- dovecot - dovecot.org

sieve passing body as arguments to executed script
by Jonathan Davis 02 Aug '23

02 Aug '23

I ran into an issue when trying to wildcard match the email body where the variable was empty, which lead me to extracttext and forverypart, however I am running into an odd error. When I deliver an email with the body of 'this is the body text of email' it dies with the following error: sogo: line 236: error: specified :args item `this is the body text of email??' is invalid The sieve in question: if header :matches "Subject" "*" { set "emailsubject" "${1}"; } if header :matches "From" "*" { set "emailfrom" "${1}"; } foreverypart { if header :mime :type :is "Content-Type" "text" { extracttext :first 80 "emailbody"; break; } } execute "script.php" ["${emailfrom}", "${emailsubject}", "${emailbody}"]; I tried downloading the log to see if ?? was a character not rendering correctly in console, but local text editors show the same. I'm not sure where it is coming from or what it is. I tried :quotewildcard with set :quotewildcard "quotedbody" ${emailbody}"; And passed "${quotedbody}" as an argument, however the same error was appearing in the logs. If I'm approaching this problem incorrectly, the end result is I want to pass the entire contents of the email to the script. - Jonathan

1 0

Postlogin script ACL_GROUPS from LDAP
by Andrzej Milewski 01 Aug '23

01 Aug '23

Hello, I am testing the Dovecot mail server with the iRedMail configuration. My backend is based on LDAP. I would like to set up the "Public" folders in such a way as to grant permissions to specific groups of users. To achieve this, I created the following entry in the configuration: acl = vfile:/etc/dovecot/dovecot-acl-global:cache_secs=300 For individual users, the global permissions work correctly, and I achieve what I want. However, I am unsure how to grant permissions for a group. Specifically, I know that I should include permissions for groups in this file, for example: Public/ anyone l Public/IT_Suwalki group=grupa1 lrwstipek Public/IT_Suwalki/* group=grupa1 lrwstipekxa But I don't know how to associate users with groups. From what I managed to figure out, the user should have the "ACL_GROUPS=grupa1,grupa2" variable, and it should be passed by the postlogin script. But how can I do that? Do you have any working example of such a script? Which LDAP attributes should this script utilize? In my LDAP, there is an attribute called "memberOfGroup"; can I use it? Thank you for all the suggestions. -- Andrzej Milewski andrzej.milewski(a)gmail.com tel. 0603957324

1 0

Imaptest sigfault error
by DeJa Wu 31 Jul '23

31 Jul '23

I Tried to run the test with imaptest and got a segfault error. Debug: Reading symbols from imaptest...done. (gdb) run user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining Starting program: /usr/bin/imaptest user="puser%d(a)am.local" users=0-100000 pass=Us123456 host=ha-rr.am.local ssl=any-cert clients=100000 port=993 - secs=300 no_pipelining [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Logi Sele Logo 100% 100% 100% 179 163 154 551/637 [0%] 245 247 250 1153/1372 [1%] 238 240 238 1725/2086 [2%] 213 215 219 2250/2725 [2%] 213 209 203 2760/3364 (263 stalled >3s) [3%] 220 226 228 3308/4024 (854 stalled >3s) [4%] 247 245 247 3870/4765 (1338 stalled >3s) [4%] 239 237 239 4414/5482 (1800 stalled >3s) [5%] 259 257 259 4998/6259 (2299 stalled >3s) [6%] 270 274 271 5599/7069 (2809 stalled >3s) [7%] 3843 46 26 ms/cmd avg Logi Sele Logo 100% 100% 100% 243 242 237 6122/7798 (3369 stalled >3s) [7%] 242 239 237 6697/8524 (3937 stalled >3s) [8%] 241 241 248 7251/9247 (4542 stalled >3s) [9%] 229 231 234 7776/9934 (5143 stalled >3s) [9%] 230 228 225 8332/10624 (5800 stalled >3s) [10%] Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7f1745f in io_loop_handler_run_internal () from /usr/lib/dovecot/libdovecot.so.0 How can I fix this?

2 1

Notification "API" for external replication
by Heiko Schlittermann 31 Jul '23

31 Jul '23

Hi Aki and all the Dovecot team, thank you for your work on Dovecot. As the "built-in" replication is going to cease (I do not want to discuss the reasoning or any judgement here): Can you (the Dovecot developers) ensure that a kind of "notification socket"¹ will be there, even if you do not provide a the replicator feature? And - but that's already a feature request - could you use this (or an other socket) for notifications on sieve script changes? I can imagine using this socket as an "official" interface to external software. Actually that would implicate that the notification messages are documented and stable, but I'm sure, this would be possible (if not done already). ¹) That is how I understand the current mechanism of the replication: the replicator gets a notification via the socket and starts replicating the mailbox. Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 1

Accessing SSL parameters via dovecot variables
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, Dovecot supports variables, which can be used in filters. Does the SSL code expose variables linked to the client certificate? The answer today appears to be no, and if that’s true I plan to patch it, but just need to confirm I am not missing something. Regards, Graham —

2 2

Filtering by SASL auth mechanism
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I want dovecot to behave differently depending on what SASL mechanism was used. Most specifically, if EXTERNAL, I want auth_ssl_username_from_cert to be yes, but no otherwise. There is a filtering mechanism that supports protocol, remote, etc. https://doc.dovecot.org/configuration_manual/config_file/ Would it make sense to add a SASL mechanism filter like this: mechanism external { # … } Regards, Graha —

1 0

SASL External and LDAP - Login attempt with empty password
by Graham Leggett 26 Jul '23

26 Jul '23

Hi all, I am trying to configure dovecot to accept SASL EXTERNAL authentication with a client certificate and no password. I have tried the following configuration: passdb { driver = ldap # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext args = /etc/dovecot/dovecot-ldap-external.conf.ext mechanisms = external default_fields = noauthenticate=y } In the logs I see dovecot correctly negotiate SASL EXTERNAL, but eventually we reach this line and we fail: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… Which is in turn reached by following this code: https://github.com/dovecot/core/blob/34a18f5a79bf7eca58e55aff3e1fe69468292d… In theory, if I understand this correctly, what is missing is a field to say “don’t try check any password”, which field is this supposed to be? “nopassword”? “noauthenticate”? I am happy to patch this, but need some guidance as what the correct approach is. Regards, Graham —

1 0

Quota possibly overcomplicating, need sanity check?
by David Mehler 25 Jul '23

25 Jul '23

Hello, New setup and trying to get quotas going. It's a Dovecot/Postfix/Mariadb virtual user setup. In my db I have a varchar field called quota with a default value of 128. Here's what I have in dovecot configs for quota: # Plugins mail_plugins = acl mail_crypt quota service stats { fifo_listener stats-mail { user = vmail mode = 0644 } inet_listener { address = 127.0.0.1 port = 24242 } } # quota status service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/dovecot-quota { user = postfix group = postfix mode = 0660 } client_limit = 1 } # Quota warnings service quota-warning { executable = script /usr/local/bin/quota-warning.sh user = vmail unix_listener quota-warning { group = vmail mode = 0660 user = vmail } } plugin { quota = count:User quota quota2 = maildir:Shared quota:ns=public/ quota_max_mail_size = 100M # Required for 'count' quota driver quota_vsizes = yes quota_rule2 = Trash:storage=+10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=100M quota_rule3 = SPAM:ignore quota_warning = storage=100%% quota-warning +100 %u quota_warning2 = storage=95%% quota-warning +95 %u quota_warning3 = storage=80%% quota-warning +80 %u quota_warning4 = -storage=100%% quota-warning -100 %u # user is no longer over quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_grace = 10%% # 10% is the default quota_status_success = DUNNO quota_status_nouser = DUNNO quota_status_overquota = "552 5.2.2 Mailbox is full" ## Stats ### how often to session statistics (must be set) stats_refresh = 30 secs ### track per-IMAP command statistics (optional) stats_track_cmds = yes } The protocol imap has the imap_quota plugin and protocol lmtp has the quota plugin. I've also got lmtp_rcpt_check_quota = yes mailbox_list_index = yes In my dovecot-sql.conf file my user query looks like this: user_query = SELECT concat('*:storage=', quota, 'M') AS quota_rule FROM accounts WHERE username = '%Ln' AND domain = '%Ld' AND sendonly = false; Postfix checks: check_policy_service unix:private/dovecot-quota Am I overcomplicating? Thanks. Dave.

1 0

mail_crypt on existing mailstore
by David Mehler 25 Jul '23

25 Jul '23

Hello, I've got a pre-existing mailstore, it's a Postfix/Dovecot/Mariadb virtual-user setup, with users and mailboxes. I'd now like to get mail_crypt going. Can I do this with this existing store or if not how would I set this up? Thanks. Dave.

1 0

subscription, dots and subscribe to shared folder.
by Julien Nadal 24 Jul '23

24 Jul '23

Hello; We were able to set up shared folders in a cluster (using dovecot as proxy on dedicated front-end servers, without using director) by following https://doc.dovecot.org/configuration_manual/shared_mailboxes/cluster_setup/. Here is our related conf on imap farms (dovecot v2.3.16 on Almalinux): namespaces: mail_location = maildir:~/Maildir namespace default { inbox = yes location = prefix = separator = / } namespace shared { list = children location = imapc:~/shared/%%u:INDEXPVT=~/shared-pvt/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } imapc settings: imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = XXXXXX imapc_master_user = %{user} imapc_password = XXXXXX imapc_port = XXXXXX passdb { args = password=#hidden_use-P_to_show# userdb_namespace/shared/disabled=yes userdb_acl_user=%{auth_user} allow_nets=XXXXX/XX driver = static master = yes } dict { acl-mysql = mysql:/etc/dovecot/conf.d/dovecot-dict-sql.conf.ext } This way, a folder is created under ~/ : shared & shared-pvt : When user A shares a folder with B, B will find ~/shared/userA/sharedfolder I should mention that the user authentication (backend: mysql) uses the full email address as we are in a multi-tenant context. So the folder looks like ~/shared/usera(a)domain.tld/folder Since then, everything works perfectly, we can share and see the shared folders in the webmail (SOGo). Unfortunately, accessing these folders through an imap client (tested on Thunderbird and MSOutlook) is impossible because the subscription fails (the folder is listed, but the subscription doesn't seem to do anything). I could not find any relevant logs but I was able to confirm on the command line: I am able to view folder with LIST, subscribe with an "OK" output, but the folder is not listed with LSUB. So I could see that the subscribtion file in maildir shows incorrect entries: V 2 Sent Trash Drafts Junk shared/testuser1@sub domain tld/INBOX/folder The dots in the folder names are replaced by tabs. I was able to recover things by editing the file as follows: Sent Trash Drafts Junk shared/testuser1(a)sub.domain.tld/INBOX/folder This means that Maildir++ and V2 subscription can't handle dots in folders. I found a previous discussion: https://dovecot.org/pipermail/dovecot/2021-January/121233.html But the final advice can't be applied on our side: - changing LAYOUT to FS is not possible for us - we have already migrated the dot separator to slash - changing the layout only for shared namespaces does not solve the problem and totally breaks the access to shared folders. Thanks a lot for your advice Best regards Julien

3 4

Outlook and IMAP Flags
by Laura Smith 22 Jul '23

22 Jul '23

Hi I've tried searching the internet, but the only thing I can find is a post on a MIcrosoft forum where a Microsoft reps claims flags are not supported on IMAP (I thought it was an RFC3501 feature ?). Anyway, I have a user who has Outlook/Windows on desktop and iOS (iPhone/iPad) for remote. On the iOS devices, the user can happily set flags against messages with zero issues. And indeed, when they set these flags, they are shown in Outlook. However if they attempt to set the flag in Outlook, nothing happens. Outlook continues showing the message as if it was unflagged. Any ideas ? Laura

2 1

Exclude folders from fts xapian on a per-user basis
by Adam Kessel 21 Jul '23

21 Jul '23

Is there any way for a user to specify folders they want excluded from fts xapian indexing? Or can this only be done globally in /etc?

1 0

Dovecot pigeon/sieve and SELinux
by Graham Leggett 21 Jul '23

21 Jul '23

Hi all, I am in the process of migrating a dovecot installation from RHEL8 to RHEL9, this time round I am trying to get everything to work in selinux enforcing mode. First error I am stuck on is as follows: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=377(vmail) egid=376(vmail) missing +x perm: /var/lib/dovecot, we're not in group 97(dovecot), dir owned by 97:97 mode=0750) It appears that the vmail user cannot access /var/lib/dovecot, because under RHEL9 the permissions are hidden to the world. [root@seawitch dovecot]# ls -al /var/lib/dovecot total 12 drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:51 . Am I correct in interpreting the error message as meaning that /var/lib/dovecot/sieve is not a correct directory for global sieve scripts, and they need to go somewhere else? If they do need to go somewhere else, in the world of enforcing selinux, where do they go? While dovecot-selinux is documented, sieve is not mentioned: https://linux.die.net/man/8/dovecot_selinux So, let’s work around the above error by adding the vmail user to the dovvecot group. Is this even a good idea? /usr/sbin/usermod -a -G dovecot vmail Now we hit the next error: Error: sieve: file storage: Failed to stat sieve storage path: stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied (euid=380(vmail) egid=378(vmail) missing +w perm: /var/lib/dovecot/sieve/vacation.sieve stat(/var/lib/dovecot/sieve/vacation.sieve) failed: Permission denied, dir owned by 0:0 mode=0755) This error is weird. Dovecot is trying to open the original vacation.sieve source file for write - why? We have pre-compiled all the global sieve scripts: [root@marcopolo ~]# ls -al /var/lib/dovecot/sieve/ total 36 drwxr-xr-x. 5 root root 4096 Jul 21 17:29 . drwxr-x---. 3 dovecot dovecot 36 Jul 21 17:29 .. -rwxr-xr-x. 1 root root 284 Jul 21 08:47 junk.sieve -rw-r--r--. 1 root root 277 Jul 21 17:29 junk.svbin -rwxr-xr-x. 1 root root 316 Jul 21 08:47 report-ham.sieve -rw-r--r--. 1 root root 476 Jul 21 17:29 report-ham.svbin -rwxr-xr-x. 1 root root 201 Jul 21 08:47 report-spam.sieve -rw-r--r--. 1 root root 382 Jul 21 17:29 report-spam.svbin drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-execute drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-filter drwxr-xr-x. 2 root root 6 Jul 21 08:47 sieve-pipe -rwxr-xr-x. 1 root root 309 Jul 21 08:47 vacation.sieve -rw-r--r--. 1 root root 558 Jul 21 17:29 vacation.svbin Is the error perhaps inaccurate, and it’s trying to open a temp file for write, failing (correctly, it has no business opening a temp file for write at this point), and then claiming the failure on the temp file is a failure on the source file? So to sum up: - In an SELinux world of Redhat, what directory do global sieve scripts go? - What permissions and selinux context are required on the global sieve scripts directory? Regards, Graham —

1 0

IMAP account can't save any email with attachment
by Chris Thomas 20 Jul '23

20 Jul '23

Hi, I'm getting a curious problem where if I write a draft without an attachment and click save. It'll work without any issue at all. But if I do the same, then attach a file to the email, it'll sit there for a couple of minutes before timing out (I'm using thunderbird), it'll eventually give you a message saying "Your draft message was not copied to your drafts folder (Drafts) due to network or file access errors." I've got all of dovecots verbose logging turned on. I'm using dovecot as a submission server through to the postfix server to do the actual sending. All the logging is turned on there too. But I can't figure out what the problem is. Is there anything I can look for in the logs that will help me out? chris

2 3

Re: Tons of imap-login processes despite client_limit very high
by Joseph Tam 20 Jul '23

20 Jul '23

https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html From: D D <pierre.alletru(a)gmail.com> > We're seeing a ton of imap-login processes running even when using high performance mode (https://doc.dovecot.org/admin_manual/login_processes/#high-performance-mode) According to the docs: > > "process_min_avail should be set to be at least the number of CPU cores in the system, so that all of them will be used. Otherwise new processes are created only once an existing one’s connection count reaches client_limit" > > We have process_min_avail=4, client_limit=0 and default_client_limit=200000. So we'd expect seeing only 4 imap-login processes serving a ton of connections each. Yet, we see thousands of imap-login processes (more than half of all the imap processes): > ... > > Is having so many imap-login processes normal with our config? Did we misunderstand the docs or is there something wrong here? > > > default_client_limit = 1048576 > default_process_limit = 200000 > > service imap-login { > # client_limit = 0 # default is 0 > # process_limit = 0 # default is 0 > service_count = 100 This service limit might be your culprit. I wrote about the strange interaction between service_count and process_limit here: https://www.mail-archive.com/dovecot%40dovecot.org/msg85850.html This gotcha should really be documented. Joseph Tam <jtam.home(a)gmail.com>

3 4

Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 19 Jul '23

19 Jul '23

5 5

-d ${user}@${nexthop} or -d ${recipient}?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

What's the differency between these two lines; 1- flags=DORhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -r ${recipient} -d ${user}@${nexthop} 2- flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} and which one should I use, based on a setup like; Dovecot, Postfix, Postfixadmin, ManageSieve and virtual users hosted in SQL? Thanks in advance.

1 0

dovecot: lda(info@mydomain) - vacation action: discarding vacation response to mailinglist recipient?
by rixati6186＠iturchia.com 18 Jul '23

18 Jul '23

Hello, I'm trying to set auto reply for my email account, through Roundcube and ManageSieve plugin (the plugin itself and its regular filtering works fine), however the auto-reply doesn't arrive to the sender's inbox, when I tested it with sending an email to myself/my server, from my Gmail account, my maillog has a line, stating; Jul 18 15:28:06 mailsrv dovecot: lda(info(a)mywebsite.com)<44812><uikMAlaFtmQMrwAAI6rZ/g>: sieve: msgid=<CA+GnASfyKJDPB-K2uCvxaOL-XQQ7Uv=yJt7sgJSYm-YJzYJSfQ(a)mail.gmail.com>: vacation action: discarding vacation response to mailinglist recipient <mysendermail(a)gmail.com> Any idea would be much appreciated, thank you!

1 1

Re: Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 18 Jul '23

18 Jul '23

2 1

Re: Fatal error in http-client.c when passdb is oauth2 and userdb is sql
by Евгений Бахтин 18 Jul '23

18 Jul '23

2 1

Tons of imap-login processes despite client_limit very high
by D D 18 Jul '23

18 Jul '23

Hi Dovecot community. We're seeing a ton of imap-login processes running even when using high performance mode (https://doc.dovecot.org/admin_manual/login_processes/#high-performance-mode) According to the docs: "process_min_avail should be set to be at least the number of CPU cores in the system, so that all of them will be used. Otherwise new processes are created only once an existing one’s connection count reaches client_limit" We have process_min_avail=4, client_limit=0 and default_client_limit=200000. So we'd expect seeing only 4 imap-login processes serving a ton of connections each. Yet, we see thousands of imap-login processes (more than half of all the imap processes): $ ps aux | grep imap-login | wc -l 1278 $ ps aux | grep imap | wc -l 2154 We use verbose_proctitle=yes and a there seem to be 2 types of these processes, about half for a single IP and about half we suspect for multiple IPs: $ ps aux | grep imap-log _apt 1941081 0.0 0.0 10420 8700 ? S 14:57 0:00 dovecot/imap-login [84.115.232.178 TLS proxy] _apt 1941589 0.0 0.0 10532 8648 ? S 14:57 0:00 dovecot/imap-login [119.202.86.160 TLS proxy] _apt 1941789 0.0 0.0 10188 8620 ? S 14:57 0:00 dovecot/imap-login [0 pre-login + 2 TLS proxies] _apt 1942144 0.0 0.0 10716 8748 ? S 14:57 0:00 dovecot/imap-login [0 pre-login + 3 TLS proxies] _apt 1942428 0.0 0.0 10800 8712 ? S 14:57 0:00 dovecot/imap-login [5.41.100.37 TLS proxy] ... $ ps aux | grep imap-log | grep pre-login | wc -l 624 $ ps aux | grep imap-log | grep -v pre-login | wc -l 654 Is having so many imap-login processes normal with our config? Did we misunderstand the docs or is there something wrong here? default_client_limit = 1048576 default_process_limit = 200000 service imap-login { # client_limit = 0 # default is 0 # process_limit = 0 # default is 0 service_count = 100 process_min_avail = 4 vsz_limit = 2G inet_listener imap { } inet_listener imaps { haproxy = yes port = 994 } }

2 3

cram-md5, sasl and lua (inheriting technical debt)
by tknb8＠tunenet.dk 18 Jul '23

18 Jul '23

Hello, I am exploring the posibility of migrating an exsisting setup to postfix+dovecot. The issue being that many clients are currently configured for cram-md5 authentication. I am fully aware that this is a really, really, really bad idea, but re configuring all clients at once is not feasible with limited end user support resources. I have a setup running with LUA for the passdb, and everything works with PLAIN login. To keep compatibility with the PLAIN login mechanism i have tried to store {PLAIN} passwords in the DB, since proper secure password storage is incompatible with CRAM-MD5. My issue is that the LUA function auth_password_verify(req, pass) not even seems to be called for cram-md5 logins. Reading through the documentation also seems to indicate that the callenge is not passed to the LUA function making it impossible to compute the hash in LUA or the function req.password_verify(req, row.password, pass). Is my assumption correct that cram-md5 can not work with a LUA script ? Kind regards, Peter K.

2 1

Many IDLE imap processes but very few connections moved to imap-hibernate
by pierre.alletru＠gmail.com 17 Jul '23

17 Jul '23

Hi Dovecot community! I have a strange issue with imap-hibernate. Or more likely it behaves as it's supposed to and it's just that I don't really understand it. I have enabled it, and it works, but for some reason hibernation happens only to a tiny amount of connections, whereas I have a lot of IDLE imap processes. And I can't find any relevant errors in the logs. ## config ## mail_debug = yes verbose_proctitle = yes $ doveconf imap_hibernate_timeout imap_hibernate_timeout = 5 secs $ doveconf -a | grep -A 21 'service imap-hibernate' service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } ## imap processes ## $ ps aux | grep "dovecot/imap" | wc -l 2214 ps aux | grep "dovecot/imap" | grep IDLE | wc -l 1258 $ ps aux | grep "imap-hibernate" syslog 1571453 0.0 0.0 4748 3156 ? S 15:44 0:00 dovecot/imap-hibernate [18 connections] As you can see here I have 1258 IDLE imap processes (out of 2214 in total), and only 18 connections in imap-hibernate. I'd like to have all IDLE processes to be moved to imap-hibernate in order to save up memory. Any idea why these 1k+ IDLE imap processes are not moved into imap-hibernate? Thank you!

