.so.0(+0x55589) [0x7f08c6ff7589] -> dovecot/stats(+0x5aa5) [0x561765217aa5] -> dovecot/stats(stats_metrics_add_dynamic+0x11f) [0x56176521a80f] -> dovecot/stats(+0x6724) [0x561765218724] -> /usr/lib/dovecot/libdovecot.so.0(connection_input_default+0x155) [0x7f08c709bd05] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f08c70ba529] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f08c70bbc12] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f08c70ba5d0] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f08c70ba790] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f08c702d353] -> dovecot/stats(main+0x128) [0x561765217e38] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f08c6ca8d0a] -> dovecot/stats(_start+0x2a) [0x561765217eba] ==> /var/log/mail.warn <== Aug 3 06:23:51 bullseye dovecot: stats: Fatal: master: service(stats): child 38121 killed with signal 6 (core dumped) I installed and run systemd-coredump, dovecot-sysreport Please will you take a look at the various attached files (coredumps etc) Many thanks. Kind Regards Brent Clark

2 1

doveadm fts lookup: Is "search query" documented anywhere?
by Graham Leggett 07 Aug '23

07 Aug '23

Hi all, According to the —help option for doveadm fts, there is a “lookup” option as follows: [root@aurora ~]# doveadm fts --help usage: doveadm [-Dv] [-f <formatter>] fts <command> [<args>] expand [-u <user>|-A] [-S <socket_path>] <search query> lookup [-u <user>|-A] [-S <socket_path>] <search query> optimize [-u <user>|-A] [-S <socket_path>] [<namespace>] rescan [-u <user>|-A] [-S <socket_path>] [<namespace>] tokenize [-u <user>|-A] [-S <socket_path>] <text> The option does not appear to be documented anywhere (eg https://doc.dovecot.org/3.0/man/doveadm-fts.1/) and “search query” doesn’t appear to be defined. Guessing that it might be just plain text, I tried searching for a known word, but this failed as follows: [root@aurora ~]# doveadm fts lookup -u test(a)example.com sweet Fatal: Unknown argument SWEET Anyone know? Regards, Graham —

2 2

Trash deleted date?
by joe a 07 Aug '23

07 Aug '23

Using Thunderbird client. Cannot sort "Trash" Folder by time/date deleted. I can display both "Received" and "Date" columns, but they show identical data. Does dovecot create a "deleted" time stamp? dovecote 2.3.20 (80a5ac675d) TB 102.14.0 64 bit

1 0

passwdb deny.ip
by mauric＠gmx.ch 06 Aug '23

06 Aug '23

Hello i understod in the last discussion thread <Forcing imap authentication failure for certain IP addresses> that also IP can be filter, ok the ip are available in deny.ip. Please why this are not blocked? # dovecot version 2.3.4.1 (f79e8e7e4) passdb { args = /etc/dovecot/deny.ip args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } cat mail.log | grep 'sql(name,' Aug 06 01:29:11 Dovecot/auth-worker(7927): Info: sql(Name,A.B.232.146): unknown user # cat deny.ip | grep A.B.232.146 A.B.232.146 meny thanks

3 3

mail-crypt long-term support? How to backup?
by eaerhaerhaehae aehraerhaeha 05 Aug '23

05 Aug '23

3 6

Dovecot shared folders - examples of the "doveadm acl" command?
by Graham Leggett 05 Aug '23

05 Aug '23

Hi all, The old wiki has been taken down, and all the links I can find through google are now broken. Does anyone have a concrete example of “doveadm acl” to grant someone access to a shared folder? Regards, Graham —

2 2

fail2ban / ldap login failure
by micha＠micha.waw.pl 05 Aug '23

05 Aug '23

[Debian Bookworm + Dovecot 2] I have user database in ldap (samba). I want to use fail2ban to restrict unsuccessful login attempts, but... I cannot see "Authentication failure" message in ANY log. (/var/log/mail.log shows successful logins as well as disconnects.) How should I proceed?