2 1

Problem connecting with desktop client
by Wolfgang Paul Rauchholz 17 Jul '23

17 Jul '23

I run my home server under Rocky Linux 9. The server is modem / router and as such has two firewall interfaces; internal and external. Dovecot version is dovecot-2.3.16-8.el9.x86_64 kernel is: 5.14.0-284.18.1.el9_2.x86_64 My domain is wo-lar.com Postfix and Dovecot are up and running, and I can send and receive emails from CLI. But I cannot connect from desktop clients. I get the following error message: Server message: Can't connect to host "tcp://wo-lar.com:143" I tried to telnet from my desktop and server. Results are the same: - I always get a connection refused: telnet wo-lar.com 143 telnet / telnet <Server LAN IP> 143. On server only: telnet 127.0.0.1 143 - telnet wo-lar 143 (without .com!) establishes a connection [root@home wp.rauchholz]# telnet wo-lar 143 Trying 79.152.236.25... Connected to wo-lar. Escape character is '^]'. OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot ready. I went through all kinds for conf files and search for wo-lar string, but can't find it anywhere Where is the mistake hiding? Thanks for helping. Wolfgang

2 4

Re: Replication going away?
by William Edwards 16 Jul '23

16 Jul '23

> Op 16 jul. 2023 om 17:57 heeft Aki Tuomi <aki.tuomi(a)open-xchange.com> het volgende geschreven: > > Hi! > > Yes, director and replicator are removed, and won't be available for pro users either. > > For NFS setups (or similar shared setups), we have documented a way to use Lua to run a director-like setup, see > > https://doc.dovecot.org/3.0/configuration_manual/howto/director_with_lua/ It would probably be good to share this link in the aforementioned Director removal thread. > > Regards to replication, doveadm sync is not being removed. So you can still run doveadm sync on your system to have a primary / backup setup. > > Aki > >> On 16/07/2023 18:34 EEST William Edwards via dovecot <dovecot(a)dovecot.org> wrote: >> >> >> Top posting because nothing specific to reply to, sorry. Not exactly sure, but there’s another thread about the removal of Director in favour of Dovecot Pro on 3.x. Perhaps this change is related. >> >> William Edwards >> >>>> Op 16 jul. 2023 om 16:33 heeft Daniele <danix(a)kernel-panic.it> het volgende geschreven: >>> >>> Hello, >>> >>> Just like Vladimir, I'm a bit concerned about this change, and I'd really appreciate if someone could let us know if the replication feature (that works so well!) will be replaced or removed; and, in case of removal, what would be recommended replacement? >>> Thanks in advance and best regards, >>> Daniele >>> >>>> On 09-Jul-23 9:36 PM, Vladimir Mishonov via dovecot wrote: >>>> Hello everyone. >>>> >>>> Just saw this commit in the official Github repo: >>>> >>>> https://github.com/dovecot/core/commit/4c04e4c30fd4817a8b0e11d04d9681173f69… >>>> >>>> Looking at the commit details, it appears that it completely removes the replication feature. I'm a bit perplexed by this change and am not sure what might be the justification for it. Personally, I find replication to be very useful, as it allows me to maintain a synchronized mirror of all of my mailboxes on my home server, for use as backup in case the primary server goes down for some reason. >>>> >>>> Perhaps there's some sort of replacement being planned for this feature? Or maybe the relevant code is simply going to be refactored to a plugin or external program, and there's nothing to worry about at all? >>>> >>>> In any case, I'd greatly appreciate if one of the developers could comment on this change. >>>> >>> >>> _______________________________________________ >>> dovecot mailing list -- dovecot(a)dovecot.org >>> To unsubscribe send an email to dovecot-leave(a)dovecot.org >>> >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org >

1 0

user lookup fails username is SHA256 @domain
by Daniel Botting 16 Jul '23

16 Jul '23

Hi all, I'm currently building a replacement personal mailserver on Debian 11 (hopefully upgrade it to 12 and it will continue to work). My existing personal mailserver is serving a handful of mailboxes for three domains, virtual users, on an older version of Debian. When I attempt to deliver mail to the server (using swaks) it is accepted by Exim and passed to lda, as per the logs below the lda is somehow seeing the CRYPT entry as if it was the local part? Output from syslog: Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): Started userdb lookup Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb: Connecting Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=700293,uid=0): Client connected (fd=9) Jul 16 09:50:02 imap2 dovecot: auth: Debug: master in: USER#0111#011{SHA256-CRYPT}generated-sha(a)example.domain#011service=lda Jul 16 09:50:02 imap2 dovecot: auth: Username character disallowed by auth_username_chars: 0x7b (username: {SHA256-CRYPT}generated-sha(a)example.domain) Jul 16 09:50:02 imap2 dovecot: auth: Debug: userdb out: NOTFOUND#0111 Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): auth USER input: Jul 16 09:50:02 imap2 dovecot: lda({SHA256-CRYPT}generated-sha(a)example.domain)<700316><>: Debug: auth-master: userdb lookup({SHA256-CRYPT}generated-sha(a)example.domain): Userdb lookup failed Jul 16 09:50:02 imap2 dovecot: lda(700316): Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=700293,uid=0): Disconnected: Connection closed (fd=9) From what I've read 0x7b is hex for { so disallowed by auth_username_chars line is because of this problem. Doveconf -n output: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-21-amd64 x86_64 Debian 11.6 # Hostname: mailserver.fqdn auth_debug = yes auth_debug_passwords = yes auth_verbose = yes mail_debug = yes mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/vmail/%d/passwd driver = passwd-file } protocols = " imap" service auth { unix_listener auth-client { group = Debian-exim mode = 0660 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </path/to/cert.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/local/vmail/%d/%u driver = static } Example of line in passwd file: username:{SHA256-CRYPT}generated-sha I followed https://doc.dovecot.org/configuration_manual/howto/simple_virtual_install/ before posting to ensure I hadn't missed something obvious. Any thoughts on this would be appreciated. Thanks Daniel

1 0

Windows 11 Outlook 365 and dovecot
by The Doctor 16 Jul '23

16 Jul '23

Are there any known Idssues? I help set up a client this morning using Win11 and Dovecot and the client cannot delete e-mail like he did previously. -- Member - Liberal International This is doctor(a)nk.ca Ici doctor(a)nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism https://www.empire.kred/ROOTNK?t=94a1f39b We look outside to find assurance, and then we fail. -unknown Beware https://mindspring.com

3 2

Options to track performance?
by Christian 15 Jul '23

15 Jul '23

Hi there, after upgrading my dovecot on a bookworm container, I now have a weird delay when imap clients like Evolution connect the first time. Is there any performance logging configuration I could enable, to see what dovecot is doing in which timing? I suspect some timeout or delay somewhere, but unable to find it so far. Kind regards Chris

1 0

Options to track performance?
by Christian 15 Jul '23

15 Jul '23

Hi there, after upgrading my dovecot on a bookworm container, I now have a weird delay when imap clients like Evolution connect the first time. Is there any performance logging configuration I could enable, to see what dovecot is doing in which timing? I suspect some timeout or delay somewhere, but unable to find it so far. Kind regards Chris

1 0

dovecot and argonid
by Maciej Milaszewski 13 Jul '23

13 Jul '23

Hi For test I try use new auth (argonid) fot dovecot-2.3.20 I change only in sql: password: {ARGON2ID}........ in dovecot.conf i set default_vsz_limit = 2000 M and I can't auth Jul 12 15:07:43 dovecot8 dovecot: auth-worker(44928): conn unix:auth-worker (pid=23437,uid=114): auth-worker<4772376>: sql(user12,xxx.xxx.xxx.12,<VfN04EkA0LUK>): Password mismatch Jul 12 15:07:43 dovecot8 dovecot: imap-login: Disconnected: Connection closed (auth failed, 1 attempts in 105 secs): user=<user12>, method=PLAIN, rip=xxx.xxx.xxx.12, lip=xxx.xxx.xxx.12, secured, session=<VfN04EkA0LUK> I try telnet ip 144 a login username pass Any idea ?

2 3

Proper way to enable statistics on Dovecot 2.3.20?
by rixati6186＠iturchia.com 12 Jul '23

12 Jul '23

Hi. I'm using Dovecot on OpenBSD OS. "dovecot --version" reports: 2.3.20 (80a5ac675d) and this is my configuration file: https://termbin.com/m4to How to properly set the statistics for the version I use? I have both "service stats" and "service old-stats" and it seems I'm not really getting any statistics. Where's my mistake? Thanks in advance. ("doveadm oldstats top" command gives an empty page with columns.) Thanks.

2 6

argon2id best practices, generating and database storage
by David Mehler 12 Jul '23

12 Jul '23

Hello, To users of argon2id as a password hash, what are best practices/what do you use to generate the argon2id password hashes? I want to know if I should do more than: doveadm pw -s ARGON2ID Also, for storing an argon2id password hash in a database (mysql/mariadb in this example) what value(s) do you use for the field? Thanks. Dave.

1 0

Motion for OCSP Support in Dovecot
by novoMedia 12 Jul '23

12 Jul '23

Currently, Dovecot does not offer any support for OCSP, leaving system administrators with a dilemma: choosing between security or compatibility. - What is OCSP? OCSP (Online Certificate Status Protocol) is a network protocol used to check the validity and revocation status of digital certificates in real-time. - What is Must-Staple? "Must-Staple" is a certificate extension that enforces the inclusion of OCSP stapling information, requiring servers to present the certificate's revocation status during the TLS handshake. - What advantages does the use of Must-Staple offer? The inclusion of a 'must-staple' flag in a certificate mandates the presence of an OCSP response during a TLS handshake, ensuring that a revoked certificate remains (at worst) only usable until the expiration of the latest OCSP response, rather than the expiration of the certificate itself (subject to specific client/implementation). https://www.reddit.com/r/selfhosted/comments/aye79v/the_case_for_ocsp_musts… - What is the current issue with Dovecot? Presently, any system administrator who intends to issue must-staple certificates, faces the dilemma to either chose to a) Refrain from issuing must-staple certificates at all, resulting in the loss of a valuable security feature. b) Issue must-staple certificates without an OCSP response in Dovecot, thereby breaking the TLS RFC (and “hope for the best” on the client side…). A "stuck between a rock and a hard place" situation. - Any other reasons to implement OCSP? Regulatory frameworks such as HIPAA, PCI-DSS and more require the implementation of OCSP to enhance privacy and security. Personally, this requirement does not impact me since I am neither located in the United States nor have customers there. Nonetheless, it is worth noting this requirement for individuals or entities who are subject to these regulations. - Is there demand for OCSP in Dovecot? https://github.com/mjhas/dovecot/issues/44 (First GitHub Google hit for “dovecot ocsp”) https://serverfault.com/questions/830434/do-postfix-and-dovecot-support-ocs… https://dovecot.org/pipermail/dovecot/2018-October/113368.html https://www.dovecot.org/list/dovecot/2016-March/103395.html - Summary By implementing a simple OCSP solution, Dovecot could effectively solve this predicament without any drawbacks for its users. The focus here is on simplicity. It is unnecessary to employ a comprehensive OCSP resolver/responder like the one used in Nginx; rather, it would suffice to allow the definition of a simple file path containing the OCSP response alongside the certificate (honoring TLS SNI). Please kindly consider my motion.

4 6

mail-crypt key sharing
by Robert Senger 12 Jul '23

12 Jul '23

Hi all, I am trying to setup mailbox sharing (not public mailboxes) together with mail-crypt plugin and encrypted folder keys. According to the source code of the mail-crypt plugin (there's code trying to retrieve private keys for shared mailboxes), and its documentation, this should be possible: ----- If you are using global keys, mails can be shared within the key scope. The global key can be provided with several different scopes: Global scope: key is configured in dovecot.conf file Per-user(group) scope: key is configured in userdb file With folder keys, key sharing can be done to single user, or multiple users. When key is shared to single user, and the user has public key available, the folder key is encrypted to recipient’s public key. If you have mail_crypt_acl_require_secure_key_sharing enabled, you can’t share the key to groups or someone with no public key. ----- The documentation mentions key sharing, but I have no idea how this could be implemented, and did not find anything else than this mail- crypt documentation in the whole web... I assume that I need to export the user key of the users's folder that should be shared, and import it into the receiving users keys, encrypted with the receiving user's key. Is that right? Any hints how to do that? Regards, Robert -- Robert Senger

1 2

Shared folders?
by joe a 11 Jul '23

11 Jul '23

Is it possible to setup shared folders between virtual users on the same server?

5 9

Public mailboxes and mailcrypt
by Robert Senger 11 Jul '23

11 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

3 3

How to disable BINARY extension
by Ralf Becker 10 Jul '23

10 Jul '23

Reason for disabling are many broken mails containing unescaped equal signs ("=") and our webmailer is using BINARY, when offered, and than does not display the mail and reports Dovecots error "Invalid quoted-printable input trailer: '=' not followed by two hex digits". I'm fully aware that the mails are broken, unfortunately all sorts of programs or senders generate them ... I can use imap_capability = <full-list-of-caps-without-binary> but this is for multiple reasons not ideal: - new caps would never show up - pre-login the are also displayed There seems to be no syntax like: imap_capability = -BINARY Is there any other way to disable just binary? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

1 0

meaning of LIST output
by joe a 10 Jul '23

10 Jul '23

having trouble using offlineimap to copy folders to a local store for spamassasin to use. Says "no folder to sync (folderfilter issue?)" Thinking I simply did not know the proper folder name, did telnet to dovecot server for list of folders, see this,(snippet): . . . * LIST (\HasNoChildren \UnMarked) "." Cabinet.Missed-SPAM * LIST (\HasNoChildren) "." Cabinet.Missed-HAM * LIST (\HasNoChildren \UnMarked) "." Cabinet.Marked-SPAM . . . What is the significance of not one being not "UnMarked"? joe a.

1 0

rename virtual user?
by joe a 09 Jul '23

09 Jul '23

Possible to change a virtual user account, in passwd file, to another name and or domain?

3 3

Public mailboxes and mailcrypt
by Robert Senger 09 Jul '23

09 Jul '23

Hi there, is there a possibility to combine public mailboxes (as described in the first link below) with mailcrypt plugin using per-user keys (as described in the second link below)? I assume, no. But if there's a solution like, for example, storing the decryption key multiple times with different password protection, or by using a global key for the public mailbox only, let me know... I know that I could simply turn off encryption for the public mailbox, and I know how to do that. That's the fllback solution... ;) Regards, Robert (1) https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared… (2) https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ -- Robert Senger

1 0

Fwd: dovecot and postfix, authentication issue
by jeremy ardley 06 Jul '23

06 Jul '23

On 6/7/23 20:49, joe a wrote: > On 7/6/2023 8:12 AM, jeremy ardley via dovecot wrote: >> >> On 6/7/23 19:15, joe a wrote: >>> >>> If your example was meant to show the correct way, I cannot see any >>> difference between that and what my posted config shows other than >>> the sequential (contiguous?) in your example. >> >> Perhaps try the different configuration out? Or even better, stick to >> one auithentication method only. >> >> >> Jeremy >> > > Sorry, not to appear dense or argumentative, but I did not see any > difference in your example, vs what exists, other than that in your > example they are grouped together. > > Is that what you suggest I try, or are my aging eyes and brain missing > something there? > How about just using PAM? In dovecot.conf : auth_mechanisms = plain login passdb { driver = pam } userdb { driver = passwd } This will then call pam whose config is mainly determined by cat /etc/pam.d/dovecot #%PAM-1.0 #auth required pam_faillock.so preauth silent audit #auth [default=die] pam_faillock.so authfail audit @include common-auth @include common-account @include common-session Assuming the pam config is defaults then you will get pam authenticating local users against the local (unix) passwd file. In turn this will authenticate dovecot users and then postfix users This may sound complex but it's pretty standard to have postfix --> dovecot --> pam --> unix_local

2 2

dovecot and postfix, authentication issue
by joe a 06 Jul '23

06 Jul '23

Greetings from a new dovecot user. Have setup dovecot on openSuse 15.4 with postfix as the MTA. Both are the latest version in that distribution. Simple virtual user setup using /etc/dovecot/passwd Dovecot seems to be working and all the defined users are authenticating well enough for imapsync to migrate files to the mailboxes. However, when attempting to send test mail via postfix, only some users are authenticated and have mail delivered. Using swaks (smtp toolkit) the failures are: 550 5.1.1 <some.user(a)mydomain.com>: Recipient address rejected: User unknown in local recipient table I'm puzzled, probably some simple thing overlooked. To avoid clutter, I won't include postfix items unless asked. dovecot --version 2.3.20 (80a5ac675d) dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.14.21-150400.24.66-default x86_64 # Hostname: flitch auth_verbose = ob-fuskate disable_plaintext_auth = no first_valid_uid = 100 info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/passwd driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = no ssl_cipher_list = ALL:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } userdb { args = uid=vmail gid=vmail home=/home/vmail/%u driver = static }

3 6

director_username_hash usable variables
by Stefano Cecconello 06 Jul '23

06 Jul '23

Hi, From the documentation of the director_username_hash core setting ( https://doc.dovecot.org/settings/core/#core_setting-director_username_hash ), it seems that it is possible to use some variables for the hashing of the username from a proxy\director : . Variables that can be used for this setting: * Global variables * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain . If i need to use in the hash calculation some variables that are not global, like domain_first \ orig_username authentication_variables ( https://doc.dovecot.org/configuration_manual/config_file/config_variables/#a uthentication-variables ), are those be parsed\read from the director_hash_username settings ? Or the only variables allowed to be used are : * %{user}, %u \ Username (username@domain) * %{username}, %n \ Username * %{domain}, %d \ Domain * Global: %% * Global: env:<name> * Global: uid * Global: gid * Global: pid * Global: hostname In order to see if these variables are read\parsed during the hashing, somebody know if there is a way to log their value in the dovecot log ? Thanks Stefano

1 0

Chrooting
by Alexey Vlasov 30 Jun '23

30 Jun '23

Hi, I have the following hier for chrooting local users: /var/mail/.u336084 /var/mail/.u336084/bin /var/mail/.u336084/dev [cut here] /var/mail/.u336084/proc /var/mail/.u336084/var/ [cut here] /var/mail/.u336084/var/mail/ /var/mail/.u336084/var/mail/u336084 /var/mail/.u336084/var/mail/u336084/Mail /var/mail/.u336084/Mail -> var/mail/u336084/Mail (symlink) passwd file: u336084:x:1340334:255::/var/mail/.u336084:/bin/bash Chroot works fine, for SSH, FTP and etc, for example: # chroot /var/mail/.u336084 /bin/bash Given the current hierarchy, is it possible to tell the dovecot to do the same chroot? I found strange behavior that users cannot delete IMAP-folders: [pid 25055] stat("/var/mail/.u336084/Mail/.www1", {st_mode=S_IFDIR|0700, st_size=167, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/.Trash.www1", 0x7ffeddc3d5c0) = -1 ENOENT (No such file or directory) [pid 25055] stat("/var/mail/.u336084/Mail/.Trash", {st_mode=S_IFDIR|0777, st_size=198, ...}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_UNLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fcntl(16, F_SETLK, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, l_len=0}) = 0 [pid 25055] fstat(16, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] stat("/var/mail/.u336084/Mail/mailboxes.lock", {st_mode=S_IFREG|0600, st_size=0, ...}) = 0 [pid 25055] unlink("/var/mail/.u336084/Mail/mailboxes.lock") = 0 [pid 25055] close(16) = 0 [pid 25055] write(7, "96 NO [CANNOT] Renaming not supported across conflicting directory permissions (0.002 + 0.000 + 0.001 secs).\r\n", 110) = 110 [pid 25055] epoll_wait(11, [{EPOLLIN, {u32=1794732256, u64=94916277006560}}], 7, 1800000) = 1 Btw I don't see any conflicting dirs: root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail/.www1 drwx------ 5 u336084 virtmail 167 Jun 27 13:26 /var/mail/.u336084/Mail/.www1 root@:/var/mail/u336084# ls -ld /var/mail/.u336084/Mail lrwxrwxrwx 1 u336084 virtmail 26 Apr 28 21:43 /var/mail/.u336084/Mail -> var/mail/u336084/Mail root@:/var/mail/u336084# ls -ld Mail drwx------ 16 u336084 virtmail 4096 Jun 30 01:25 Mail All folders have right owner u336084. With this configuration Courier worked properly, I noteced the problem after migration to Dovecot. Thanks in advance.

1 0

Warning sqlpool(mysql): Query failed
by Alessio Cecchi 27 Jun '23

27 Jun '23

Hi, with the last dovecot version (2.3.13) I see many of this warnings via "doveadm log errors": Feb 17 03:26:28 Warning: dict(31513): conn unix:dict (pid=31330,uid=95): dict(mysql)<email1(a)company1.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 679 secs) Feb 17 03:48:53 Warning: dict(31013): conn unix:dict (pid=31805,uid=95): dict(mysql)<email2(a)company2.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 685 secs) Feb 17 03:54:12 Warning: dict(32529): conn unix:dict (pid=3147,uid=95): dict(mysql)<email3(a)company3.com>: sqlpool(mysql): Query failed, retrying: MySQL server has gone away (idled for 670 secs) What do they mean? I thinks are related to inactivity timeout on mysql server (where I have a wait_timeout=600), but these warnings could be problems or can be fixed with some setting in dovecot? My dovecot configuration about dict: dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dovecot-dict-sieve-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } plugin { [...] acl_shared_dict = proxy::acl expire_dict = proxy::expire quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = dict:proxy::sieve;name=activesql [...] } service dict { process_limit = 500 unix_listener dict { group = vmail mode = 0660 user = vmail } } Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Re: Postfix: running a script on authentication failure
by Joseph Tam 27 Jun '23

27 Jun '23

On Thu, 22 Jun 2023, Michael Peddemors wrote: > * Use services like RATS-AUTH to block IPs that can safely be blocked as known hackers.. Cool. Are there other DNSRBLs (apart from bl.blocklist.de) that list BFD attack IPs? > * Use services like RATS-NULL (or SpamHaus DROP lists) right in the firewall level. There are SOME networks > that should simply be 'unplugged' Can't find it in https://spamrats.com/. Is it an DNSRBL or downloadable file? > * Turn off port 110 (well, all plain text authentication) 90% less email compromise reports when you do.. That will disable STARTTLS though. Even though it's not plaintext, maybe that is a good thing as it avoids MITM banner stripping attacks. Joseph Tam <jtam.home(a)gmail.com>

2 1

Server migration, password scheme/hashing, argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, salt?
by David Mehler 24 Jun '23

24 Jun '23

Hello, I'm migrating to a new server. It's running Debian 11 currently though that's going 12 this weekend. Currently it uses Openssl v3.0.9, and dovecot 2.3.13 and MySQL (in this case Mariadb) for storing user account information v10.6.14. My question is in regards password storage and scheme/encryption/salts. Currently they are stored in Mariadb password field with a type of varchar and a 255 character length, and are stored as SHA512-CRYPT. I'm wondering if I should keep this as is or when I migrate go to another scheme? I'm thinking argon2i, argon2d, argon2id, sha512, sha512-crypt, tiger2, saltt? Discussion/opinions welcome. Thanks. Dave.

2 3

configuring Dovecot submission service
by Computerisms Corporation 23 Jun '23

23 Jun '23

Hi Dovecot Gurus, I have been playing around with the submission service. I have managed to get all the things working that I want working with two exceptions. I have not found (or possibly I have overlooked) solutions in the documentation or discussions on the 'net. First; I would like to be able to authenticate against my backend MTA using the user-supplied credentials. I have tried setting submission_relay_user as %u and submission_relay_password as %w, but these seem to be passed through as literal strings, and of course my backend MTA has no idea who %u is. I found a post from 2019 that indicates passing the submission_relay_user/password to the backend is not a supported function, but hoping that maybe that is outdated info. I also found: https://doc.dovecot.org/3.0/configuration_manual/authentication/proxies/ Which seems to indicate it could pass credentials to a non-Dovecot MTA backend, but I am not really clear from the docs on how to set that up, and I did not find any relevant examples to work from. Seems like it would be setting up a Director service, maybe? I have done that before and I do manage multiple email servers, but none of them is clustered or configured to be interoperable, so not sure if this is a viable approach. Second; I am wondering about the possibility of having multiple submission_relay_host entries. For example if I have dovecot submission services running on my standard port 587 and 465 connect to a relay on the same box through localhost, but could I have another submission service running on another port, say 5587, and relay all traffic received on that port through a completely different host? I am thinking I could set that up by running a separate instance of dovecot for just that service, but maybe there is a more suitable way? I don't have a solid use-case for this in mind at the moment, but given that I do manage multiple email servers, I am thinking that if this is possible it might provide some useful corner-case configurations down the road. Thank you for reading my post, any thoughts, information, or pointers to relevant documentation would be most appreciated. -- Bob Miller 867-334-7117 www.computerisms.ca

2 3

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

4 4

Postfix: running a script on authentication failure
by André Rodier 22 Jun '23

22 Jun '23

Hello, all. I just set-up a new server, running postfix, with submission(s) activated on standard ports (587, 465) Shortly after it has been setup, I see brute force attacks (not surprising) from a whole /24 network (more surprising). I carefully checked the logs, and see the modus operandi, which basically loop across the IP addresses in the network, to avoid being blacklisted by tools like fail2ban. And it is true, even with fail2ban activated, no IP is blacklisted. By activating verbose logging, I see multiple user names are tried, not only passwords. Is there any way, with postfix, to run a script on authentication failure, with information like the IP address and the username passed, for instance. I basically need features that fail2ban doesn't offer - I would like to not rely on reading logs, removing one step and acting more pro-actively. - If a script is called on authentication failure, it is fairly easy to use a Levenshtein distance to differentiate between a user having lost his password and a brute force attack. - If I log all the failure in a database, with the IP address, and the whois information, the script would take decision according to the whois information. What are you using on your side ? - Do you know any service, that I could use, to get the network to ban from an IP address reputation, something like crowdsec, for instance ? - Anyone has success with Suricata, Snort, or a tool like this ? Please, do not suggest third party hosted services, I want to be part of my self-hosting solution. Kind regards, André

1 0

el9 rpms
by Marc 21 Jun '23

21 Jun '23

Is there a specific reason why there are (still) no el9 packages? https://repo.dovecot.org/ce-2.3.17/centos/ https://repo.dovecot.org/ce-2.3-latest/rhel/

4 7

Re: Submission behaviour
by Joseph Tam 21 Jun '23

21 Jun '23

From: "André Rodier" > chain input { > > # Limit new imap connections ala fail2ban > meta nfproto ipv4 tcp dport imaps ct state new,untracked \ > limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } I'm don't know all the subttlties of this rule, but there are some mail clients (MacOSX Mail comes to mind) that will bombard your IMAP server with new connections when it does a global search. It will open a new connection for each mailbox, then do a search. When your connection limit is reached, it will then close all the open connections and do another round. This may be interpreted as a BFD attack, and you'll lock out a legitimate user. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot reposting inactivity as auth failed
by pedro＠netsecpt.pt 20 Jun '23

20 Jun '23

Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Dovecot Version : 2.3.19.1 (9b53102964) Log imap line with issues : dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user=<myemail@mydomain>, method=PLAIN, rip=xxx.xxx.xx.xx, lip=xxx.xxx.xxx.xxx, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits), session=<some_hash> Thank you

3 6

Submission behaviour
by André Rodier 20 Jun '23

20 Jun '23

Hi, I have used fail2ban for a while, to block brute force attacks on ssh, imap(s) or submission(s) ports. More because I wanted to reduce the noise in the logs rather than a fear of a broken password. Then, with nftables, I realised you can achieve the same thing, as long as a TCP connection isn't close. This works very well for SSH, but I then realised it works for a modern IMAP server that supports IDLE, since the connection is kept open, for instance the excellent Dovecot mail server. Here an example, of nftable ruleset, for dovecot imap(s): ------------------------------------------------------------------- table inet filter { set banned_imap_ipv4 { type ipv4_addr flags dynamic,timeout timeout 1d } set banned_imap_ipv6 { type ipv6_addr size 65535 flags dynamic,timeout timeout 1d } chain input { # Limit new imap connections ala fail2ban meta nfproto ipv4 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv4 { ip saddr } meta nfproto ipv6 tcp dport imaps ct state new,untracked \ limit rate over 10/minute add @banned_imap_ipv6 { ip6 saddr } # Reject the traffic explicitly ip saddr @banned_imap_ipv4 tcp dport imaps reject with icmp type admin-prohibited ip6 saddr @banned_imap_ipv6 tcp dport imaps reject with icmpv6 type admin-prohibited tcp dport { imap, imaps } ct state new counter accept \ comment "Accept imap/imaps connections" } } ------------------------------------------------------------------- Surprisingly, this is working very well with Dovecot, and various modern clients like Evolution or Thunderbird, as well as K9 on Android. There is also a way to save the rules before restarting the firewall, which works very well as well: ------------------------------------------------------------------- # nft list set inet filter banned_imap_ipv4 table inet filter { set banned_imap_ipv4 { type ipv4_addr size 65535 flags dynamic,timeout timeout 1d elements = { 162.142.125.214 timeout 1d expires 23h44m16s600ms } } } ------------------------------------------------------------------- Now, the question I have is this. I can limit new TCP connections to a reasonable amount, like 10 per minute, because I know I will not try to send that amount of emails from a single IP. However, is there an option, in Postfix, to keep the TCP connection opened for submission(s) protocols (ports 465 or 587) Thanks for your insights.

1 0

Re: Dovecot reposting inactivity as auth failed
by Joseph Tam 20 Jun '23

20 Jun '23

From: pedro(a)netsecpt.pt > Hi , i am having an issue with dovecot , in log files of imap inactivity lines have the word included "auth failed" , witch is not true , what happens next is that fail2ban is looking for that word too in log file of dovecot ,and when it finds it it bans my public ip address . > Is there any change to change this behavior in dovecot , what i mean is to insert "auth failed" when in fact it is an authentication failed , and not use it as general for every thing in log file . Putting aside the semantics that not supplying credentials before the timeout *is* an auth failure, I would think the best way to handle this is to change the pattern fail2ban triggers to be more specific about what it considers an auth failure. If this is a typical log entry you want to avoid an automatic ban dovecot: imap-login: Disconnected: Inactivity (auth failed, 1 attempts in 180 secs): user= ... I would modify /etc/fail2ban/filter.d/dovecot.conf to limit it to 0-99sec like so failregex = ...( in \d{1,2} secs)... Some BFD attempts will leak through but it avoids triggering on any inactivity >99s. Joseph Tam <jtam.home(a)gmail.com>

1 0

Cannot get mail-crypt plugin to work
by rcooper＠dwford.com 16 Jun '23

16 Jun '23

dovecot 2.2.27 and then 2.2.36 (tried both) Trying to enable mail-crypt in global key mode. Nothing is ever encrypted, even when I move mail from folder to folder. I have tried everything available to find here, google, etc and I assume I am missing something fundamental. Debug log shows the plugin loading Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Loading modules from directory: /usr/lib/dovecot Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: Module loaded: /usr/lib/dovecot/lib10_mail_crypt_plugin.so Jun 15 08:26:00 srv2 dovecot: POP3(rick): Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled (I assume because global not per user) my 10-mailcrypt.conf in .conf.d mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_global_private_key = </certs/ecprivkey.pem mail_crypt_global_public_key = </certs/ecpubkey.pem mail_crypt_save_version = 2 } I have also tried base64 encoded .pem files inline. I have also added the mail_plugins line to my protocol definitions to no avail and when I do that dovecot -n shows the lines as mail_plugins = " mail_crypt mail_crypt" so I assume it's a mistake to add mail_plugins = $mail_plugins mail_crypt to the protocol sections. Some online tutorials say must do this and others do not mention it at all. Just looking for some guidance as to where to go next.

3 4

zlib compressed folders
by Michael Grant 15 Jun '23

15 Jun '23

I’ve been playing with zlib compressed mail archives. I can’t seem to get it to work. I followed the instructions here: https://doc.dovecot.org/configuration_manual/zlib_plugin/ I’m not interested in being able to save, just read-only would be great. I have some compressed mail archives, for example 2020.gz in my ~/mail/ directory. I have some uncompressed ones too like 2021. Both are mbox formatted. In my imap client, I see both 2020.gz and 2021 as imap folders. I can access mail in 2021 but not in 2020.gz. It just says it’s empty. My local.conf has this in it: mail_plugins = $mail_plugins zlib I know for sure this is being read because if I change this to some non-existent plugin, I see an in the log complaining about a non-existent plugin. I’ve tried also adding in the lines for saving but no difference. Would love to know if there’s something more I need to do. Also, should I expect to see a folder named 2020 instead of 2020.gz in my imap clients? My suspicion is that dovecot is treating these as uncompressed imap folders which it can’t read because they look like garbage. Is there some doveadm command to get it to re-scan folders that I need to run and then realize this is a folder using zlib? Michael Grant

3 3

Empty oldstats
by djdejawu＠gmail.com 15 Jun '23

15 Jun '23

I'm facing a problem to get integration dovecot and Netdata agent to monitor current status of dovecot sessions. First of all I've been set up a socket for reading data with Netdata agent: service old-stats { unix_listener old-stats { group = netdata user = vmail mode = 0660 } } Then in netdata agent UI i've found that all stats collected from this source are zeroed. Hm, maybe I did something wrong, and I goes to check classic command, what Netdata agent uses in Dovecot socket: # doveadm oldstats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses 1686759269 0.000000 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 Yep, all stats not counted. How to count stats in my setup? Oldstat plugin is enabled. mail_plugins = quota acl old_stats plugin { old_stats_refresh = 10 secs old_stats_track_cmds = yes } # dovecot --version 2.3.19.1 (9b53102964) BR, DeJa

1 0

Empty oldstats
by DeJa Wu 15 Jun '23

15 Jun '23

I'm facing a problem to get integration dovecot and Netdata agent to monitor current status of dovecot sessions. First of all I've been set up a socket for reading data with Netdata agent: service old-stats { unix_listener old-stats { group = netdata user = vmail mode = 0660 } } Then in netdata agent UI i've found that all stats collected from this source are zeroed. Hm, maybe I did something wrong, and I goes to check classic command, what Netdata agent uses in Dovecot socket: # doveadm oldstats dump global reset_timestamp last_update num_logins num_cmds num_connected_sessions user_cpu sys_cpu clock_time min_faults maj_faults vol_cs invol_cs disk_input disk_output read_count read_bytes write_count write_bytes mail_lookup_path mail_lookup_attr mail_read_count mail_read_bytes mail_cache_hits auth_successes auth_master_successes auth_failures auth_db_tempfails auth_cache_hits auth_cache_misses 1686759269 0.000000 0 0 0 0.0 0.0 0.0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 Yep, all stats not counted. How to count stats in my setup? Oldstat plugin is enabled. mail_plugins = quota acl old_stats plugin { old_stats_refresh = 10 secs old_stats_track_cmds = yes } # dovecot --version 2.3.19.1 (9b53102964)

1 0

Panic: file acl-backend-vfile.c: line 123 on access from Nextcloud Imap-Client
by forum＠xp8.de 15 Jun '23

15 Jun '23

Hello, with activated imap_aci i get the following error: Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Panic: file acl-backend-vfile.c: line 123 (acl_backend_vfile_get_local_dir): assertion failed: (list == ns->list) Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x46) [0x7f4d46caede6] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x22) [0x7f4d46caef02] -> /usr/lib/dovecot/libdovecot.so.0(+0x109cdb) [0x7f4d46cbbcdb] -> /usr/lib/dovecot/libdovecot.so.0(+0x109d77) [0x7f4d46cbbd77] -> /usr/lib/dovecot/libdovecot.so.0(+0x5cf73) [0x7f4d46c0ef73] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x7fbf) [0x7f4d4696dfbf] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0xb795) [0x7f4d46971795] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(acl_backend_get_default_object+0x69) [0x7f4d46971499] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(acl_backend_get_default_rights+0x13) [0x7f4d469714c3] -> /usr/lib/dovecot/modules/lib01_acl_plugin.so(+0x8e53) [0x7f4d4696ee53] -> /usr/lib/dovecot/modules/lib02_imap_acl_plugin.so(+0x3975) [0x7f4d46960975] -> dovecot/imap(command_exec+0xa4) [0x55d9dc7f6364] -> dovecot/imap(+0x22312) [0x55d9dc7f4312] -> dovecot/imap(+0x223c4) [0x55d9dc7f43c4] -> dovecot/imap(client_handle_input+0x1bd) [0x55d9dc7f47cd] -> dovecot/imap(client_input+0x74) [0x55d9dc7f4d94] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x6d) [0x7f4d46cd1f8d] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x13a) [0x7f4d46cd368a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x54) [0x7f4d46cd2034] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f4d46cd21f0] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x17) [0x7f4d46c446c7] -> dovecot/imap(main+0x4ea) [0x55d9dc7e5d0a] -> /lib/x86_64-linux-gnu/libc.so.6(+0x29d90) [0x7f4d469add90] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x80) [0x7f4d469ade40] -> dovecot/imap(_start+0x25) [0x55d9dc7e5da5] Jun 15 08:40:02 konsrvdata2 dovecot: imap(xp8it)<439797><iKSIViX+vKoKXggM>: Fatal: master: service(imap): child 439797 killed with signal 6 (core dumped) Bug? Any Ideas? Greets! root@konsrvdata2:/etc/dovecot/conf.d# dovecot --version 2.3.16 (7e2e900c1a) root@konsrvdata2:/etc/dovecot/conf.d# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-67-generic x86_64 Ubuntu 22.04.2 LTS ext4 # Hostname: konsrvdata2 auth_mechanisms = plain cram-md5 auth_username_format = %Ln disable_plaintext_auth = no mail_home = /srv/dovecot/home/%d/%n/ mail_location = maildir:/srv/dovecot/mail/%d/%n/ mail_plugins = acl mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { list = yes location = maildir:/srv/dovecot/mail/waldkindergarten-ts:INDEXPVT=/srv/dovecot/mail/xp8it/shared/waldkindergarten-ts prefix = shared/%%u/ separator = / type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { acl = vfile acl_defaults_from_inbox = yes acl_shared_dict = file:/srv/dovecot/db/shared-mailboxes.db sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve sieve" service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } ssl_cert = </etc/dovecot/private/imap.konis.info.fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail driver = static } protocol lmtp { mail_plugins = acl sieve } protocol lda { mail_plugins = acl sieve } protocol imap { mail_plugins = acl imap_acl }

1 0

Re: imap syncing issues
by dovecot＠x9p.org 14 Jun '23

14 Jun '23

Paul Kudla already suggested setting fetch intervals and to avoid microsoft clients. You can debug the issue with tcpdump like this: # tcpdump -X -s100 -nni lo0 port 143 (replace lo0 for lo, eth0 or the name of your interface) disable all clients, enable the one you want to debug/see the commands. me deleting a message and client issuing the command: 14:40:17.386079 127.0.0.1.48376 > 127.0.0.1.143: P 1410:1437(27) ack 177507 win 256 <nop,nop,timestamp 1610013520 2861364932> (DF) ......(REDACTED) 0030: aa8c f6c4 3131 3120 7569 6420 6d6f 7665 ....111 uid move 0040: 2034 3732 3920 2254 7261 7368 220d 0a 4729 "Trash".. 14:40:17.486259 127.0.0.1.143 > 127.0.0.1.48376: P 177507:177624(117) ack 1437 win 256 <nop,nop,timestamp 2861364932 1610013520> (DF) ......(REDACTED) 0030: 5ff6 db50 2a20 4f4b 205b 434f 5059 5549 _..P* OK [COPYUI 0040: 4420 3136 3830 3237 3234 3630 2034 3732 D 1680272460 472 0050: 3920 3132 365d 204d 6f76 6564 2055 4944 9 126] Moved UID Cheers, x9p On 6/14/23 17:19, Michael Grant wrote: > > Yes, I’m the sole person responsible for messing this up. My Linux > machine, my server, I installed it, I configured it, perhaps I caused > this.... > > It could be some misbehaving imap client that is causing this, that’s > one of the things I’m trying to understand. I don’t see any errors in > the mail log which is where dovecot logs to. All the clients are as > up to date as possible. > > One way forward that I know of is to remove all the imap clients and > start over, adding one by one seeing if it starts breaking again. I > was hoping first to see if I could figure out what’s gone wrong before > doing this. > > *From: *dovecot(a)x9p.org > *Sent: *14 June 2023 18:05 > *To: *Michael Grant <mailto:mgrant@grant.org>; dovecot(a)dovecot.org > *Subject: *Re: imap syncing issues > > The issue seems to be with the clients (an update maybe?), not the server. > > do you have console/root access to dovecot and files? > > On 6/14/23 11:17, Michael Grant via dovecot wrote: > > I’m having synchronization issues in imap. I am accessing my mail > from several different imap clients: K9 on Android, Windows 11 and > 10 mail client, and Android Gmail app. Both desktop and laptop, > tablet, phone. I know I have more than the usual number of imap > connections... > > Often when I delete a message in one place, it doesn’t get deleted > in another. For example, if I delete a message on K9 then open my > laptop, it’s still there in W11 Mail. But just now, I deleted > some messages on my laptop and swiped down on K9 and the message > disappeared on K9. But K9 shows other messages which have been > deleted in Windows 11 Mail. I’ve not yet been able to figure out > a pattern. It’s annoying me. I have to delete messages in > several different places. Messages not coming back, they’re just > not being deleted in one place and that delete operation is not > syncing to the others. > > Messages seem to be being marked as read properly across devices. > This seems to be an issue with delete only, so far as I’ve noticed. > > I’ve long been using multiple imap clients, this syncing issue > started maybe 6 to 8 months ago. > > Is there a good way to get debugging info out of dovecot as to > what the clients are doing? > > Or does anyone have any advise which might help resolve this > without resorting to me digging into the imap protocol? > > Michael Grant > > > > _______________________________________________ > > dovecot mailing list --dovecot(a)dovecot.org > > To unsubscribe send an email todovecot-leave(a)dovecot.org >

1 0

imap syncing issues
by Michael Grant 14 Jun '23

14 Jun '23

I’m having synchronization issues in imap. I am accessing my mail from several different imap clients: K9 on Android, Windows 11 and 10 mail client, and Android Gmail app. Both desktop and laptop, tablet, phone. I know I have more than the usual number of imap connections... Often when I delete a message in one place, it doesn’t get deleted in another. For example, if I delete a message on K9 then open my laptop, it’s still there in W11 Mail. But just now, I deleted some messages on my laptop and swiped down on K9 and the message disappeared on K9. But K9 shows other messages which have been deleted in Windows 11 Mail. I’ve not yet been able to figure out a pattern. It’s annoying me. I have to delete messages in several different places. Messages not coming back, they’re just not being deleted in one place and that delete operation is not syncing to the others. Messages seem to be being marked as read properly across devices. This seems to be an issue with delete only, so far as I’ve noticed. I’ve long been using multiple imap clients, this syncing issue started maybe 6 to 8 months ago. Is there a good way to get debugging info out of dovecot as to what the clients are doing? Or does anyone have any advise which might help resolve this without resorting to me digging into the imap protocol? Michael Grant

3 2

Migration dovecot server with local users to dovecot with virtual mailboxes
by tseegerkrb＠gmail.com 12 Jun '23

12 Jun '23

Hello, we are using a dovecot server with NIS, we want to transfer it to a new setup. As backend a mysql server will be used in the future. My problem is, if I just copy the maildir or use "doveadm import" all mails are flagged as "unseen". How can i preserve the flags? This is how I have tried it so far. root@mail / $ doveadm import -s -u testuser(a)testdomain.local maildir:/tmp/testuser-maildir-230608/Maildir/:INDEX=MEMORY "" "All" As a "workaround" I tried to change the flags. root@mail / $ doveadm -v flags add -u testuser(a)testdomain.local "Seen" "ALL" This led partially to the desired success, the mails are shown as "seen", but the folders (e.g. Roundcube) still show unread mails. dovecot -n ############################################ # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-23-cloud-amd64 x86_64 Debian 11.7 # Hostname: mail.testdomain.local auth_mechanisms = plain login mail_fsync = always mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs:INDEX=MEMORY mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-script.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /usr/bin sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } process_min_avail = 1 service_count = 1 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_ca = </etc/dovecot/private/ca-testdomain.local_tls_srv_crt.crt ssl_cert = </etc/dovecot/private/mail.testdomain.local_tls_srv_crt.crt ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = " quota imap_quota imap_sieve" } protocol lmtp { mail_plugins = " sieve notify push_notification quota" postmaster_address = postmaster(a)testdomain.local } ############################################ Thanks for your help

5 6

dovecot with sieve vacation plugin
by spi 12 Jun '23

12 Jun '23

Hi all I have an issue understanding the sieve vacation plugin. I can get it trigger for particular emails or something, but I don't get the sender setting right. My setup: I've got an external email address a(a)aaa.com and a local b(a)bbb.local (which is used in virtual_mailbox_maps in postfix or for user authentication in dovecot). Emails for a(a)aaa.com get stored in the b(a)bbb.local mailbox. Postfix uses an external relay to transfer emails from a(a)aaa.com. Sending and receiving emails works as a charm. In received emails I see headers for Return-Path: <the original sender> Delivered-To: b(a)bbb.local Envelope-To: a(a)aaa.com X-Original-to: a(a)aaa.com In sieve I've got configured for the user b(a)bbb.local require "vacation"; if allof ( address :domain "From" "other-sender.com", currentdate :value "ge" "date" "2023-05-24" ) { vacation :from "a <a(a)aaa.com>" #:addresses ["a(a)aaa.com", "b(a)bbb.local"] :addresses ["a(a)aaa.com"] :subject "Out of office by EoL" "bla bla bla"; } The issue: When I receive an email from e. g. john(a)other-sender.com a vacation response gets created and sent. The From header ist set to the value configured by ":addresses ["a(a)aaa.com"]". But: a) If I set "sieve_vacation_send_from_recipient = yes" in dovecot.conf the sender header in the vaction response is filled in with b(a)bbb.local. b) If I set "sieve_vacation_send_from_recipient = no" in dovecot.conf the sender header in the vaction response stays blank (which I understand is the preferred way). Different settings for sieve_vacation_use_original_recipient don't seem to make any difference. In both cases a) and b) postfix tries todeliver the email directly to the receiving mail server and does not care for my sender relay host map (sender_dependent_relayhost_maps in postfix main.cf), well of course as there is no relay host for @bbb.local (case a)) and in case b) the sender is blank. In my understanding the vacation plugin uses the original recipient as sender for the out of office reply which in my case is in the X-Original-to header (I use lmtp and have also set "lda_original_recipient_header = X-Original-To"). But it does not - it sticks with the b(a)bbb.local mail address as sender. If I omitted the sender setting - how could I tell postfix to relay these ooo mails through the correct relay (like based on the From header domain in the vacation response)? What would the right approach be to set the sender right or get postfix to relay the vacation responses correctly? Any help would be appreciated! -- Cheers spi

2 8

Re: No-novice with Dovecot, but need novice-like advice (was Dovecot cracked?!)
by Jochen Bern 10 Jun '23