2 1

Pigeonhole redirect is adding a message-id header when it already exists
by Sébastien Riccio 04 Aug '23

04 Aug '23

Hello, We are using sieve filter to redirect incoming mails to an external mailbox (gmail) an we are seeing some forwarded e-mails being rejected by gmail because of duplicate headers. I think was able to identify the probable cause of the duplicate headers: It seems that when the original message's "Message-ID" is not compliant, pigeonhole acts like if the header is not existing and adds it's own Message-ID. This result in having two "Message-ID" headers being submitted to the destination mail server. Original Message-ID: Message-ID: 1883biz_pay_after_purchase:0:0_572392900$ae7ed6e4d53b424c84aaf83b30c507e7 Pigeon hole adds his own Message-ID: Message-ID: <dovecot-sieve-1664386049-21512-0@510faa1ff2d9> Gmail answer: 550-5.7.1 [94.103.100.17] Our system has detected that this message is not RFC 550-5.7.1 5322 compliant: duplicate headers. To reduce the amount of spam sent 550-5.7.1 to Gmail, this message has been blocked. Please review 550 5.7.1 RFC 5322 specifications for more information. While I understand the original "Message-ID" seems to be all but compliant with RFCs, shouldn't a "Message-ID" be added only when "Message-ID" is really missing ? When redirecting a message, If the original "Message-ID" exists but is bogus shouldn't it still be forwarded untouched ? Also, maybe if pigeonhole is adding it's own "Message-ID", shouldn't it remove any previous "Message-ID" to avoid generating duplicate headers ? (but maybe it could break some DKIM stuff?) Any ideas how to workaround this issue ? Thanks a lot for your feedbacks! Sébastien RICCIO SYSTEM ADMINISTRATOR P +41 840 888 888 F +41 840 888 000 M sriccio(a)swisscenter.com<mailto:sriccio@swisscenter.com>

9 17

Using / in folder names
by Scott 04 Aug '23

04 Aug '23

Is this possible at all ? I am trying to import a PST file and it has a slash in the folder name. Dovecot errors out with : APPEND "Caixa de Entrada_VIDA/S1" (\Seen) NO [CANNOT] Invalid mailbox name: Name must not have '/' characters My namespace separator is the dot and I configured the listescape plugin to escape / but it still doesn't work. The listescape documentation says: The / character is disallowed on POSIX systems. This plugin allows you to use all of these characters, as long as the virtual separator (i.e. what is set by the separator setting and used as such by the IMAP protocol) is changed to something else, which means that the plugin does not make it possible to use the virtual separator in folder names. So it seems that as long as I use the dot, it should work ? Except it doesn't... How can I do this import ? Thank you!

3 9

RE: Forcing imap authentication failure for certain IP addresses
by aki.tuomi 02 Aug '23

02 Aug '23

One way is to use https://doc.dovecot.org/configuration_manual/authentication/auth_policy/or you can use passdb { driver = passwd-file deny = yes args = username_formar=%{rip} /etc/dovecot/deny.ip}or you can use https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… write this in Lua.Aki -------- Original message --------From: Hippo Man <hippoman(a)gmail.com> Date: 8/1/23 18:14 (GMT+02:00) To: dovecot(a)dovecot.org Subject: Forcing imap authentication failure for certain IP addresses I'm running dovecot 2.3.18 under Debian 11.I want to do something that's a bit unusual: when IMAP connections are attemptedfrom a few specific IP addresses, I want to force an IMAP authentication failurefrom those connections, no matter what user ID and password are specified.I know that I can use iptables to completely block imap access from those IPaddresses to the IMAP ports. However, in these specific cases, I'd prefer thatthe connection goes through to dovecot, but for dovecot then to always generateauthentication failures for those specific connections ... even if a validuser ID and password happen to be specified.Is there a way to do this in dovecot?Thank you very much in advance.-- hippoman(a)gmail.com Take a hippopotamus to lunch today. .---------, 0__0 / ( oo'---, / oo\ ,\ | | \ ,=__/ \ / / /------| /| |__|-' |__|'

3 5