10 Jun '23

On 09.06.23 00:36, Richard Troy wrote: > OH, sure, I got it down to a trickle, but these few Russian sites > always managed to get their spam through and (FWIW, if you can characterize the offenders by country, trying a GeoIP filter as a stop-gap measure sounds rather promising.) > Give me a white-list of the > ONLY accounts that can relay; NOTHING ELSE can relay. ... THAT would do > it! But no! Neither in Postfix nor dovecot is there such a thing! I'm afraid that that's not *entirely* true ... : > /etc/postfix# grep senderauth main.cf > smtpd_sender_login_maps = hash:/etc/postfix/senderauth > /etc/postfix# head -2 senderauth ; grep bern senderauth | sed -e 's/[-a-z\.]*'"$DOMAIN/DOMAIN/g" > # Envelope Sender: Requires SMTP AUTH as one of: > # actual.address(a)dom.ain user.1(a)dom.ain, another(a)else.where > jochen.bern(a)DOMAIN.pawisda.de jochen.bern(a)DOMAIN.de (Also works with unspecified local part, i.e., "@some.dom.ain" for the left-hand side.) > Combine that with a greylist type function where the usual IP addresses > for particular users were let through, and new ones delayed, THAT would > be awesome, too! Please define "delayed". The kind where you tell the client to retry later and then close the connection is available for postfix under the name of postgrey, but is probably quite disruptive when used with an M*S*A port; same caveat for mechanisms that prevent the connection altogether, like one could build with iptables. The search keyword for the kind where "the server is just deeaaaaaaadddd slllooooowwwww" would be "Teergrube". [Yes, I'm German, so I capitalize German nouns like German does. :-> ] None of those are *built right into* postfix or dovecot, likely because it's too much complexity to maintain for a huge user base that doesn't use the functionality all too often. > And if someone tells me I'm wrong and points me at how to do these > things, I'll fall out of my damned chair! [promptly invents the sport of Comfy Cushion Curling] > IF we had an IMAP supported password CHANGING scheme, we'd gladly run > encrypted passwords, but there isn't, and we haven't invented (finished > inventing!) our own web-way to change 'em and so we're stuck with plain > text until one of these things changes. Your server is Linux and SSH client software has become quite available (PuTTY on Windows). For OS-based users who don't need *shell* access to the server, I've had some success just setting the "passwd" command as their login "shell" (in /etc/passwd . Plus adding it to /etc/shells if necessary.) Dunno how readily you could find an equivalent for the *virtual* accounts' password backend ... (Yes, it'd be better to have it seamlessly integrated into the IMAP protocol, but don't forget that you'd need the *MUAs* to start supporting it as well before the general public will ever even learn about the new feature ...) Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

2 1

No-novice with Dovecot, but need novice-like advice (was Dovecot cracked?!)
by Richard Troy 09 Jun '23

09 Jun '23

Hi All, This is my first posting here, and maybe I should have found this WAY back in January, '23, if not LONG before. I want to be but I find it difficult here to be brief. ... Surely background will surely help: A 27 or so year old Fedora / Postfix / Dovecot site I built had a major disaster in January and I've not yet been able to fully recover because Dovecot has let the damned spammers in again and again and again and again! OH, sure, I got it down to a trickle, but these few Russian sites always managed to get their spam through and I just had to shut Dovecot down entirely. I never found out how they got in, etc. And I've STRONGLY suspected Dovecot got cracked - at least the modern version in the youngest version for the youngest Fedora we had back in January - uh, Fedora Server 37 - I've forgotten the matching Dovecot version. In the disaster, we lost /var but not /etc, so I figured recovery would be easy and for nearly everything, it was. But NOT Dovecot (and insofar as it matters, Postfix), and in these 5+ months I've tried so many things, I'm sure I've forgotten most of them and I don't know that a retroactive look is worth doing. ...I kept some notes that might be useful if anyone wants to see the evidence of the cracking, but in short, I kept a constant watch on the logs and when ANY relay happened that shouldn't, I'd instantly know it and shut things off entirely. However, that became untenable as I couldn't find the problem and had to just shut it off, pissing off users, etc, but I've had to do things like spend a month and a half traveling, and so forth and, well... Life goes on, as the saying goes. --- NOW I want to try again. It's my perception that it's a waste of time to even LOOK at the old Dovecot configuration stuff. I feel I need to REMOVE it ALL, and I could use some help being SURE to get it all gone. And then I think I need to do a FULL new installation. Overkill? IDK. I could use some advice about SAFE ways to make changes and test to ensure we do NOT become an open mail relay EVER AGAIN. ALSO WORTH SAYING is that if Dovecot were all that damned safe and secure I wouldn't so easily be able to propose a new feature that would make a HUGE difference to sites like mine: Give me a white-list of the ONLY accounts that can relay; NOTHING ELSE can relay. ... THAT would do it! But no! Neither in Postfix nor dovecot is there such a thing! Combine that with a greylist type function where the usual IP addresses for particular users were let through, and new ones delayed, THAT would be awesome, too! And this isn't even all that hard to do - I could do it if I didn't already have a thousand obligations in life! And if someone tells me I'm wrong and points me at how to do these things, I'll fall out of my damned chair! And after picking myself up, I'll find a way to send that person some sort of gift. THIS WOULD HAVE SOLVED ALL MY PROBLEMS. And I'm sure MANY others could use this, too! --- THIS configuration: I'd like to find a way to have both virtual and our existing "unix accounts" users. IF we had an IMAP supported password CHANGING scheme, we'd gladly run encrypted passwords, but there isn't, and we haven't invented (finished inventing!) our own web-way to change 'em and so we're stuck with plain text until one of these things changes. BTW, isn't this a HUGE and OBVIOUS hole that should have been fixed decades ago?! If a major provider like the Dovecot.org team added a way to update passwords to the IMAP protocol, all the rest of the folks would follow along for sure! OR, "is that a thing" and I'm just ignorant of it? So, again, plain-text, in cram, of course. What else? Coach me on "the right way" if you want, but if users can't change it themselves, they'd rather I can retrieve it for them if needed... I'm sure the corporate world doesn't do it this way, but their code isn't open source, or am I wrong?... --- In closing I don't actually anticipate ANY help. My father, an even earlier computer user than me, once observed, "you can ask for information until you're blue in the face, and nobody will say a thing, but post the WRONG thing and a hundred people will post to point out you're wrong!" GIVEN how EASY it is to have your email system become an instant open relay at the hands of the spammers out there, how the hell Dovecot can advertise the way it is WITHOUT a serious guide about this is just frustrating and laughable. But I'd love to be shown where they DO help with this! Thanks for any and all help, Richard

5 13

Remove attachments
by Oliver Glas 08 Jun '23

08 Jun '23

5 6

Help needed with imap_sieve and mail_crypt plugin
by Robert Senger 08 Jun '23

08 Jun '23

Hi there, I was using imap_sieve for many years now to pipe mails upon user action (moving mails to the SPAM folder) into spamassassin to train spam detection. This worked fine all the time. Now we're moving to encrypted mail storage on per user basis, with encrypted private keys. This works well, but it breaks the spamassassin training upon user action since it would feed encrypted mail into spamassassin, which makes no sense. So, my question is, is there a possibility to call the mail_crypt plugin from imap_sieve to decrypt the email (that means, decrypt the private key with the user password, decrypt the email that's moved to the SPAM folder) before it's piped into spamassassin? Thanks for help! Robert -- Robert Senger

2 2

Repeating imap processes crashes with signal 11 after imapc-client timeout leak
by Nikolaos Pyrgiotis 07 Jun '23

07 Jun '23

Hello, We run a 5 instances dovecot cluster ondebian 11 virtual machines, a dovecot proxy, 2directors and 2dovecot backends. All dovecot instances run version 2.3.20. We use a glusterfs mounted volume on the backends forthe mail storage. Our users all use thunderbird mail client and they do not report any issue with the imap service. Since we have configured the dovecot cluster we see multiple random imap crashes with signal 11 and timeout leaks in the logs on both the backends for multiple users. Is this is a configuration problem or a bug with imapc or imap; I would appreciate if you could assist us to debug this further. A coredump is attached if it helps. The logs look similar to this: Jun 01 16:21:13 doveb0-rmt0-cn1 dovecot[75106]: imap(user(a)domie02.com)<105800><BxSqJw39DLgKZQD+>: Warning: Timeout leak: 0x7f9a92c0c1c0 (imapc-client.c:475) Jun 01 16:21:13 doveb0-rmt0-cn1 dovecot[75106]: imap(user(a)domie02.com)<105800><BxSqJw39DLgKZQD+>: Warning: Raw backtrace for leaks: /usr/lib/dovecot/libdovecot.so.0(backtrace_append+0x42) [0x7f9a92a7e872] -> /usr/lib/dovecot/libdovecot.so.0(backtrace_get+0x1e) [0x7f9a92a7e98e] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_destroy+0x2b5) [0x7f9a92aa21e5] -> /usr/lib/dovecot/libdovecot-storage.so.0(imapc_client_run+0x115) [0x7f9a92c0bcb5] -> /usr/lib/dovecot/libdovecot-storage.so.0(imapc_mailbox_run_nofetch+0x20) [0x7f9a92c089f0] -> /usr/lib/dovecot/libdovecot-storage.so.0(imapc_mailbox_sync_init+0x868) [0x7f9a92c0b198] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_init+0x58) [0x7f9a92bbfa68] -> dovecot/imap(imap_sync_init+0x95) [0x5605e4ebbe55] -> dovecot/imap(+0x17343) [0x5605e4ea5343] -> dovecot/imap(cmd_idle+0xb4) [0x5605e4ea5674] -> dovecot/imap(command_exec+0xa4) [0x5605e4eb04d4] -> dovecot/imap(+0x2044f) [0x5605e4eae44f] -> dovecot/imap(+0x204fa) [0x5605e4eae4fa] -> dovecot/imap(client_handle_input+0x1b5) [0x5605e4eae9d5] -> dovecot/imap(client_input+0x70) [0x5605e4eaef40] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f9a92aa1819] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x132) [0x7f9a92aa2f02] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x50) [0x7f9a92aa18c0] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x40) [0x7f9a92aa1a80] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f9a92a143c3] -> dovecot/imap(main+0x4fa) [0x5605e4e9ff0a] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xea) [0x7f9a927d2d0a] -> dovecot/imap(_start+0x2a) [0x5605e4e9ffca] Jun 01 16:23:49 doveb0-rmt0-cn1 dovecot[75106]: imap(user(a)domie02.com)<105800><BxSqJw39DLgKZQD+>: Fatal: master: service(imap): child 105800 killed with signal 11 (core dumped) Below i post the dovecot configuration of one of the two dovecot backends: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 5.10.0-23-amd64 x86_64 Debian 11.7 fuse.glusterfs # Hostname: doveb0-rmt0-cn1 auth_cache_negative_ttl = 5 mins auth_cache_size = 50 M auth_default_realm = domie02.com auth_master_user_separator = * auth_mechanisms = plain login auth_verbose = yes auth_worker_max_count = 16 disable_plaintext_auth = no first_valid_uid = 499 hostname = smtp.domie02.com imapc_features = fetch-bodystructure fetch-headers rfc822.size search modseq acl delay-login imapc_host = 10.101.0.250 imapc_max_idle_time = 5 mins imapc_password = # hidden, use -P to show it imapc_sasl_mechanisms = plain login imapc_ssl = starttls imapc_ssl_verify = no last_valid_uid = 499 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes login_greeting = You have successfully logged in to domie02.com IMAP server login_trusted_networks = 10.101.0.74 10.101.0.73 mail_always_cache_fields = flags hdr.* date.received date.sent mail_cache_fields = flags date.received guid size.physical size.virtual imap.bodystructure body.snippet mail_debug = yes mail_fsync = always mail_location = mdbox:/var/vmail/%d/%n/mdbox:VOLATILEDIR=/dev/shm/dovecot/%2.256Nu/%d/%n mail_plugins = " notify mail_log zlib acl" mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mdbox_rotate_size = 200 M mmap_disable = yes namespace Domie02 { list = children location = imapc:/var/vmail/%d/%n/shared/indexes/%%n:INDEXPVT=/var/vmail/%d/%n/shared-pvt/%%n:VOLATILEDIR=/dev/shm/dovecot/%2.256Nu/%d/%n/%%n prefix = shared.%%n. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam.Virus { auto = subscribe } mailbox Spam { auto = subscribe } mailbox Trash { special_use = \Trash } prefix = separator = . subscriptions = yes type = private } passdb { args = password=#hidden_use-P_to_show# driver = static master = yes override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.74,10.101.0.73 userdb_acl_user=%{auth_user} userdb_namespace/Domie02/disabled=yes result_success = continue } passdb { args = password=#hidden_use-P_to_show# driver = static override_fields = allow_real_nets=127.0.0.0/8,local,10.101.0.74,10.101.0.73 result_success = continue } passdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/global-acls/%d/master-dovecot-acl:cache_secs=300 acl_defaults_from_inbox = yes acl_globals_only = no acl_shared_dict =file:/var/dovecot-acl/%d/shared-mailboxes.db imap_compress_deflate_level = 6 mail_log_events = flag_change mail_log_fields = uid box flags sieve =file:~/sieve;active=~/sieve/%n.sieve sieve_before = /var/vmail/global-sieve/global.sieve sieve_env_email_address = %u sieve_env_mailbox_prefix = %{userdb:mailbox_prefix} sieve_global = /var/vmail/sieve sieve_global_extensions = +editheader +vnd.dovecot.environment zlib_save = zstd zlib_save_level = 5 } protocols = " imap lmtp sieve submission" service auth-worker { user = dovecot } service auth { unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service doveadm { inet_listener dovadm-dom-mgmt { address = 10.100.1.71 port = 8080 ssl = no } inet_listener dovadm-dom { address = 10.101.0.71 port = 8080 ssl = no } vsz_limit = 256 M } service imap-login { inet_listener imap-dom { address = 10.101.0.71 port = 143 ssl = no } inet_listener imap { port = 0 } inet_listener imaps-dom { address = 10.101.0.71 port = 993 ssl = yes } inet_listener imaps { port = 0 } process_limit = 400 process_min_avail = 2 service_count = 20 vsz_limit = 512 M } service imap { process_limit = 2048 process_min_avail = 0 service_count = 1 vsz_limit = 4 G } service lmtp { inet_listener lmtp-dom { address = 10.101.0.71 port = 24 ssl = no } process_limit = 0 process_min_avail = 0 service_count = 0 unix_listener lmtp { mode = 0666 } vsz_limit = 256 M } service managesieve-login { inet_listener sieve-dom { address = 10.101.0.71 port = 4190 ssl = no } inet_listener sieve { port = 0 } process_limit = 0 process_min_avail = 0 service_count = 0 vsz_limit = 64 M } service managesieve { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256 M } service submission-login { inet_listener submission-dom { address = 10.101.0.71 port = 587 ssl = no } inet_listener submission { port = 0 } inet_listener submissions-dom { address = 10.101.0.71 port = 465 ssl = yes } process_limit = 250 process_min_avail = 2 service_count = 1 vsz_limit = 256 M } service submission { process_limit = 1024 process_min_avail = 0 service_count = 1 vsz_limit = 256 M } ssl = required ssl_cert = </etc/ssl/certs/doveb0-rmt0-cn1.mail.rmt.domie02.com.pem ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it submission_max_mail_size = 30000 k submission_relay_host = 10.101.0.7 submission_relay_port = 587 submission_relay_ssl = starttls submission_relay_ssl_verify = no submission_relay_trusted = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-ldap-users.conf.ext driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-groups.conf.ext driver = ldap } protocol lmtp { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol lda { mail_plugins = " notify mail_log zlib acl sieve acl" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " notify mail_log zlib acl" } protocol sieve { mail_max_userip_connections = 40 } protocol submission { mail_max_userip_connections = 70 } local 10.101.0.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } local 10.100.1.71 { doveadm_allowed_commands = doveadm_password = # hidden, use -P to show it } } Thank you, Nikolaos Pyrgiotis

2 1

sieve accepting instructions from email
by Marc 07 Jun '23

07 Jun '23

Before switching to sieve, I used to have something in procmail that would allow you to turn on an auto reply by sending an email. - send email to yourself with request - receive auth code - send auth code and auto reply text - receive confirmation the auto reply is on Is there some solution in sieve (plugin) to configure your sieve rules via such email commands?

2 1

Multiple backends with NFSv4.1 (supports file locking): should work without Director, right?
by pierre.alletru＠gmail.com 05 Jun '23

05 Jun '23

Hi Dovecot community, We're looking at running multiple Dovecot backend servers in parallel, all using the same shared NFSv4.1 mount to store mailboxes in the maildir format. We've read in multiple places that running multiple backends with a shared NFS can result in issues like index files corruption. The standard solution seems to use the Director feature, or some kind of IP based proxy/load balancer. But: 1 - The Director feature will be removed in future free versions of Dovecot (https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/ILA3C…) 2 - NFSv4 and above support file locking (flock and fcntl, flock being emulated using fcntl). 3 - It looks like Dovecot does use file locking, though we're unsure if it does on everything and in particular on index files. Thus, we are wondering if the need for Director is still relevant with NFSv4? Shouldn't it work without Director thanks to file locking? Has anyone tried it? We're thinking that the documentation and various threads on the subject may be outdated, based on NFSv3 and lower (no file locking). If it doesn't work, anybody knows why? Isn't file locking there precisely to handle concurrency? Thanks!

10 17

attachments storage sub folders
by cor＠soverin.net 04 Jun '23

04 Jun '23

Hi all, we're using a separate attachment storage. Is there a way to control the subfolders that are created for each attachment? Currently the path is <user subfolder>/XX/YY/XXYY<hash>. In practice this means almost every single attachment gets its own 2 subfolders XX/YY. I'm seeing users with 5000 attachments and almost 10.000 folders. Normally this wouldn't be that big of a deal but we're using ZFS storage with metadata special device and this is causing a huge amount of additional folder metadata. It would already be helpful if we could just have a single XX/XX<hash> subfolder per user. Is that possible? Thanks, Cor dovecot 2.3.20 mail_attachment_dir = /data/attachments/%{userdb:folder} mail_attachment_fs = posix mail_attachment_hash = %{sha256:160} mail_attachment_min_size = 128k

1 0

Share
by liecj3＠bfh.ch 01 Jun '23

01 Jun '23

Hello dear Dovecot users I have a somewhat special request: I have a single file in mbox format which I want to make accessible via IMAP to anonymous logins. The mbox file is being updated outside of Dovecot and should not be changeable by Dovecot. So far I created a Docker container based on the official image (https://hub.docker.com/r/dovecot/dovecot) and configured the Dovecot according to https://doc.dovecot.org/configuration_manual/shared_mailboxes/public_shared/. The volume with the mbox file is mounted in the running container under /var/mail. Each time a client tries to access this public mailbox the following error is logged and no content is returned: May 26 21:57:06 imap(mutt)<16><Rkpg0Z/8pLfAqDAB>: Error: Mailbox Public/archive: open() failed with mbox: Read-only file system. Note that I don't need the file to be a shared mailbox. Instead I would also be happy to have all (anonymous) users mapped to the read-only mbox somewhere in the filesystem. Dockerfile: FROM dovecot/dovecot RUN mkdir -p /var/indexes/public RUN chown 1000:1000 /var/indexes/public ADD dovecot.conf /etc/dovecot/dovecot.conf /etc/dovecot/dovecot.conf: ## You should mount /etc/dovecot if you want to ## manage this file mail_home=/srv/mail/%Lu mail_location=sdbox:~/Mail mail_uid=1000 mail_gid=1000 #protocols = imap pop3 submission sieve lmtp protocols = imap first_valid_uid = 1000 last_valid_uid = 1000 passdb { driver = static args = password=pass } ssl=yes ssl_cert=<cert.pem ssl_key=<key.pem namespace { type = private inbox = yes separator = / } namespace { type = public prefix = Public/ location = mbox:/var/mail/:INDEX=/var/indexes/public subscriptions = no } listen = * log_path=/dev/stdout info_log_path=/dev/stdout debug_log_path=/dev/stdout

2 1

Using "forward_" variables in last_login_key
by Eirik Rye 01 Jun '23

01 Jun '23

Hello, In my setup, I am running dovecot with the following last_login config: plugin { last_login_dict = file:~/.last_login last_login_key = %s } I would like to distinguish between logins through webmail (Roundcube) and logins through regular IMAP clients. Roundcube sends "x-forward-service=webmail" in ID, and I have working logging for this by putting the following in login_log_format_elements: service=%{if;%{passdb:forward_service};eq;webmail;webmail;%s} (Is there may be a more elegant way to do this conditional?) This will print `service=webmail` for webmail logins, and `service=imap` for regular IMAP client logins. However, the same conditional does not work in last_login_key: last_login_key = %{if;%{passdb:forward_service};eq;webmail;webmail;%s} Using this, the login fails and the error log outputs the following error: Error: Failed to expand plugin setting last_login_key = '%{if;%{passdb:forward_service};eq;webmail;webmail;%s}': Unknown variable '%passdb' How can I tell which variables are available to use in this plugin? Are the forwarded variables not available? If not, any other suggestions on how to differentiate these logins in last_login? Looking at the remote_ip is not feasible for my setup. Best regards, Eirik

2 1

GSSAPI auth Line too long
by Thomas Lemarchand 31 May '23

31 May '23

Hello, On version 2.3.20 (80a5ac675d), I have a problem with submission-login when using GSSAPI auth : it's not working, probably due to AUTH line being too long. It appeared after I activated PAC on my Kerberos infrastructure. Now the Kerberos tickets contains MS-PAC data and are bigger. It's part of the RFC and is a valid use case : https://datatracker.ietf.org/doc/html/rfc4120#section-5.2.6 Logs : May 30 17:13:00 auth: Debug: auth client connected (pid=378) May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sent: 220 mail.int.k8s.lemarchand.io Dovecot ready. May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Received new command: EHLO [192.168.202.16] May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: New command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Execute command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Pipeline blocked May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Submitted May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Replied May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Ready to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Completed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Pipeline unblocked May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Connection state reset May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Sent: 250-mail.int.k8s.lemarchand.io 8BITMIME AUTH GSSAPI PLAIN LOGIN BURL imap CHUNKING ENHANCEDSTATUSCODES SIZE P IPELINING May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Finished May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command EHLO: 250 reply: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Client sent invalid command: Command line is too long May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Invalid command May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Submitted May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Replied May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Ready to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Next to reply May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Completed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Sent: 500 5.5.2 Line too long May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Finished May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: command [unknown]: 500 reply: Destroy May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Trigger output May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Sending replies May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: No more commands pending May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Remote closed connection: Connection closed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Disconnected: Connection closed May 30 17:13:00 submission-login: Debug: smtp-server: conn 10.200.114.128:13587 [1]: Connection state reset My guess is that it's due to https://github.com/dovecot/core/blob/main/src/lib-smtp/smtp-common.h#L10 being too low (is it configurable ?), but I didn't read the code thoroughly. Red Hat IDM now activates MS-PAC by default, so any installation based on IDM (or FreeIPA) may have the same problem. What's your opinion ? Bug ? Mail sent using password auth :'( -- Thomas Lemarchand

4 7

Inconsistent listing of shared subfolders
by mschering＠intermesh.nl 30 May '23

30 May '23

Hi all, I have a problem with listing shared folders. In my web application I don't get the whole folder tree at once but get them level by level with: LIST "" "subfolder/%" RETURN (CHILDREN) Now I have an issue with shared folders. If I share folder test/sub with another user it returns it's (not shared) parent folder with this command: LIST "" "shared/someuser/%" RETURN (CHILDREN) But if I do the same with INBOX/sub it will not return the "INBOX" folder with the above command. Is that a bug or does anybody know why it behaves differently? Also, If I do: LIST "" "shared/someuser/*" RETURN (CHILDREN) it will return both the subfolder of test and inbox. My shared namespace is setup like this: namespace { type = shared separator = / prefix = shared/%%u/ # a) Per-user seen flags. Maildir indexes are shared. (INDEXPVT requires v2.2+) location = maildir:%%h/Maildir:INDEXPVT=~/Maildir/shared/%%u # b) Per-user seen flags. Maildir indexes are not shared. If users have direct filesystem level access to their mails, this is a safer option: #location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u:INDEXPVT=~/Maildir/shared/%%u subscriptions = no list = children } Thanks for any help! Best regards, Merijn

1 0

Outlook Duplicate emails
by Nick Lekkas 29 May '23

29 May '23

Hello there to all ! I have 2 postfix/dovecot mailservers. Those mailservers are synced using replicator enabled. The dovecot versions I use is 2.3.16 on Rocky Linux 9 .The configuration issued from CentOS 7 mailservers with replicator enabled using 2.2.36. The config is the same in both 2 couple servers. I have issue with pop3 and outlook that receives duplicate email in many cases and in some accounts. Have anyone faced any similar issue.? Any help appreciated... Best Regards Nick __________ ESET Endpoint Antivirus __________ This email was scanned, no threats were found. email from: to: with subject Outlook Duplicate emails dated 29/05/2023 - is OK Detection engine version: 27314 (20230529) https://www.eset.com

2 1

RE: LDAP olcAccess for auth_bind
by Marc 29 May '23

29 May '23

> >> > >> I really got your point, but how you will implement aliases > > has nothing to do with dovecot, sendmail can get those from ldap. > > > >> or domain > > sendmail gets these from ldap (but requires a restart) > > > >> query or maybe quota? You still need to access ldap directly for > other > >> info's. > > quotas can be/are distributed to the os by ldap. But it depends a bit > on your setup, and if you have multiple file systems. > > > >> I mean, dovecot can probably use linux login but i'm not sure about > the > >> MTA. Unless you have a fixed list of domains added manually. > >> > > I have on different servers cron jobs running, getting every 5?min > modified/created records and then do a restart or something else. All > these processes have own entity in ldap with own acls. > > sendmail can get anything you want from ldap. For outgoing mail auth, > I have sendmail use os users (which come from ldap) > > > So in the end you still access ldap from another program but not from > dovecot :) I don't get your point. The goal for using ldap is having a centralized database that distributes information. How you choose to implement this, is depending on your requirements. > You avoid to authenticate users directly only to send the credentials of > some privilleged user from postfix/sendmail/whatever script... > Not to avoid. Other applications have different needs and thus different acl's. Dovecot does not need to know a users email address or alias. Only the MTA needs to know. The relaying MTA does not need to know the user etc.

1 0

LDAP olcAccess for auth_bind
by Andrzej Milewski 28 May '23

28 May '23

Hi, I'm trying to set up a production mail server. I have installed Dovecot on Debian from the package. For authentication, I have another machine running OpenLDAP, also installed on Debian. I would like the end mail client to authenticate with Dovecot using the login and password set in LDAP. In the LDAP-related configuration, I have: auth_bind=yes base = ou=Users,dc=example,dc=com user_attrs = mail=couriermaildir:~/Maildir,homeDirectory=/home/%d/%uid/,uidNumber=uid,gidNumber=gid user_filter = (&(objectClass=posixAccount)(uid=%u)) pass_attrs = uid=user,userPassword=password,\ pass_filter = (&(objectClass=posixAccount)(uid=%u)) The LDAP user is entered as uid=user(a)example.com. With the default olcAccess permissions, it works and logs in correctly. Here are my default olcAccess settings after installation: # {1}mdb, config dn: olcDatabase={1}mdb,cn=config objectClass: olcDatabaseConfig objectClass: olcMdbConfig olcDatabase: {1}mdb olcDbDirectory: /var/lib/ldap olcSuffix: dc=example,dc=com olcAccess: {0}to dn.children="ou=Idmaps,dc=example,dc=com" attrs=userPassword, shadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous a uth by dn="cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=laktopol,dc=p l" write by * none olcAccess: {1}to dn.subtree="ou=Idmaps,dc=example,dc=com" by self write by dn= "cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write b y * read olcAccess: {2}to dn.children="ou=Hosts,dc=example,dc=com" attrs=userPassword,s hadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous au th by dn="cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com " write by * none olcAccess: {3}to dn.subtree="ou=Hosts,dc=example,dc=com" by self write by dn=" cn=samba,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {4}to dn.children="ou=Users,dc=example,dc=com" attrs=userPassword,s hadowLastChange,SambaLMPassword,SambaNTPassword by self write by anonymous au th by dn="cn=samba,dc=example,dc=com" write by dn="cn=nsspam,dc=laktopol,dc=p l" write by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {5}to dn.children="ou=Users,dc=example,dc=com" by self write by dn= "cn=samba,dc=example,dc=com" write by dn="cn=nsspam,dc=example,dc=com" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {6}to filter=(objectClass=sambaDomain) by dn="cn=samba,dc=laktopol, dc=pl" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {7}to dn.base="dc=example,dc=com" attrs=children by dn="cn=samba,dc =laktopol,dc=pl" write by dn="cn=admin,dc=example,dc=com" write by * read olcAccess: {8}to attrs=userPassword,shadowLastChange,SambaLMPassword,SambaNTPa ssword by self write by anonymous auth by dn="cn=nsspam,dc=example,dc=com" wr ite by dn="cn=admin,dc=example,dc=com" write by * none olcAccess: {9}to attrs=shadowLastChange by self write by * read olcAccess: {10} to * by * read However, I am not satisfied with these settings because using the anonymous user, anyone can browse the entire LDAP tree. While passwords are not visible with anonymous login, user data in the LDAP domain is exposed. If I change the last olcAccess entry from "olcAccess: {10} to * by * read" to "olcAccess: {10} to * by anonymous auth," the anonymous user cannot browse LDAP, but the mail client user also cannot log in. What should be the correct configuration? -- Andrzej

4 12

Outlook fails to connect to Dovecot submission server
by Ralf Becker 28 May '23

28 May '23

Dovecot 2.3.20 including it's submission server works well with all sorts of clients, but Outlook. Outlook works / can connect to Dovecot IMAP service with same certificate TLS config, but it fails to connect using SMTPs on port 465. Other clients connect and send mails without problem, also openssl s_client can connect and reports no problems. I tried with Outlook Version 365 on Windows 11 (no cloud) and "Microsoft® Outlook® 2021 MSO (Version 2304 Build 16.0.16327.20200) 64-bit". I already enabled all submission_client_workarounds and lowered min_ssl_version from TLSv1.2 to TLSv1, but that changed nothing. I can see nothing failing in the logs, thought the OL connection wizard always check IMAP and SMTP together, so it's hard to say what the problem is. The same two Outlook version connect without a problem to Postfix authenticating via SASL to Dovecot also requiring a minimum TLS version of 1.2. They just wont connect with Dovecot submission server. Any ideas what's wrong, or how to debug that further? Ralf -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

5 8

Inaccurate results while searching for a phrase in subject (fts-flatcurve)
by ss17＠fea.st 26 May '23

26 May '23

Hi, I had been using the lucene FTS plugin since a decade now and it has done me well. Thought of upgrading to the new & current stuff and came across the flatcurve plugin which seems very promising (xapian on the other hand was creating indexes larger than my mailboxes themselves). I am using following configuration in dovecot.conf: fts = flatcurve fts_filters_en = lowercase english-possessive stopwords fts_languages = en fts_tokenizers = generic email-address fts_autoindex = no fts_enforced = yes A search command like this: doveadm -D search -u john(a)doe.com mailbox INBOX SUBJECT "/home/johndoe/render.php" should show the messages with subject: "CRON: /home/johndoe/render.php OK" but produces a lot of extra undesired results and I think the second line in this debug output indicates the reason: May 23 07:44:13 doveadm(john(a)doe.com): Debug: fts-flatcurve(INBOX): Query (hdr_subject:/home/johndoe/render.php*) matches=0 uids= May 23 07:44:13 doveadm(john(a)doe.com): Debug: fts-flatcurve(INBOX): Query (hdr_subject:php* AND hdr_subject:render* AND hdr_subject:johndoe* AND hdr_subject:home*) matches=272 uids=67041,67085,67188,67223,67257,67290,67323,67355,67395,67564,67770,67817,67863,67985,68819,69512,69572,69635,69737,70017,70058,70086,70125,70147,70191,70296,70304,70331,70340,70350,70354,70375,70407,70417,70427,70449,70499,70521:70522,70535:70550,70555,70561:70563,70591,70597:70599,70662,70685,70702,70708,70718:70719,70724,70727:70728,70730:70733,70735,70746:70747,70754,70775,70777,70794,70811:70812,70822,70866,70942,70948,70971,71017,71021,71040,71042,71075,71079,71084,71113,71128:71129,71131,71152,71160,71184,71188,71208,71214,71225,71255,71269,71297,71300,71331,71375,71422,71449,71457,71467,71469,71495,71515,71605,71626,71632,71649,71672,71681:71682,71689,71692,71699,71716,71757,71770,71777,71782:71785,71790,71795,71797,71814,71818:71819,71828,71838:71842,71845,71859:71860,71937,71947,71954,71960,71963:71964,71977,71990,72014,72021:72022,72030,72034:72042,72045:72046,72049,72056,72061,72063,72073:72074,72083,72088,72090,72092,72101,72108,72129,72131:72132,72134,72136:72140,72159,72163,72172:72173,72186,72212,72218:72223,72237,72239,72246,72267,72288,72387,72410,72446,72469,72476:72477,72514,72541,72543,72568:72569,72572:72574,72598,72604,72606,72609,72644,72674,72687,72691,72694,72734,72772,72791,72797,72799,72803,72832:72833,72835:72841,72856:72857,72866:72867,72873:72874,72901,72930,72938,72948,72960,72965,72976,73018,73037,73071,73081,73116,73158,73249,73307,73352,73392,73466,73533,73601,73670,73733,73775,73784:73786,73804,73807,73811,73815,73819,73823,73825,73831,73842,73846,74005,74199,74390,74540,74684,74854,75017,75192,75354,75525,75710,75839:75843,75845,75903,75984:75985,76091,76263,76447,76624,76816,76989,77091:77092,77097,77119,77155,77293,77460,77608,77761,77908,78066,78218,78393,78400:78401,78522:78523,78560,78728,78921,79104,79298,79504,79555,79898,80027,80031:80032,80034:80035,80037,80056,80071,80073,80077:80079,80082:80084,80086,80089 I tried rebuilding the indexes with "fts_flatcurve_substring_search = yes" too but that didn't change anything. It works as expected with lucene plugin because in that case header search is performed via dovecot indexes instead of FTS. May be I am not doing something right in configuring this new FTS? Will really appreciate some pointers here. Thanks, Sam

2 2

dovecot indexer-workers
by Nikolay Zlatkov 26 May '23

26 May '23

Hi, I have a problem with dovecot indexer-workers starting at the same time everyday and using too much disk io and cpu. I have limited indexer-workers to 2, but i am not sure this is the solution. Can you help me to configure this automatic reindex to be in the night for example. Best Regards! -- Николай Златков / Nikolay Zlatkov Системен администратор / System Administrator CALLFLOW mobilePhone +359 87 986 85 32 <tel:+359 87 986 85 32> emailAddress nzlatkov(a)callflowlab.com <mailto:nzlatkov@callflowlab.com> website www.callflowlab.com <//www.callflowlab.com> address Magnaurska shkola 11 Str., Office 310, Sofia 1784 All channels. One place. | OMNILINX | Check out our new product. <https://omnilinx.com/?utm_source=email&utm_medium=signature>

1 0

The (doveadm search HEADER "Header" "") command does not return email which have the header "Header"
by Léo El Amri 26 May '23

26 May '23

Hello there, When using the doveadm command (search HEADER "X-Discourse-Post-Id" "") or the IMAP command (SEARCH HEADER X-Discourse-Post-Id ""), emails containing a X-Discourse-Post-Id header are not listed. I've also tried with non X- headers, such as List-Unsubscribe and Auto-Submitted. RFC 3501 [1] and Dovecot's documentation [2] both says that this command should return emails containing the header searched. I couldn't find a mention of this bug in the git history, hence why I'm posting here, maybe there is something wrong with my installation ? I'm running Dovecot 2.3.20 on Debian on amd64 with an ext4 filesystem. I attached the output of dovecot -n. [1]: https://www.rfc-editor.org/rfc/rfc3501.html#section-6.4.4 [2]: https://wiki.dovecot.org/Tools/Doveadm/SearchQuery -- Cordially, Léo

1 1

dovecot replication crashing
by Heiko Schlittermann 25 May '23

25 May '23

Hi, I'm a but clueless, having issues with replication. `doveadm dsync -u hans` works. But using the following replication setup, I see coredumps. Where to go next? Interestingly not for all users. (For testing purposes I've only 2 users. One having about 20 messages: here even the replication works, but the 2nd user (having about 14k messages) fails. The failure seems to happen immediatly after starting the replication attempt). I saw the replication crashing using Dovecot packages from the current Debian distro. In order to debug this, I'm now using 2.3.20, built from Git. The replicator config boils down to this (complete config is attached) replication_full_sync_interval = 90d replication_max_conns = 16 mail_plugins = $mail_plugins notify replication plugin { mail_replica = tcps:smtp-mz.example.com:9090 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service aggregator { fifo_listener replication-notify-fifo { user = dovecot mode = 0666 } unix_listener replication-notify { user = dovecot mode = 0666 } } The stacktrace I get looks like this: Stack trace of thread 729589: #0 0x00007f9e4f2c8ce1 __GI_raise (libc.so.6 + 0x38ce1) #1 0x00007f9e4f2b2537 __GI_abort (libc.so.6 + 0x22537) #2 0x00007f9e4f5fe8c6 default_fatal_finish (libdovecot.so.0 + 0x558c6) #3 0x00007f9e4f6ab601 i_internal_fatal_handler (libdovecot.so.0 + 0x102601) #4 0x00007f9e4f5fe589 i_panic (libdovecot.so.0 + 0x55589) #5 0x00007f9e4f5fe99e fd_set_nonblock (libdovecot.so.0 + 0x5599e) #6 0x00005564cbe6a08d cmd_dsync_ibc_stream_init (doveadm-server + 0x3008d) #7 0x00005564cbe6b772 cmd_dsync_run (doveadm-server + 0x31772) #8 0x00005564cbe6d284 doveadm_mail_next_user (doveadm-server + 0x33284) #9 0x00005564cbe6e4ba doveadm_mail_cmd_exec (doveadm-server + 0x344ba) #10 0x00005564cbe7eb71 doveadm_cmd_run_ver2 (doveadm-server + 0x44b71) #11 0x00005564cbe8300a doveadm_cmd_server_run_ver2 (doveadm-server + 0x4900a) #12 0x00007f9e4f6c1799 io_loop_call_io (libdovecot.so.0 + 0x118799) #13 0x00007f9e4f6c2e82 io_loop_handler_run_internal (libdovecot.so.0 + 0x119e82) #14 0x00007f9e4f6c1840 io_loop_handler_run (libdovecot.so.0 + 0x118840) #15 0x00007f9e4f6c1a00 io_loop_run (libdovecot.so.0 + 0x118a00) #16 0x00007f9e4f6343a3 master_service_run (libdovecot.so.0 + 0x8b3a3) #17 0x00005564cbe5d9a2 main (doveadm-server + 0x239a2) #18 0x00007f9e4f2b3d0a __libc_start_main (libc.so.6 + 0x23d0a) #19 0x00005564cbe5da2a _start (doveadm-server + 0x23a2a) 2023 Mar 28 00:09:28 clone doveadm(hans)<729589><TdSzNhcUImT1IQsAKQCViw>: Fatal: master: service(doveadm): child 729589 killed with signal 6 (core dumped) I'm a bit clueless now, even using the coredump and gdb. -- Heiko

3 7

subscriptions via master user
by Przemysław Kwiatkowski 25 May '23

25 May '23

Hello, When I impersonate an regular user using master user (log in to Roundcube as "user*masteruser") - there are user's subscriptions missing. I can see all folders, but have to manually enable visibility in settings. Is this normal? Can I fix it? passdb { driver = passwd-file master = yes args = /filepath pass = yes } passdb { driver = passwd-file args = /filepath } userdb { driver = passwd-file args = /filepath default_fields = uid=vmail gid=vmail system_groups_user=vmail home=/srv/vmail/%d/%n master_user=%u } -- Przemyslaw Kwiatkowski

1 0

fts crash
by Przemysław Kwiatkowski 21 May '23

21 May '23

Hello, I started full reindex of whole emails base (doveadm index -A '*') and solr crashed due to out of memory. I had plenty of such messages: doveadm(gzt): Error: fts_solr: Indexing failed: Connection lost: read((conn:127.0.0.1:8983,id=621)) failed: EOF (Request queued 40.832 secs ago, 1 send attempts in 39.359 secs, 0.002 in http ioloop, 0.000 in other ioloops, connected 704.138 secs ago) doveadm(gzt): Error: Mailbox Sent: Precache for UID=4036 failed: Internal error occurred. Refer to server log for more information. [2023-05-20 06:01:40] doveadm(gzt): Error: Mailbox Sent: Transaction commit failed: FTS transaction commit failed: backend deinit I increased solr memory and restarted it. Do I have to restart dovedam index? The "request queued" message suggest that Dovecot is smart and I don't need to do anything. Am I right? (Any way to confirm that indeed everything was indexed?) -- Przemyslaw Kwiatkowski

2 1

Re: LMTP server client certificate validation
by Jochen Bern 19 May '23

19 May '23

On 16.05.23 14:27, Sean Gallagher wrote: > I have a created a CA for the sole purpose of signing the certificate of > the LMTPS client. I regard this as a horrible horrible kludge. ... how do you figure that? *Someone*, and that means you, has to specify which clients are allowed to connect. Which leaves three possibilities: a) You run the CA and thus, the CA can do the selection for you. Which means that in order to deal with a single-permissible-client situation, you need the CA to issue client certs to just that one entity. b) The CA does *not* and issues (client) certs to entities you do *not* want to grant access. Then the selection job remains yours and, assuming that requiring a client cert from that CA makes any sense in the first place, auth_ssl_username_from_cert is there to help you (by making sure that the username will be "the ID" from the cert so that you can base some additional filtering on that). c) The CA is willing to enrich the certs it issues with DN parts, X509v3 extensions or the like signalling access rights as granted beforehand by a *fourth* party, as in, you. Which is a terrible can of worms as soon as things, especially the number of such fourth parties to support by the same CA, start to scale up IMHO. Which promptly brings us back to you running the CA yourself ... Kind regards, -- Jochen Bern Systemingenieur Binect GmbH

3 5

Possible hack via doveadm
by Daniel L. Miller 18 May '23

18 May '23

I currently have two servers running with synchronization that I've been very happy with. However, I'm seeing the following in my logs recently: May 12 15:45:58 cloud1 dovecot: doveadm(194.165.16.78): Error: doveadm client not compatible with this server (mixed old and new binaries?) May 13 03:44:31 cloud1 dovecot: doveadm(45.227.254.48): Error: doveadm client not compatible with this server (mixed old and new binaries?) Since I don't recognize those IPs, the first is out of Panama and the other is Belize, I assume these are hostile attackers trying to exploit something. How can I defend against this? -- Daniel

5 6

pigeonhole: sieve: float score failed for comparator-i ascii-numeric
by Randy Li 18 May '23

18 May '23

Hello Following the sieve_spamtest_status_header from the document, I think I could extract the score from the spamassassin (which is from spampd lmtp). But sieve script can't never work properly with comparator "i;ascii-numeric". I have used sieve-test several times, once I remove the dot from the mail sample, the sieve script works well. I noticed that document says i;ascii-numeric is for unsigned integer only which certainly does work for this case. The score here would be signed float(all right all the float is signed) and it is a float variable from tst-spamvirustest.c. I think that is the place the bug happened. Unfortunately, I didn't found any RFC that supports a float comparator and I am not familiar with the sieve interrupter. If someone could give me a possible method to fix this, I could submit a patch. Sincerely Randy Li

2 2

Re: Incorrect saved dates in mailboxes
by Joseph Tam 18 May '23

18 May '23

> OK, that does make sense so far. Today I have checked, and the correct > dates seem to be showing up now after the initial date (ever since that > initial run of the "dovecot expunge" command was run on all mailboxes). > So in our case I have the expunge set to delete older than 30 days. I > assume if I wait 30 days from now, it will start working? Yup. If you run your script every day (and thus, run "doveadm fetch ... date.saved" as well), that will make sure any new mail put into your Trash folder will have date.saved within 24h of the "real" value. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: Incorrect saved dates in mailboxes
by Joseph Tam 18 May '23

18 May '23

Chris Szilagyi <chris(a)apex-internet.com> writes: > Recently, I noticed that our expunge script is not working, and I don't > think it ever has on this server. On further inspection, it looks like > the saved date for emails in the folders we want to expunge is set to a > recent date (yesterday) for almost all messages. For example, when I > run the command "doveadm -f tab fetch -u username date.saved mailbox > Trash", the date for almost all of the messages is yesterday at the > exact same time. I tried this on other users and they have this exact > same timestamp shown for most of their messages, too. > > I tried checking for "date.received" and that shows correct, it is > "date.saved" that is not working. > > Any idea of how or why this would not be showing the correct date? I've > used this setup in the past on other servers with dovecot and it has > worked great, no idea why we would be seeing this issue now. I recall having the same problem. I think the "date.saved" is not instantiated in the cache until you query for it. So the value you were shown is when you last dumped its value if it wasn't previously set -- your run of same values coincided when you ran "doveadm fetch". My expunge script just uses date.received instead -- it seems to work. Joseph Tam <jtam.home(a)gmail.com>

2 1

[PATCH] [WIP]: thunderbird mboxrd to mbox
by Randy Li 16 May '23

16 May '23

I was trying to restore email from local thunderbird download data. None of the script I found could work. This script is modified from superuser.com/questions/105653/how-to-convert-mboxo-mboxrd-to-mboxcl-mboxcl2 Which works for me, using this script I could use doveadm import to restore my INBOX(I don't know how to restore the Sent mailbox). If this script is useful, I would rewrite one for python3 and following the mboxrd spec. Signed-off-by: Randy Li <ayaka(a)soulik.info> --- mailman2mbox.py | 111 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 111 insertions(+) create mode 100755 mailman2mbox.py diff --git a/mailman2mbox.py b/mailman2mbox.py new file mode 100755 index 0000000..1a154b7 --- /dev/null +++ b/mailman2mbox.py @@ -0,0 +1,111 @@ +#!/usr/bin/env python2 +""" +Usage: ./mailman2mbox.py infile outfile default-to-address +""" +import sys +from time import strftime,strptime,mktime,asctime +from email.utils import parseaddr,formatdate + +if len(sys.argv) not in (3,4): + print __doc__ + sys.exit() + +out = open(sys.argv[2],"w") +listid = None +if len(sys.argv)==4: + listid = sys.argv[3] + +date_patterns = ("%b %d %H:%M:%S %Y", "%d %b %H:%M:%S %Y", "%d %b %Y %H:%M:%S", "%d %b %H:%M:%S", "%d %b %y %H:%M:%S", "%d %b %Y %H.%M.%S",'%m/%d/%y %H:%M:%S %p') + +class HeaderError(TypeError): + pass + + +def finish(headers, body): + body.append("\n") + for n,ln in enumerate(headers): + if ln.startswith("Date:"): + break + else: + raise HeaderError("No 'Date:' header:\n" + "".join(headers)+"\n") + if listid is not None: + for ln2 in headers: + if ln2.lower().startswith("list-id:"): + break + else: + headers.append("List-Id: <%s>\n" % (listid,)) + date_line = ln[5:].strip() + if date_line.endswith(')'): + date_line = date_line[:date_line.rfind('(')].rstrip() + if date_line[-5] in "+-": + date_line, tz = date_line[:-5].rstrip(), int(date_line[-5:])//100 + else: + tz = -5 + if date_line[:3] in ("Mon","Tue","Wed","Thu","Fri","Sat","Sun"): + if date_line[3:5] == ', ': + prefix = "%a, " + elif date_line[3] == ',': + prefix = "%a," + else: + prefix = "%a " + else: + prefix = "" + while True: + for p in date_patterns: + try: + date_struct = strptime(date_line, prefix+p) + except ValueError: + pass + else: + break + else: + if not date_line: + raise ValueError(headers[n]) + date_line = date_line[:date_line.rfind(' ')] + continue + break + + date_struct = list(date_struct) + try: + headers[n] = 'Date: %s\n' % (formatdate(mktime(date_struct),True)) + headers[0] = "From %s %s\n" % (headers[0][:-25].rstrip(), asctime(date_struct), ) + except ValueError: + raise ValueError(headers[n]) + + for w in headers, body: + for s in w: + out.write(s) + + +message = 0 +headers, body = None, None +for line in open(sys.argv[1]): + if line.startswith("From "): + message+=1 + header = True + if headers is not None: + try: + finish(headers, body) + except HeaderError: + message -= 1 + out.write('>') + for w in headers, body: + for s in w: + out.write(s) + headers, body = [], [] + line = line.replace(" at ", "@") + elif line == '\n': + header = False + elif header and line.startswith('From:'): + line = line.replace(" at ","@") + (headers if header else body).append(line) + +try: + finish(headers, body) +except HeaderError: + out.write('>') + for w in headers, body: + for s in w: + out.write(s) + +out.close() -- 2.40.1

2 1

Incorrect saved dates in mailboxes
by Chris Szilagyi 16 May '23

16 May '23

Hello: We have a server (Debian 11) using Dovecot 2.3 which has been in place for about a year. We are using mbox format for our mailboxes, and do not use MySQL, just plain user directories under /home. Recently, I noticed that our expunge script is not working, and I don't think it ever has on this server. On further inspection, it looks like the saved date for emails in the folders we want to expunge is set to a recent date (yesterday) for almost all messages. For example, when I run the command "doveadm -f tab fetch -u username date.saved mailbox Trash", the date for almost all of the messages is yesterday at the exact same time. I tried this on other users and they have this exact same timestamp shown for most of their messages, too. I tried checking for "date.received" and that shows correct, it is "date.saved" that is not working. Any idea of how or why this would not be showing the correct date? I've used this setup in the past on other servers with dovecot and it has worked great, no idea why we would be seeing this issue now. Thanks in advance. Chris

2 1

[feature request] SSL handshake rejection for non-SNI clients
by Serg 16 May '23

16 May '23

I would like to offer to implement a feature to reject SSL handshakes for a default certificate-key pair for efficiently discarding bot requests (i.e. such requests that provide invalid/not configured hostname or do not specify at all, like when doing request to the IP address directly). Nginx has such feature already implemented as seen here[1], and it would be beneficial if dovecot would support this too. Currently I am using the following SSL configuration snippet to mimic such behavior: > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_key = </etc/ssl/dovecot/server.key > > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = </etc/ssl/domains/flopster.at.encryp.ch/key > } But in this case the problem is that the invalid requests (for this example it is requests that don't have Server Name Indication at all or mention anything else but not flopster.at.encryp.ch) are still being replied by Dovecot with a TLS certificate rather than being simply rejected with a TLSV1_UNRECOGNIZED_NAME error code. [1]: <https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake>

3 3

Re: [External] Re: Help - Permissions issue with new mail
by Mihai Badici 16 May '23

16 May '23

Sorry, I sent the reply directly to you not to the list. I try to find which is the uid expected by dovecot. Usually since in postfix the uid is set as 5000 you need to have the same "virtual" uid set in dovecot. I didn't see this in the fail you sent. Maybe you made some change in the past without restarting dovecot. Anyway i think a line like mail_uid=5000 somewhere in dovecot configuration ( location may differ )should fix your issue. Try to find if this is already set and if not add this in dovecot and restart it. On 2023-05-04 15:16, Michele Clark wrote: > Attached is a copy of my main.cf from postfix and my 10-mail from > dovecot > > Let me know if you see anything that I might try - Thanks in advance > > Michele Clark > Title | Engineering Business Unit > KBR | Government Solutions – US > Office: +1 937-713-8669 > > ------------------------- > > From: Mihai Badici <mihai(a)badici.ro> > Sent: Wednesday, May 3, 2023 3:44 PM > To: Michele Clark <Michele.Clark(a)us.kbr.com> > Subject: Re: [External] Re: Help - Permissions issue with new mail > > You don't often get email from mihai(a)badici.ro. Learn why this is > important [1] > > CAUTION: This email originated from outside of the organization. Do > Re: [External] Re: Help - Permissions issue with new mail Contact photo From Michele Clark on 2023-05-04 15:16 Details Headers Plain text Download all attachmentsSave all to cloud... 10-mail.conf.jpg.docx(~761 KB) MAIN.CF.JPG(~161 KB) Attached is a copy of my main.cf from postfix and my 10-mail from dovecot Let me know if you see anything that I might try - Thanks in advance Michele Clark Title | Engineering Business Unit KBR | Government Solutions – US Office: +1 937-713-8669 From: Mihai Badici <mihai(a)badici.ro> Sent: Wednesday, May 3, 2023 3:44 PM To: Michele Clark <Michele.Clark(a)us.kbr.com> Subject: Re: [External] Re: Help - Permissions issue with new mail You don't often get email from mihai(a)badici.ro. Learn why this is important CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. I think the problem isn't the rights of the files but dovecot need to use the same user for read them. I have something like: mail_uid = 5000 in 10-mail.conf, this uid need to be the same as in postfix On 5/3/23 21:42, Michele Clark via dovecot wrote: > 1: This was previously working but has been down since there was an > unexpected power outage. This install has been in place for several > years > 2: When I chmod -r the CUR folder I can get mail to drop to our > roundcube inbox or if I chmod the actual email file in the cur folder > (have tried > not click links or open attachments unless you recognize the sender > and know the content is safe. > > I think the problem isn't the rights of the files but dovecot need to > use the same user for read them. > > I have something like: mail_uid = 5000 in 10-mail.conf, this uid need > to be the same as in postfix > > On 5/3/23 21:42, Michele Clark via dovecot wrote: > >> 1: This was previously working but has been down since there was an >> unexpected power outage. This install has been in place for several >> years >> 2: When I chmod -r the CUR folder I can get mail to drop to our >> roundcube inbox or if I chmod the actual email file in the cur >> folder (have tried both) however new messages still come thru with >> -rw------- >> 3. Attached is a copy of the return from comm -23 <(postconf -n) >> <(postconf -d) with the exception of a few redactions for our >> personal data >> 4. What info would you like to see from dovecot? >> >> Any help is much app >> >> Michele Clark >> Title | Engineering Business Unit >> KBR | Government Solutions – US >> Office: +1 937-713-8669 >> >> ------------------------- >> >> From: John Stoffel <john(a)stoffel.org> >> Sent: Wednesday, May 3, 2023 2:14 PM >> To: Michele Clark <michele.clark(a)us.kbr.com> >> Cc: dovecot(a)dovecot.org <dovecot(a)dovecot.org> >> Subject: [External] Re: Help - Permissions issue with new mail >> >> [You don't often get email from john(a)stoffel.org. Learn why this is >> important at https://aka.ms/LearnAboutSenderIdentification [1] ] >> >> CAUTION: This email originated from outside of the organization. Do >> not click links or open attachments unless you recognize the sender >> and know the content is safe. >> >>>>>>> "michele" == michele clark--- via dovecot >> <dovecot(a)dovecot.org> writes: >> >>> We have an install of Dovecot running with Postfix and Roundcube >>> using virtual mail to allow us to connect to our AD domain which >> got >>> messed up after a power issue. >> >> Was this working before the AD problems, or is this a new install? >> >>> I can log into our Roundcube and see all my old emails, however >> new >>> emails keep getting stuck in the CUR files with permissions of >>> -rw------- >> >>> If I chmod the email it will deliver to the inbox in Roundcube. >> >> Where are you changing the permissions? The destination directory? >> >>> Can anyone advise on how I can adjust this so all new emails will >>> come thru with the correct permissions? - Thanks in advance >> >> It all depends on how your email are delivered, and you need to post >> some of your configuration details, such as the postfix config and >> the >> dovecot config. >> >> For postfix, just post the changed from defaults info, which you can >> get with the following bash sheel command: >> >> comm -23 <(postconf -n) <(postconf -d) >> >> See the postconf man page for details. >> >> Also post your dovecot info as well. >> >> This e-mail, including any attached files, may contain confidential >> information, privileged information and/or trade secrets for the >> sole use of the intended recipient. Any review, use, distribution, >> or disclosure by others is strictly prohibited. If you are not the >> intended recipient (or authorized to receive information for the >> intended recipient), please contact the sender by reply e-mail and >> delete all copies of this message. >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org > This e-mail, including any attached files, may contain confidential > information, privileged information and/or trade secrets for the sole > use of the intended recipient. Any review, use, distribution, or > disclosure by others is strictly prohibited. If you are not the > intended recipient (or authorized to receive information for the > intended recipient), please contact the sender by reply e-mail and > delete all copies of this message. > > Links: > ------ > [1] https://aka.ms/LearnAboutSenderIdentification

4 9

replicator service
by Przemysław Kwiatkowski 15 May '23

15 May '23

I'm confused. Replicator service is bidirectional. Does it mean I should start it only on *one* end of a replication pair? Or on both, working simultaneously? -- MiCHA

2 1

acl replication
by micha＠micha.waw.pl 14 May '23

14 May '23

What is correct way to sync ACLs across two servers? Example: I want user1 to have access to user2 mailbox. I do this on server1: doveadm acl set shared/user2 user=user1 admin create delete expunge insert lookup read write write-deleted write-see Now user1 can see shared/user2 when logged to server1. (Looks good!) He still has no access when logged to server2. (Seems correct.) So I do synchronization: doveadm sync -u user2 remote:server2 ...and nothing changes. He still have access only when logged to server1. So I force full synchronization: doveadm sync -u -f user2 remote:server2 ...and success! User1 has access to shared/user2 on both servers now. But now I want to remove access. So I do this on server1: doveadm acl delete shared/user2 user=user1 Of course the above affects only server1, so user1 still have access when logged to server2. So now I do synchronization: doveadm sync -u user2 remote:server2 Nothing happens. :-( So I try do do full synchro: doveadm sync -u user2 -f remote:server2 ...disaster! The ACL is COPIED BACK from server2 to server1 and effectively restoring access to shared/user2 on on both servers again. (WTH?) So big question is: Who to do it properly? It would be enough for me if ACL's were copied only one way (server1->server2), but bidirectional replication would of course also be nice. :-) Configs: namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/.maildir:LAYOUT=fs:INDEX=~/.shared/%%u order = 0 prefix = shared/%%u/ separator = / subscriptions = no type = shared } plugin { acl = vfile:/etc/dovecot/mailconfig/global-acls acl_defaults_from_inbox = yes acl_shared_dict = file:/etc/dovecot/mailconfig/shared/shared-mailboxes }

3 4

Conclusion about plus address setup
by Tom Reed 14 May '23

14 May '23

Hello Just FYI, After simple putting this line into postfix's main.cf: recipient_delimiter = + And reload postfix, the plus alias address should work. I am using dovecot LMTP as delivery agent. Nothing changes to dovecot configuration. Here are the versions: Postfix 3.6.4 Dovecot 2.3.16 OS Ubuntu 22.04 Thank you very much for all helps. regards Tom

1 0

dovecot for plus address
by Tom Reed 13 May '23

13 May '23

Hello How to setup dovecot to accept the plus address? such as user+foo(a)sample.com will be delivered into user(a)sample.com Thank you. Tom R.

3 4

Sieve with several redirects stops if one redirect fails
by Matteo Staglianò 12 May '23

12 May '23

Hello, I have this block on my sieve filter: |if not header :matches "X-Spam-Status" "Yes*" {|| || redirect "atest(a)non-existent.tld";|| || redirect "info(a)existent.tld";|| ||}|| ||keep;| when the first redirect fails: |sieve: info: started log at May 12 10:33:21.|| ||error: msgid=<20230512103320.070708@candy>: redirect action: failed to redirect message to <atest(a)non-existent.tld>: smtp(host.smtp.tld): RCPT TO failed: 550 5.1.1|| ||<atest(a)non-existent.tld> recipient rejected (permanent failure).| the second one is not even triggered. I would like to know if this is an expected behaviour or a misconfiguration on my side. |dovecot-core 2:2.3.8-4~buster|| ||dovecot-imapd 2:2.3.8-4~buster|| ||dovecot-lmtpd 2:2.3.8-4~buster|| ||dovecot-mysql 2:2.3.8-4~buster|| ||dovecot-pigeonhole-dbg 2:2.3.8-4~buster|| ||dovecot-pop3d 2:2.3.8-4~buster|| ||dovecot-sieve 2:2.3.8-4~buster|| |||| ||sieve = ~/.dovecot.sieve|| ||sieve_extensions = +editheader|| ||sieve_global_extensions = +vnd.dovecot.pipe|| ||sieve_max_redirects = 15|| ||sieve_pipe_bin_dir = /usr/lib/dovecot/|| ||sieve_plugins = sieve_imapsieve sieve_extprograms|| ||sieve_vacation_default_period = 1h|| ||mail_plugins = notify mail_log quota imap_quota imap_sieve|| ||mail_plugins = notify mail_log quota sieve|| || | Thank you

1 0

doveadm on remote socket SSL problem
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, trying to exec doveadm commands on remote server: doveadm search -S domain.com:12333 -u user@domaincom mailbox Sent This produces error in remote server log: doveadm(192.168.10.19): Error: SSL handshake failed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number How to do it right?

1 0

dsync start/end date issue
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, i am trying to do a backup with doveadm backup command. I need to set date filter with argument [-e end date]. Doing so with -e 2020-01-01 or -e 1577829600 shows error: dovecot: doveadm: Error: dsync(mail-archive.domain.com): handshake: Invalid sync_until_timestamp: 0 What is the correct way of time filter?

1 0

Best practice for Dovecot with LDAP and Postfix
by Moritz Pflanzer 09 May '23

09 May '23

Hi all, so far I had a setup where Dovecot was using a passwd file as userdb and passdb. Postfix was then authenticating with Dovecot via SASL to validate user accounts. Now I added an LDAP backend and would like to use that for Dovecot and Postfix. My first approach was to change the passdb to use the LDAP driver with the following settings: hosts = openldap:1389 base = ou=users,dc=example,dc=com auth_bind = yes auth_bind_userdn = uid=%n,ou=users,dc=example,dc=com And I changed the userdb driver to static since anyway there is just the vmail system account for all virtual user mailboxes. This is working as expected for the IMAP connections. But postfix authentication fails as it is apparently using a wrong user_filter. This is what I see in the logs from OpenLDAP: docker-openldap-1 | 645908ae.1d975b70 0x7fe379297700 conn=1347 fd=12 ACCEPT from IP=172.19.0.7:52144 (IP=0.0.0.0:1389) docker-openldap-1 | 645908ae.1d98571f 0x7fe379a98700 conn=1347 op=0 BIND dn="" method=128 docker-openldap-1 | 645908ae.1d993bd7 0x7fe379a98700 conn=1347 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000072 text= docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: 8A9FC1E03C5: client=mo4-p01-ob.smtp.rzone.de[85.215.255.51] docker-postfix-1 | May 08 14:35:26 nest postfix/cleanup[12461]: 8A9FC1E03C5: message-id=<713569303.508224.1683556526256(a)webmail.strato.de> docker-postfix-1 | May 08 14:35:26 nest postfix/qmgr[951]: 8A9FC1E03C5: from=<moritz(a)pflanzer.eu>, size=3340, nrcpt=1 (queue active) docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: disconnect from mo4-p01-ob.smtp.rzone.de[85.215.255.51] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 docker-openldap-1 | 645908ae.2616b031 0x7fe379297700 conn=1347 op=1 SRCH base="ou=users,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=moritz(a)example.com))" docker-openldap-1 | 645908ae.26179272 0x7fe379297700 conn=1347 op=1 SRCH attr=uid docker-openldap-1 | 645908ae.2619389b 0x7fe379297700 conn=1347 op=1 SEARCH RESULT tag=101 err=32 qtime=0.000017 etime=0.000221 nentries=0 text= I tried setting the user_filter manually to "user_filter = (mail=%u)" but that doesn't have any effect. Is this the expected behavior from Dovecot? I guess I can get it working by using the ldap driver for the userdb as well. But is that the best approach since I technically don't need it for dovecot itself. Or should I now change the postfix config as well to directly authenticate against the LDAP server instead of using SASL with Dovecot? Looking forward to recommendations, Moritz

7 16

Re: dmarc user can't receive email because of encrypted storage
by Aki Tuomi 09 May '23

09 May '23

> On 04/05/2023 21:08 EEST efeizbudak(a)disroot.org wrote: > > > On 2023-05-04 20:53, Aki Tuomi via dovecot wrote: > >> On 04/05/2023 20:11 EEST efeizbudak--- via dovecot > >> <dovecot(a)dovecot.org> wrote: > >> > >> > >> Hi all, > >> > >> So recently google has been trying to send email to dmarc(a)domain.com > >> on > >> my server but I'm using encrypted storage and since the dmarc user has > >> no password the email is being rejected with the error: > >> > >> May 4 16:51:50 domain dovecot: > >> lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: > >> msgid=<10341808348719730099(a)google.com>: failed to store into mailbox > >> 'INBOX': generate_keypair(INBOX) failed: > >> mail_crypt_require_encrypted_user_key set, cannot generate user > >> keypair > >> without password or key > >> > >> How can I fix this, or at least read what the mail says? Would it be > >> safe to just give dmarc user a strong password? > > > > You can run > > > > doveadm mailbox cryptokey generate -U dmarc -N > > > > so the user will have a keypair generated. Then it should work. > > > > Aki > > I'm getting > > generate: invalid option -- 'N' > > should I just run it without -N ? > > Thank you! Please keep responses on the list. Try -n password? I have a faint recall of a buggy version like this. Aki

2 11

Documentation issue: incorrect link
by Tom Hendrikx 05 May '23

05 May '23

Hello, In the second paragraph at https://doc.dovecot.org/configuration_manual/sieve/extensions/duplicate/, a link is included to RFC7353, but this RFC is not related to sieve at all. I think the correct RFC to link is RFC7352, like in the first paragraph. Kind regards, Tom

1 0

amount of users
by Thomas Schäfer 05 May '23

05 May '23

Hi, is somewhere a table/matrix/function based on experience how many users require which values for mail_max_userip_connections default_client_limit default_process_limit ...? I run into problems with a small group of users, since the defaults seem to be only for single man shows. The second assumption is: User are permanently online (connected to imap) and using two devices in average (one or two desktops, + one mobile device) Regards, Thomas -- There’s no place like ::1 Thomas Schäfer (Systemverwaltung) Ludwig-Maximilians-Universität Centrum für Informations- und Sprachverarbeitung Oettingenstraße 67 Raum C109 80538 München ☎ +49/89/2180-9706 ℻ +49/89/2180-9701

1 0

dmarc user can't receive email because of encrypted storage
by efeizbudak＠disroot.org 04 May '23

04 May '23

Hi all, So recently google has been trying to send email to dmarc(a)domain.com on my server but I'm using encrypted storage and since the dmarc user has no password the email is being rejected with the error: May 4 16:51:50 domain dovecot: lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: msgid=<10341808348719730099(a)google.com>: failed to store into mailbox 'INBOX': generate_keypair(INBOX) failed: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key How can I fix this, or at least read what the mail says? Would it be safe to just give dmarc user a strong password?

2 1

Error: read() failed for file :: No buffer space available
by rudolf＠padaru.de 04 May '23

04 May '23

Hey there, ive got a situation with one of mine mailusers he cant access his mailbox and i cant resync the mailuser or access the mails with doveadm too: In maillog we got a lot of these errors, ist only m.73 that makes problems: Error: Syncing mailbox INBOX failed: read() /mdbox/storage/m.73: No buffer space available I dont really understand whats the problem here, the partition has ~500gb free space and all other mailboxes work fine on this server. Is there somebody who can give me a hint to solve this? First i thought the mdbox file is to obig, so i increased the mdbox_rotate_size limit without success. To restart the dovecot changes nothing too. In the dovecot journal i cant find other problems wo cause in this one, same in syslog, nothing special to see, like segfaults or so. My doveconf -n: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.4.0-146-generic x86_64 Ubuntu 20.04.6 LTS auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@üÜöÖäÄ auth_worker_max_count = 60 default_vsz_limit = 1000 M disable_plaintext_auth = no imap_capability = +XLIST imap_logout_format = in=%i out=%o del=%{deleted} fetched_mails=%{fetch_hdr_count} lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lock_method = flock login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_always_cache_fields = date.received date.sent imap.envelope hdr.x-spam hdr.x-virus-status hdr.return-path hdr.received flags mail_cache_min_mail_count = 30 mail_location = auto: mail_max_userip_connections = 30 mail_never_cache_fields = mail_plugins = " zlib" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags notify vnd.dovecot.pipe vnd.dovecot.filter vnd.dovecot.execute mbox_read_locks = dotlock mbox_very_dirty_syncs = yes mdbox_rotate_size = 250 M namespace inbox { inbox = yes location = mailbox Archiv { auto = no special_use = } mailbox Drafts { auto = no special_use = } mailbox Junk { auto = no special_use = } mailbox Sent { auto = no special_use = } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = no special_use = } prefix = } passdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } plugin { sieve = ~/sieve/.dovecot.sieve sieve_after = ~/sieve_after/.dovecot_after.sieve sieve_before = ~/sieve_before/.dovecot_before.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/ sieve_execute_input_eol = lf sieve_extensions = +notify +imapflags +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute +editheader -reject sieve_filter_bin_dir = /usr/local/bin/ sieve_filter_input_eol = lf sieve_global_dir = /etc/dovecot/sieve/ sieve_max_redirects = 25 sieve_pipe_bin_dir = /usr/local/bin/ sieve_pipe_input_eol = lf sieve_plugins = sieve_extprograms sieve_redirect_envelope_from = recipient zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 sieve service auth-worker { idle_kill = 1 mins } service auth { idle_kill = 1 mins unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 4 service_count = 0 user = dovecot } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 0 user = dovecot } service managesieve { process_limit = 1024 user = dovecot } service pop3-login { executable = /usr/lib/dovecot/pop3-login process_min_avail = 4 service_count = 0 user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0666 } unix_listener stats-writer { group = dovecot mode = 0666 } } shutdown_clients = no ssl_cert = </etc/certs/ourCert.com.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:E ECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNU LL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lda { mail_plugins = " zlib sieve zlib" rejection_reason = Your message to <%t> was automatically discarded:%n%r } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " zlib mail_log notify zlib" ssl = yes } protocol pop3 { mail_plugins = zlib pop3_client_workarounds = oe-ns-eoh outlook-no-nuls pop3_no_flag_updates = no pop3_uidl_format = %08Xu%08Xv ssl = yes } Size oft he mdbox-file: du -b m.73 262143997 m.73 Mit freundlichen Grüßen Yours sincerely <https://padaru.de/> Pascal Rudolf | Geschäftsführer PADARU-IT | Bielebohstraße 10 | 02736 Beiersdorf @: rudolf(a)padaru.de | www: <http://padaru.de/> padaru.de mobil: +49 (0) 17 772 595 32

1 0

Help - Permissions issue with new mail
by michele.clark＠us.kbr.com 03 May '23

03 May '23

Hi all. We have an install of Dovecot running with Postfix and Roundcube using virtual mail to allow us to connect to our AD domain which got messed up after a power issue. I can log into our Roundcube and see all my old emails, however new emails keep getting stuck in the CUR files with permissions of -rw------- If I chmod the email it will deliver to the inbox in Roundcube. Can anyone advise on how I can adjust this so all new emails will come thru with the correct permissions? - Thanks in advance

5 4

managesieve problem
by Soeren Malchow 25 Apr '23

25 Apr '23

Hi, i am struggeling with a managesieve problem, we are using docker mailserver and managesieve login does not work, if i understand correctly, then dovecot should offer something like this "SASL" "PLAIN" on our server it is simply empty "SASL" "" i was trying to authenticate in a telnet connection AUTHENTICATE "PLAIN" "LOGINSTRING_HERE" And i get this NO "Error in MANAGESIEVE command received by server." first of all i would like to ask where the SASL capabilites come from, how can i get it to offer "PLAIN" or "AUTH" everything else (e.g. sieve itself) just works find Cheers Soeren

2 2

dovecot sasl with postfix, smtp auth not available
by Badli Al Rashid 24 Apr '23

24 Apr '23

Hi All, I have set up dovecot sasl with postfix. When I check the smtp with ehlo there is no auth advertise. Connected to www.zystro.xyz. Escape character is '^]'. 220 www.zystro.xyz ehlo x.zystro.xyz 250-www.zystro.xyz 250-PIPELINING 250-SIZE 10485760 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING I did a number of installations the auth was not shown. I have use debian distributed and also dovecot packages. Sasl. root@www:~# postconf -a cyrus dovecot root@www:~# postconf -A cyrus Dovecot version. root@www:~# dovecot --version 2.3.20 (80a5ac675d) Dovecot configuration. root@www:~# dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-21-amd64 x86_64 Debian 11.6 # Hostname: www.zystro.xyz auth_mechanisms = plain login debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = mbox:~/Mailbox namespace { inbox = yes location = prefix = separator = / } passdb { driver = pam } postmaster_address = postmaster(a)zystro.xyz protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { address = 127.0.0.1,::1 port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } ssl_cert = </etc/letsencrypt/live/www.zystro.xyz/fu llchain.pem ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } I have followed the guide at postfix and dovecot but still the auth did not appear. https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/ https://www.postfix.org/SASL_README.html Anybody got any ideas ? Regards, -badli

6 12

dovecot-fts-solr Solr9 support
by PGNet Dev 24 Apr '23

24 Apr '23

I run dovecot-2.3.18 , & am deploying Solr search with 'dovecot-fts-solr' I run Solr standalone. When creating a dedicated 'dovecot' core, cp'ing from Dovecot's included solr schemas ls -al /usr/share/doc/dovecot/solr-* -rw-r--r-- 1 root root 12K Dec 3 06:48 /usr/share/doc/dovecot/solr-config-7.7.0.xml -rw-r--r-- 1 root root 2.7K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema-7.7.0.xml -rw-r--r-- 1 root root 2.9K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema.xml is tested only for Solr 7.7.0 https://doc.dovecot.org/configuration_manual/fts/solr/ "The steps described in this page are tested for Solr 7.7.0. For other versions, this these steps may need to be adjusted." which, per solr docs https://solr.apache.org/downloads.html About versions and support Version Description 9.x Current major version for feature releases (STABLE) 8.11.x Previous major version may sometimes receive critical bugfix releases 10 Next major version, yet to be released (UNSTABLE) <8.11 All older versions are End Of Life (EOL) is EOL'd and unsupported. In the dovecot 7.7.0 schema, FastLRUCache/LRUCache are used as the caching class(es), grep class=.*LRU /usr/share/doc/dovecot/solr-config-7.7.0.xml <filterCache class="solr.FastLRUCache" <queryResultCache class="solr.LRUCache" <documentCache class="solr.LRUCache" class="solr.search.LRUCache" For Solr 9, cat CHANGES.txt Upgrade Notes --------------------- ... * SOLR-13817: Deprecate legacy SolrCache implementations. Users are encouraged to transition their configurations to use org.apache.solr.search.CaffeineCache instead. (ab) running solr9 + dovecot-fts-solr search, based on the 7.7.0 schemas, results in errors, failed scan & search. Modifying the config to use CaffeineCache cp solr-config-7.7.0.xml solr-config-9.0.0.xml perl -pi -e '\ s|solr.FastLRUCache|solr.CaffeineCache|g; \ s|solr.LRUCache|solr.CaffeineCache|g; \ s|solr.search.LRUCache|solr.search.CaffeineCache|g;' \ solr-config-9.0.0.xml appears to do the trick. Atm, indexing & search -- both manually triggered, and on delivery receipt to Dovecot store -- is working with no errors (yet). I've not tested exhaustively yet, & don't know if this Cache class change in the schema is both necessary & sufficient for dovecot-fts-solr search use with solr 9.0.0 Given that for Solr "<8.11 All older versions are End Of Life (EOL)" it'd be useful for Dovecot to 'retest' for current, not-EOL'd Solr, and publish/package compatible schemas accordingly.

5 8

Indexer opening emails in write mode ?
by Andre Rodier 23 Apr '23

23 Apr '23

Hi, I have dovecot indexer working inside AppArmor, and I am confused by some error messages: > name="/home/users/andre/mails/maildir/.Sent/cur/1682251668.M110083P109814.pigment,S=1743,W=1776:2,S" pid=111784 > comm="indexer-worker" requested_mask="wd" denied_mask="wd" fsuid=1001 ouid=1001 Why the indexer would open email files in write mode, please ? Thanks for your advice

1 0

sieve traces not logged
by Christian Weiske 23 Apr '23

23 Apr '23

Hello, Some sieve filters do not work as expected and I want to debug why. For that I configured in /etc/dovecot/conf.d/90-sieve.conf sieve_trace_dir = /var/log/dovecot/ sieve_trace_level = matching and created /var/log/dovecot/ and gave it the user+group "Debian-exim". Unfortunately, no logs are written into that direcory. The normal log file in /var/log/dovecot.log contains no information - except that lmtp stored the mail in mailbox "test". The docs[1] only say that those two options need to be enabled. Sieve itself works, which I confirmed by creating a rule that moves mails with subject "test" into a separate folder. What am I doing wrong? ---- $ dovecot --version 2.3.20 (80a5ac675d) Running on Debian 11, packages from https://repo.dovecot.org/ce-2.3-latest/debian/bullseye Full sieve config from "dovecot -n": plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /etc/dovecot/sieve-bin/ sieve_plugins = sieve_imapsieve sieve_extprograms sieve_trace_debug = no sieve_trace_dir = /var/log/dovecot-sieve sieve_trace_level = matching } [1] https://doc.dovecot.org/configuration_manual/sieve/configuration/#trace-deb… -- Regards/Mit freundlichen Grüßen Christian Weiske -=≡ Geeking around in the name of science since 1982 ≡=-

1 1

Blacklistd
by Doug Hardie 22 Apr '23

22 Apr '23

Are there any plans to interface to blacklistd? -- Doug

6 9

quotas and Trash
by David Koski 22 Apr '23

22 Apr '23

Hello, I am testing quotas with the following configuration: plugin { quota_rule = *:storage=1M quota_rule2 = INBOX.Trash:storage=+100M quota_grace = 10%% } The 1M limit works perfectly but I had to prefix Trash with "INBOX." to get it to stop complaining about an unknown namespace. But now the quota_rule2 is ignored. Once the mailbox reaches 1M, even if it is all in INBOX.Trash, it will fail to deliver due to quota limit. Dovecot: 2.3.13+dfsg1-2+deb11u1:amd64 Debian 11 auth_mechanisms = plain login disable_plaintext_auth = no mail_plugins = quota mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_plugins = quota quota quota = maildir:User quota quota_grace = 10%% quota_rule = *:storage=1M quota_rule2 = INBOX.Trash:storage=+100M } protocols = " imap pop3" service anvil { unix_listener anvil-auth-penalty { group = vmail mode = 0660 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { mode = 0660 } } service imap-login { inet_listener imap { address = 172.16.0.1 } } service pop3-login { inet_listener pop3 { address = 172.16.0.1 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = no ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota quota postmaster_address = dkoski(a)sutinen.com } protocol lda { mail_plugins = quota quota } protocol imap { mail_max_userip_connections = 14 mail_plugins = quota quota imap_quota } protocol pop3 { mail_plugins = quota quota } Regards, David Koski dkoski(a)sutinen.com

3 7

Message searching in Dovecot
by John Gateley 21 Apr '23

21 Apr '23

Hello, For mobile clients (gmail on Android), I need a server side searching solution. A few months ago, I tried getting Solr to work with Dovecot, but failed. The instructions here https://doc.dovecot.org/configuration_manual/fts/solr/ are quite out of date, they reference Debian 8 and 9 (current version 11), and Solr 7.7 (current version 9.2) My Solr experience is pretty much zero. Questions/Requests: * Is there a different tool than Solr I should be using for this? * Does anyone have a recent version of Solr and Debian working? * If you do, would you be willing to help me? * I cannot afford much, this is a home mailserver for my wife and I, but I could pay a small consulting fee. I use ansible to deploy the server, I'd be willing to contribute the playbooks somewhere for documentation, or help with the docs. Thanks! John

5 6

Re: Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

From headers: Received: from BL0GCC02FT014.eop-gcc02.prod.protection.outlook.com (2a01:111:f400:7d05::209) by CYXPR09CA0010.outlook.office365.com (2603:10b6:930:d4::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via Frontend Transport; Thu, 20 Apr 2023 11:49:06 +0000 Authentication-Results: spf=softfail (sender IP is 63.88.93.251) smtp.mailfrom=open-xchange.com; dkim=fail (signature did not verify) header.d=open-xchange.com;dmarc=fail action=oreject header.from=open-xchange.com;compauth=none reason=452 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning open-xchange.com discourages use of 63.88.93.251 as permitted sender) From: Aki Tuomi <aki.tuomi(a)open-xchange.com> Date: Thursday, April 20, 2023 at 07:49 Subject: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365 On 20/04/2023 14:18 EEST White, Daniel E. (GSFC-770.0)[AEGIS] via dovecot <dovecot(a)dovecot.org<mailto:dovecot@dovecot.org>> wrote: Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security. Um? Those already are added? Or what do you mean? Aki

3 2

Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security.

2 1

Request - extra variable in passdb for logging
by Bogusław Juza 20 Apr '23

20 Apr '23

Hi Staff, I'm creating the dovecot configuration for multiple user passwords e-mail site. It's working well, but I've one problem - I can't log, which password was used. I'm using auth-sql, the query looks like: password_query = \ SELECT `users`.`email` AS `user`, \ `shadow`.`passwd` AS `password`, \ FROM `shadow` WHERE `shadow`.`email` = '%u' AND \ ( ('%r'='127.0.0.1' AND `shadow`.`webmail`<>0) OR \ ('%r'<>'127.0.0.1' AND `shadow`.`imap`<>0 AND \ `shadow`.`hash`='%{sha512;rounds=5000:password}') \ ) LIMIT 1 The hash from random generated application password works as the selector, which password should be checked. It works fine, but in the log I have got only the e-mail and both IP addresses. I need to log one more information - which password was used (`shadow`.`id` column). It would be a great feature to have one more extra variable, which I could set in this query and which goes directly to log and nowhere else. I have tried something like: password_query = \ SELECT CONCAT(`users`.`email`,'#',`shadow`.`id`) AS `user`, ... and then "repair it" in user_query: SELECT `email` AS `user` WHERE `email` = REGEXP_SUBSTR('%u','[^#]+') and it even works well, except postfix-auth, which received email with #number as the username and it was problematic. So I'm kindly asking for this extra variable in next versions of Dovecot ;) Bogusław Juza

2 1

last_login plugin and $remote_ip
by Fabrizio Cuseo 19 Apr '23

19 Apr '23

Good morning. I am planning a dovecot system with: - 3 x glusterfs servers (with 2 volumes, 1 ssd for short term mail, and 1 with bigger hdd for long term archive mail) - 1 x mysql server (another server with active replica will be added) - 3 x mbox servers (with dovecot pop/imap/lmpt/sieve/postfix) - 3 x dovecot proxy/directors for pop3/imap/smtp - 4 x proxmox mail gateway for antispam/antivirus in front of smtp servers - 1 x centralized syslog server All have private ip addresses, and in front there is a firewall with HA_proxy to make high availability and load balancing. My only problem now is using last_login plugin; i have configured on the mailbox servers on pop3/imap, but the ip address that is written on mysql is the proxy/director address, not the real client ip address. No results using real_remote_ip. Apr 19 09:14:31 mailbox-01 dovecot: pop3-login: Login: user=<username(a)domain.it>, method=PLAIN, rip=172.16.27.31, lip=172.16.27.21, mpid=19723, session=<42nHLKv5JsqsEBsf> Apr 19 09:14:31 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Started proxying to 172.16.27.21 (1.978 secs): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> Apr 19 09:14:34 mailbox-01 dovecot: pop3(username(a)domain.it)<19723><42nHLKv5JsqsEBsf>: Disconnected: Logged out top=0/0, retr=0/0, del=0/37, size=115779706 Apr 19 09:14:34 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Disconnected by server (0s idle, in=45, out=82): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> in db I have last_ip: 172.16.27.31, not 212.66.96.188 ------------- dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-69-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mailbox-01 auth_default_realm = XXXXXXXX.it default_client_limit = 2500 dict { mysql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dict-sieve-sql.conf sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = tb-extra-mailbox-sep delay-newmail login_greeting = Welcome to mail server mail_fsync = always mail_gid = 89 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = quota mail_privileged_group = mail mail_uid = 89 mailbox_list_index_very_dirty_syncs = yes mdbox_rotate_size = 128 M mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms quota = count:User quota quota_clone_dict = proxy::mysql quota_grace = 50M quota_rule2 = Trash:storage=+100M quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = dict:proxy::sieve;name=active sieve_extensions = +vacation-seconds sieve_vacation_default_period = 7d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = " imap lmtp pop3" service dict { unix_listener dict { group = mail2023 mode = 0660 user = mail2023 } } service doveadm { inet_listener { port = 2425 } inet_listener http { port = 8080 } unix_listener doveadm-server { user = mail2023 } } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = mail2023 mode = 0666 user = mail2023 } } service pop3 { process_limit = 250 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = mail2023 } user = mail2023 } service stats { unix_listener stats-reader { group = mail2023 mode = 0660 user = mail2023 } unix_listener stats-writer { group = mail2023 mode = 0660 user = mail2023 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve quota quota_clone } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol lda { mail_plugins = quota sieve quota quota_clone } protocol imap { mail_max_userip_connections = 10 mail_plugins = quota quota imap_quota quota_clone last_login } protocol pop3 { mail_max_userip_connections = 2 mail_plugins = quota quota quota_clone last_login } in dovecot-dict-sql.conf.ext there is: map { pattern = shared/last-login/$service/$user/$remote_ip table = mail_last_login value_field = last_access value_type = uint fields { userid = $user service = $service last_ip = $remote_ip } } -- --- Fabrizio Cuseo - mailto:f.cuseo@panservice.it

2 2

Re: Mailing list update
by Peter Wienemann 19 Apr '23

19 Apr '23

Dear Aki, On 12.04.23 13:31, Aki Tuomi via dovecot wrote: > We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. thanks for this. > Please let us know if you have face any issues with the mailing list and we'll look into it. Is there a way to keep old links to archived messages (such as https://dovecot.org/pipermail/dovecot/<year>-<month>/<message-id>.html) intact? Best regards, Peter

3 3

Custom SASL authentication
by David Koski 19 Apr '23

19 Apr '23

Hello, I'm looking for a good way to apply a custom hash to passwords. My hope is to add passwords to a (MySQL) database: INSERT INTO users (user='joblo', pass=MYHASH('plain-password').. For SASL authentication, my thought first was to apply the same hash to the issued password and compare it with the hashed password in the database. I soon discovered the sql driver supplied by Dovecot doesn't provide that ability, unless I'm missing something. I'm looking for documentation on how to implement a custom authentication script if needed. Regards, David Koski dkoski(a)sutinen.com

4 6

imap Error: rename failed: Too many links
by Andrey Repin 18 Apr '23

18 Apr '23

Greetings, All! I'm facing a problem with one particular directory in a mailbox. The exact error line is: Apr 7 12:00:21 mxs dovecot: imap(vera): Error: rename(/home/vera/.mail/INBOX/Майя Николаевна/new/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST, /home/vera/.mail/INBOX/Майя Николаевна/cur/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST) failed: Too many links The rest of the mailbox behave correctly, as I can tell, but this specific subdir fails to report unread mail correctly. What are the options to fix it? # dovecot --version 2.2.22 (fe789d2) Config is in attachment, but I doubt it is of any interest. -- With best regards, Andrey Repin Friday, April 7, 2023 16:37:09 Sorry for my terrible english...

4 6

Maildir compression
by Jose David Bravo A 18 Apr '23

18 Apr '23

Hello, I would like to compress the maildir of some of our users, I'm thinking to use this script: [ https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… | https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… ] My question is, how dovecot will calculate the quota for that user after the compression? will dovecot calculate the quota of that user using the real size of the message file after compression, or the plain size before compression? Is it necessary to recreate the index of that maildir after the compression is made? If so, what command should I use? Thank you! Jose Bravo

2 1

Confusion re doveadm pw and protected private keys
by Paul Kroitor 18 Apr '23

18 Apr '23

Hello, It seems from this thread at letsencrypt : https://community.letsencrypt.org/t/changing-permissions-for-pem-files/19656 1 (see especially second post from _az) that doveadm pw now parses all files in the config, even ones not relevant to the pw aspect of the request. If it's not able to access all the files, it terminates prematurely with exit code 89. The result, at least for anyone using letsencrypt / certbot, is that doveadm pw fatally fails unless run as root, because the config includes the private key, which has permissions 600 root root. This makes the dovecot pw functionality unusable for web apps that want to calculate a password hash using it (e.g. RoundCube's password change feature). My understanding is that dovecot only really needs the private key for its main functionality, when it's running as root, and that there's no reason doveadm pw, which should (presumably) often be run as a regular user, needs access to it. Is this the intended behavior, or have I got something wrong? Thanks for all help, Paul

2 1

Shared / Public mailbox
by Stephane MAGNIER 15 Apr '23

15 Apr '23

Hi I wish to create a share mailbox ( well.. Apparently, this is a public mailbox). Let's say I have 2 users : user1 & user2 and the need to share a mailbox for "general inquiries" emails.. Despite of the 2 users' account creation ( user1 & user2) , should I create a third email account ( info1) for general inquiries for instance and instruct Dovecot that this mail box has to be shared ? In that case, logically, I have to declare into: "15-Mailboxes.conf" |namespace { type = public separator = / prefix = Public/ location = maildir:|||/var/spool2/mail|/info1/:CONTROL=/var/spool2/mail/Maildir/info1:INDEX=|||/var/spool2/mail|/info1 # Allow users to subscribe to the public folders. subscriptions = yes } | |and add a file : /etc/dovecot/dovecot-acl| || ||||/var/spool2/mail|/info1/| user=user1,user2 lrwstipekxa ||/var/spool2/mail|/info1|/* user=user1,user2 lrwstipekxa and add the plugin : plugin { acl = vfile }|| Is that the way to do it ? 2) Now what is the difference between a shared and Public mailbox ? I can see that the plugin is slightly different : |acl_shared_dict| <https://doc.dovecot.org/settings/plugin/acl-plugin/#plugin_setting-acl-acl_…> For me a "public"email folder is for sharing emails.. My understanding is: general email account can be shared ( like info1 in my example).. this is called a public mailbox.( specific email account, shared between users). So what is called a "Shared mailbox" ????? Thanks for your help ?

4 5

Mailing list update
by Aki Tuomi 13 Apr '23

13 Apr '23

Hi all! We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. Please let us know if you have face any issues with the mailing list and we'll look into it. Regards, Aki Tuomi Open-Xchange oy

4 9

Mailing list changes.
by dovecot＠ptld.com 13 Apr '23

13 Apr '23

I noticed starting today the Sender: header is no longer included on the mailing list. I used to use the Sender: header in sieve rules for sorting. Now the list emails only come From: rando email addresses. On the postfix mailing list it replaces the From: header with the list address instead of keeping the original email author. Is this the future intended behavior? Or can we get a Sender: or From: header to contain the list address for sorting?

3 3

Dovecot restoration.... problem
by Stephane Magnier 13 Apr '23

13 Apr '23

Hi, In the past, I've done a Dovecot Backup with a Rsync cmd... every day Today I need to get back these mailboxes.. and doesn't work out 1) first of all, I tried to make a simple copy... Now way . Couldn't access the INBOX Do you think that it could work that way ? I don't need to synchronized every minute. once a day is OK for me. 2) I did use the instruction doveadm --import -u user1 maildir:/home/user1/mail/ "" ALL It did start copying but apparently cannot got until the end... but noting visible onto Thunderbird... I didn't do any synchro between 2 dovecot servers. I just need to make a copy some times to times and rsync seemed to be a good option. But now, How can I get back online ??? Thanks

2 1

decrypt.rb
by Dave 11 Apr '23

11 Apr '23

Per the Dovecot site here: https://wiki.dovecot.org/Plugins/MailCrypt ... the "decrypt.rb" ruby script can be used to decrypt a Dovecot-encrypted message file from the command line. The script sort of runs successfully for me, in the sense that it doesn't error out, but it doesn't show the decrypted message. I've called it like so: decrypt.rb -k <PATH_TO_DOVECOT_KEYFILE> -f ./encrypted_message But when I do it just displays the info below and exits (I've subbed <DATA> tags for the actual data): ------------------[OUTPUT]----------------------- Key(s) (total: 1) - Key type : EC - Key digest: <DATA1> - Peer key : <DATA2> - Encrypted : <DATA3> - Kd hash : <DATA4> ------------------------------------------------------- I've tried specifying an output file as well, per the script's command line options, but the output file is 0 bytes. Does anyone have any suggestions? I *think* I'm using it the way it's intended to be used, but maybe I'm not?! -Dave

5 14

None
by None 11 Apr '23

11 Apr '23

... - maildir: change it to use '/' as hierarchy separator to allow '.' characters (for usernames in shared folders) ... Now changing the separator in the maildir-storage.c is trivial (even though it "can't" be changed :-), but fixing the resultant breakage in maildir-list.c needs a little more understanding. Timo, could you give me some pointers? I can see that I need to work out what imap_match_init() does. My motivation is to follow up on an earlier thread about reusing .mailboxlist files as .subscription files, preferably without rewriting them to replace the slashes with something else. Thanks -- Charlie

1 0

None
by None 11 Apr '23

11 Apr '23

checking IMAP connection. Based on that experimentation, it seems that when I try to verify certificate files with openssl, all checks out, but when I try to check thing through IMAPS, things go ugly (see log below). If I try same openssl s_client command on my web server, it gets everything correctly. As result from this one, I've even tried to use certificate from my web server with IMAP and even then openssl keeps on saying that there is bad record mac. Is this bug in dovecot's SSL handling or have I managed to mess something in my setup? URLS: CA cert: http://jylitalo.homeip.net/ca/ca.crt IMAPD cert: http://jylitalo.homeip.net/ca/imapd.crt [log starts] bash-2.05a$ openssl verify -CAfile /usr/local/www/data/ca/ca.crt /etc/ssl/certs/imapd.crt /etc/ssl/certs/imapd.crt: OK bash-2.05a$ openssl s_client -host localhost -port 993 -CAfile /usr/local/www/data/ca/ca.crt -verify -debug verify depth is 0 CONNECTED(00000003) depth=1 /C=FI/ST=Finland/L=Helsinki/O=Juha Ylitalo/CN=Juha Ylitalo/Email=jylitalo(a)iki.fi verify return:1 depth=0 /C=FI/ST=Finland/O=Juha Ylitalo/CN=coat.st-paul/Email=jylitalo(a)iki.fi verify return:1 47169:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s3_pkt.c:1046:SSL alert number 20 47169:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s23_lib.c:226: bash-2.05a$ [log ends] -- Juha Ylitalo juha.o.ylitalo(a)nokia.com <work e-mail> +358 40 562 6152 http://linux.nokia.com/~jylitalo/ <work www>

1 0

None
by None 11 Apr '23

11 Apr '23

while (rename(src, dest) < 0 && count < 2) { if (errno != EEXIST) { rename can never return EEXIST in errno. maildir-save.c, line 124. /* move the file into new/ directory - syncing will pick it up from there */ if (rename(tmp_path, new_path) == 0) failed = FALSE; Here you can lose emails if the new/ folder contains a message whose base name is equal. The only way to avoid this is: 1) use link and unlink, not rename 2) leave messages that have a time_t part equal to or higher than time(NULL). Anyway, Maildir has a strict consistency criteria which says that all messages that are linked from tmp/ into new/ _must_ use time(NULL) plus a number that is guaranteed not to lapse within one second, and which does not collide with other messages in new/. new/ is the single entry point into cur/, and messages in new/ can not be "older" than the messages in cur/. The simple reasoning for this is that you can never guarantee that there is no message in cur/ that has the same base name, but perhaps different flags. It follows that when moving a message from new/ to cur/, it is required that the server only picks messages that are older than one second. Andy -- Andreas Aardal Hanssen http://www.andreas.hanssen.name/gpg

1 0

auth-worker fatal signal 11 core dump
by Anthony Carrico 07 Apr '23

07 Apr '23

I'm testing out dovecot/tls/openldap(via portunus). It seems to work fine. I can access Maildir with Thunderbird as expected. However according to the logs, auth-worker crashes when slapd closes: Apr 04 22:11:56 silver slapd[1745983]: conn=1054 op=1 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1054 fd=14 closed Apr 04 22:11:56 silver slapd[1745983]: conn=1053 op=2 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1053 fd=13 closed Apr 04 22:11:56 silver dovecot[2083465]: auth-worker: Fatal: master: service(auth-worker): child 2084984 killed with signal 11 (core dumped) Apr 04 22:11:56 silver dovecot[2083465]: auth: Fatal: master: service(auth): child 2084981 killed with signal 11 (core dumped) Here is the configuration. It is a minimal setup, just testing ldap for passdb: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 6.1.7 x86_64 NixOS 22.11 (Raccoon) btrfs # Hostname: silver auth_mechanisms = plain login base_dir = /run/dovecot2 default_internal_group = dovecot2 default_internal_user = dovecot2 mail_location = maildir:/home/%n/Maildir:INBOX=/var/spool/mail/%n:INDEX=/var/lib/dovecot/indexes/%n:LAYOUT=Maildir++ passdb { args = /var/lib/dovecot/etc/dovecot-ldap.conf.ext driver = ldap } pop3_uidl_format = %08Xv%08Xu protocols = imap sendmail_path = /run/wrappers/bin/sendmail service auth { user = root } ssl_ca = </var/certs/.minica/cert.pem ssl_cert = </var/certs/silver/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Here is the ldap config: uris = ldaps://silver tls_ca_cert_file = "/var/certs/.minica/cert.pem" auth_bind = yes auth_bind_userdn = uid=%u,ou=users,dc=silver base = dc=silver Here is the stack trace: PID: 2084981 (auth) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Tue 2023-04-04 22:11:56 EDT (11h ago) Command Line: dovecot/auth Executable: /nix/store/s72dc8pc6g70dscya8ggsvn61rnfhixy-dovecot-2.3.19.1/libexec/dovecot/auth Control Group: /system.slice/dovecot2.service Unit: dovecot2.service Slice: system.slice Hostname: silver Storage: /var/lib/systemd/coredump/core.auth.0.9fed479ad6ac4f0e8c2d5f290d9ea3f5.2084981.1680660716000000.zst (present) Disk Size: 324.7K Message: Process 2084981 (auth) of user 0 dumped core. Module linux-vdso.so.1 with build-id 7aefd45ed44b5302cf82d7b5093cd9b882b8bc8a Module legacy.so with build-id fdd26faf7ff15c8fa78ef2091d38c5fb886da146 Module libscram.so.3 without build-id. Module libdb-5.3.so without build-id. Module libsasldb.so.3 without build-id. Module libplain.so.3 without build-id. Module libotp.so.3 without build-id. Module liblogin.so.3 without build-id. Module libgssapiv2.so.3 without build-id. Module libkeyutils.so.1 without build-id. Module libkrb5support.so.0 without build-id. Module libcom_err.so.3 without build-id. Module libk5crypto.so.3 without build-id. Module libkrb5.so.3 without build-id. Module libgssapi_krb5.so.2 without build-id. Module libgs2.so.3 without build-id. Module libdigestmd5.so.3 without build-id. Module libcrammd5.so.3 without build-id. Module libanonymous.so.3 without build-id. Module libresolv.so.2 with build-id 6bcddb1dd1be5b345df903815f364e5d967ae0ef Module libdl.so.2 with build-id 2e86539e324ffb14e185718fd284d3f3f2568f06 Module libm.so.6 with build-id 5cc630080219b350d8f9e4573c65d2dd931ea978 Module libz.so.1 without build-id. Module ld-linux-x86-64.so.2 with build-id 3be2bc3749163683f612e0fb8169ce51f75742fe Module libcrypto.so.3 with build-id ca321413716a256baa08042cb3f3c07a90cc82ce Module libssl.so.3 with build-id 4bf2aae91a0d91b0ca0a6fe1ab29b2b7653a17f6 Module libsasl2.so.3 without build-id. Module libaudit.so.1 without build-id. Module libc.so.6 with build-id 3d6884d200ead572b7b89a4133f645c7a3c039ed Module libpthread.so.0 with build-id 0f7050f6ef81222c7290351dfa67e5e062c797bf Module libsqlite3.so.0 with build-id 174a69054606e27a1c555838b07035346e83bfb0 Module libsodium.so.23 with build-id 1c1e5b232aa14bf5c942b3568bf70713da9ad11f Module liblber.so.2 without build-id. Module libldap.so.2 without build-id. Module libpam.so.0 without build-id. Module libcrypt.so.1 without build-id. Module libdovecot.so.0 without build-id. Module libstats_auth.so without build-id. Module auth without build-id. Stack trace of thread 2084981: #0 0x00007f824e28e824 pthread_rwlock_rdlock(a)GLIBC_2.2.5 (libc.so.6 + 0x8e824) #1 0x00007f824de312d9 CRYPTO_THREAD_read_lock (libcrypto.so.3 + 0x2312d9) #2 0x00007f824de1ea57 ossl_lib_ctx_get_data (libcrypto.so.3 + 0x21ea57) #3 0x00007f824de2d460 ossl_provider_deregister_child_cb (libcrypto.so.3 + 0x22d460) #4 0x00007f824de1e960 OSSL_LIB_CTX_free (libcrypto.so.3 + 0x21e960) #5 0x00007f824d8d4801 legacy_teardown (legacy.so + 0x7801) #6 0x00007f824de2ebfd ossl_provider_free (libcrypto.so.3 + 0x22ebfd) #7 0x00007f824ddf535b evp_cipher_free_int (libcrypto.so.3 + 0x1f535b) #8 0x00007f824e4cd46c SSL_CTX_free (libssl.so.3 + 0x3d46c) #9 0x00007f824e7852f5 ldap_int_tls_destroy (libldap.so.2 + 0x3d2f5) #10 0x00007f824e9ddbde _dl_fini (ld-linux-x86-64.so.2 + 0x5bde) #11 0x00007f824e2400c5 __run_exit_handlers (libc.so.6 + 0x400c5) #12 0x00007f824e24024e exit (libc.so.6 + 0x4024e) #13 0x00007f824e229255 __libc_start_call_main (libc.so.6 + 0x29255) #14 0x00007f824e229309 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29309) #15 0x000055b07d5c7675 _start (auth + 0x18675) ELF object binary architecture: AMD x86-64 As you can see, it seems to be crashing in the exit-handlers. Anyway, I thought I should report the crash I was observing. Thank you -- Anthony Carrico

2 4

Error: /proc/self/status is larger than expected
by Elisamuel Resto Donate 06 Apr '23

06 Apr '23

Hello, Writing to get some insight as to how I might rid myself of a the pesky error message on the subject. Every binary throws out that error, every LMTP delivery... basically every time any dovecot binary is executed. I am unsure if this is configuration related or not, but intuition says it is an issue with a kernel feature or compiler issue. I saw the error message in the source code (file ), but I don't understand enough of the dovecot architecture or what the code itself is doing in this case. Below and excerpt of a few lines of logs. Since I don't know what specifically this would relate to (and I don't quite remember the command to send the "safe" version of the configuration), I am sending this message in hopes that whatever is needed can be asked and I will provide it. Regards, -Sam [... postfix and rspamd output...] Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: from=<list(a)someml.tld>, size=12064, nrcpt=1 (queue active) Mar 20 22:17:02 gaia postfix/smtpd[18941]: disconnect from some.list.server[1.2.3.4] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: lmtp(18954): Connect from local Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: message repeated 2 times: [ lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected] Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: sieve: msgid=<84cf4a75-db54-f33c-cea2-f4772cd182d8(a)samresto.dev>: fileinto action: stored mail into mailbox 'Lists/Folder' Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: indexer-worker(sam(a)samresto.dev)<18956><vbRKLa4hGWQKSgAAw1YR2w:RtkiMa4hGWQMSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/lmtp[18943]: 4PgcGQ33LfzdT4h: to=<sam(a)samresto.dev>, relay=wyvern.samresto.dev[private/dovecot-lmtp], delay=0.4, delays=0.31/0/0.01/0.07, dsn=2.0.0, status=sent (250 2.0.0 <sam(a)samresto.dev> vbRKLa4hGWQKSgAAw1YR2w Saved) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Disconnect from local: Logged out (state=READY) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: removed

6 11

Email not working
by Michael Hooker 05 Apr '23

05 Apr '23

Hi, First of all may I say I am not an expert on Dovecot so please forgive me if the answer to my query is obvious. After upgrading from Ubuntu 20.04 to 22.04 my email is not working. root@mail:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-60-generic x86_64 Ubuntu 22.04.1 LTS # Hostname: mail.odysseytours.nz auth_debug = yes auth_mechanisms = plain login auth_username_format = %{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} listen = *, :: mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } root@mail:~# doveadm user -f 'username' '*' nobody mike systemd-coredump sogo vmail mlmmj iredadmin iredapd snapd-range-524288-root snap_daemon Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed root@mail:~# doveadm index -A -q \* doveadm(nobody): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=65534(nobody) egid=65534(nogroup)) doveadm(systemd-coredump): Error: mkdir(//mail/.imap) failed: Permission denied (euid=999(systemd-coredump) egid=999(systemd-coredump) missing +w perm: /, dir owned by 0:0 mode=0755) doveadm(snapd-range-524288-root): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=524288(snapd-range-524288-root) egid=524288(snapd-range-524288-root)) doveadm(snap_daemon): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=584788(snap_daemon) egid=584788(snap_daemon)) doveadm(3015804): Error: auth-master: userdb list: User listing returned failure doveadm: Error: Failed to iterate through some use Contents of /etc/dovecot/conf.d/10-auth.conf with all comments removed: auth_username_format=%{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} #https://serverfault.com/questions/260488/dovecot-user-lookup-fails-when-using-usernamedomain-format auth_mechanisms = plain login !include auth-system.conf.ext Contents of /etc/dovecot/conf.d/auth-system.conf.ext with all comments removed: passdb { driver = pam } userdb { driver = passwd ##https://doc.dovecot.org/configuration_manual/authentication/passwd/#authentication-passwd args = blocking=no } It says "Authentication failure (Password mismatch?)" but its definitely the correct password. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address Don't know what this error means. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address family not supported by protocol Don't know what this error means. Any help would be greatly appreciated.

2 1

Wildcard delivery from Postfix to Dovecot LDA issues
by EML 01 Apr '23

01 Apr '23

[apologies for postfix/dovecot cross-post] How, exactly, do postfix and dovecot communicate when postfix attempts to determine whether to deliver a message to the dovecot LDA, or to bounce it? In other words, how does postfix decide to bounce foo, and deliver bar, in these log messages: postfix/pipe[11857]: 933BCA071A: to=<foo(a)example.com>, relay=dovecot, ... status=bounced (user unknown) postfix/pipe[12266]: 8AD51A071A: to=<bar(a)example.com>, relay=dovecot, ... status=sent (delivered via dovecot service) The reason I ask is that the obvious answer with the main.cf setup doesn't appear to be sufficient, and dovecot appears to check whether or not the recipient exists in the userdb passwd file before allowing delivery. I have postfix set up for virtual hosts, as follows: virtual_mailbox_domains = example.com, sub.example.com virtual_mailbox_maps = hash:/var/www1/vdomains virtual_transport = dovecot where vdomains contains: bar(a)sub.example.com example.com/test/ bar(a)example.com example.com/test/ @sub.example.com example.com/test/ @example.com example.com/test/ postfix will deliver to bar(a)example.com, but not foo(a)example.com. I can't deliver anything to the subdomain. The interesting thing is that 'bar' already has a dovecot mailbox (the 'test' mailbox), but 'foo' doesn't. If this is correct, how do I do wildcard deliveries to dovecot, particularly for the subdomain?

2 2

Dovecot error invalid service_fd
by Michel Verdier 30 Mar '23

30 Mar '23

Hi all On debian stable, dovecot 2.3.13+dfsg1-2+deb11u1 and postfix 3.5.17-0+deb11u1 I set postfix sending mails to dovecot for mailbox storage: mailbox_transport = lmtp:unix:private/dovecot-lmtp dovecot listen with lmtp: service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0666 user = postfix group = postfix } } passdb { driver = pam args = session=yes cache_key=%u%r%l dovecot } userdb { driver = passwd } # ls -l /var/spool/postfix/private/dovecot-lmtp srw-rw-rw- 1 postfix postfix 0 27 mars 11:24 /var/spool/postfix/private/dovecot-lmtp I get logs like this: postfix/lmtp[271076]: 6DB551008B3C1: to=..., relay=...[private/dovecot-lmtp], delay=0.7, delays=0.29/0.04/0.11/0.26, dsn=2.0.0, status=sent (250 2.0.0 ... postfix/qmgr[197419]: 6DB551008B3C1: removed dovecot: lmtp(271077): Disconnect from local: Client has quit the connection (state=READY) dovecot: log(253615): Error: Received master input for invalid service_fd 27: 27 271079 BYE I identify 271079 as the pid for dovecot auth worker process. If I add a timeout in dovecot: service auth-worker { idle_kill = 10s } Then I see error log coming 10 seconds after the end of every lmtp connexion from postfix. There is no other log messages around even with debug enable in dovecot. And mails are correctly delivered. Am I missing something or is this to be ignored? Cheers

1 0

Dovecot submission proxy constraints
by Peter Wienemann 29 Mar '23

29 Mar '23

Dear Dovecot experts, in 2017 Stephan Bosch mentioned in an email about the Dovecot submission proxy [0]: "The current implementation does require that the proxy has direct access to the user's mailbox for BURL (e.g. by running it on the same host as imap), but that restriction should be resolved soon, allowing for more complex setups." Is the mentioned restriction (access to mailbox) still valid in 2023 or has this constraint been lifted in the meantime? Best regards, Peter [0] https://dovecot.org/pipermail/dovecot/2017-December/110282.html

1 0

How to use dovecot with more recent versions of solr (8x, 9x)?
by jkdv＠w3.org 27 Mar '23

27 Mar '23

Hello, dovecot version 2.3.13 (89f716dc2) The dovecot solr installation guide [1] gives links and configuration info for sorl 7.7.0. However, sorl was deprecated some time ago. Those links to 7.7.0 don't work anymore. Sorl is currently available in versions 8.11.2 and 9.1.1 [3]. Specifically, one section in the guide states [2]: [[ Install schema.xml and solrconfig.xml Copy doc/solr-config-7.7.0.xml and doc/solr-schema-7.7.0.xml (Since Dovecot 2.3.6+) to /var/solr/data/dovecot/conf/ as solrconfig.xml and schema.xml. The managed-schema file is generated based on schema.xml. ]] Could someone confirm me if those 7.7.0 configuration files are compatible with 8.11.2? A diff between those files and the ones from the 8.11.2 dist reveal some changes, starting from the LuceneVersion. If they are not compatible, could someone tell me what changes were done in the doc/solr files that need to be replicated in the 8.x and 9.x versions? The doc is very opaque there as it only states that you should replace those files but doesn't go into details as to why, making it confusing on how to upgrade to a new version of solr. It would be great if the dovecot/solr doc page could be upgraded to reflect the new versions of solr. Thanks in advance for your help, --jose [1] https://doc.dovecot.org/configuration_manual/fts/solr/ [2] https://doc.dovecot.org/configuration_manual/fts/solr/#solr-configuration [3] https://downloads.apache.org/lucene/solr/

2 1

doveadm expunge unnecessarily tries to access TLS key
by Jesper Dybdal 27 Mar '23

27 Mar '23

I have just upgraded my Debian Buster (Dovecot 2.3.4, I think it was) to Bullseye (Dovecot 2.3.13). The Dovecot server works fine, which of course is the really important thing. But I have a cron job that cleans up all old mail from the mailbox that I use for my mobile phone by running "doveadm expunge" every night. That worked fine in 2.3.4, but now it fails: > jdmobile@nuser:~$ doveadm expunge mailbox '*' before 25d > doveconf: Fatal: Error in configuration file > /etc/dovecot/conf.d/10-ssl.conf line 23: ssl_cert: Can't open file > /etc/letsencrypt/live/nuser.dybdal.dk/fullchain.pem: Permission denied Of course, doveadm cannot access the TLS key when running as a normal user. But why should it try to access that key at all when I have just asked it to clean up my own files in my own Maildir? Is there a way to make it not try to access that key and do its job anyway? Or another way to delete old mail? (I could give it a "-u jdmobile" option and run it as root - but I really like to run things like that as a non-privileged user, so I won't make a stupid mistake that destroys the wrong mailbox.) Thanks, Jesper -- Jesper Dybdal https://www.dybdal.dk

2 2

Dovecot LTO build failure
by Arjen de Korte 26 Mar '23

26 Mar '23

In openSUSE Tumbleweed (and several other distributions as well), packages are build by default with linktime optimization (LTO) enabled. This didn´t work for Dovecot, so until now LTO was disabled for Dovecot. There is a way to make it work though, see the following link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=997513#20 So far a fix has not made it to upstream, the latest version 2.3.30 still fails to build without this patch. Is there any news to report regarding this?

2 1

Re: User authentication using local file
by Horst Simon 23 Mar '23

23 Mar '23

OS environment: Linux qnap-nas 5.10.60-qnap #1 SMP Thu Jan 12 04:39:10 CST 2023 x86_64 GNU/Linux I enabled "auth-passwdfile.conf.ext” in 10-auth.conf #!include auth-deny.conf.ext #!include auth-master.conf.ext #!include auth-system.conf.ext #!include auth-sql.conf.ext #!include auth-ldap.conf.ext !include auth-passwdfile.conf.ext #!include auth-checkpassword.conf.ext #!include auth-static.conf.ext In this file I have following entries and I don’t know what to enter for userdb passdb { driver = passwd-file args = /opt/local/etc/dovecot/users } userdb { driver = passwd-file #args = username_format=%u /opt/local/etc/dovecot/users # Default fields that can be overridden by passwd-file #default_fields = quota_rule=*:storage=1G # Override fields from passwd-file #override_fields = home=/home/virtual/%u } In the users file I have 2 users defined as follow: user1:{SSHA512}<encrypted password>:::::: user2:{SSHA512}<encrypted password:::::: Dovecot gives following error message on startup: Mar 23 08:50:30 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, lmtp, sieve (core dumps disabled) Mar 23 08:50:30 auth: Debug: Loading modules from directory: /opt/local/lib/dovecot/auth Mar 23 08:50:30 auth: Debug: Module loaded: /opt/local/lib/dovecot/auth/lib20_auth_var_expand_crypt.so Mar 23 08:50:30 auth: Fatal: userdb passwd-file: Missing args I don’t know what arguments I have to enter for userdb Horst > On 22 Mar 2023, at 23:00, Narcis Garcia > > Please, specify OS environment, Dovecot version, and what options did > you try. > > > El 22/3/23 a les 4:52, Horst Simon ha escrit: >> I try to configure to have user authenticate to a local file called >> users, with their mailboxes in ../../spool/dovecot, not in their home >> directories. I have this working correctly with pam authentication on >> different servers(openSuse and macOS). This server has no pam >> authentication so I need to use a local file, but I can not make any >> sense of the documentation, can someone please help on which files I >> need to change and to which values. >> I tried several options but getting all kind of errors with UID. >> >> Horst >> > > -- > > Narcis Garcia > > __________ > I'm using this dedicated address because personal addresses aren't > masked enough at this mail public archive. Public archive administrator > should fix this against automated addresses collectors. > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > dovecot mailing list > dovecot(a)dovecot.org > https://dovecot.org/mailman/listinfo/dovecot > > > ------------------------------ > > End of dovecot Digest, Vol 239, Issue 36 > ****************************************

2 4

User authentication using local file
by Horst Simon 22 Mar '23

22 Mar '23

I try to configure to have user authenticate to a local file called users, with their mailboxes in ../../spool/dovecot, not in their home directories. I have this working correctly with pam authentication on different servers(openSuse and macOS). This server has no pam authentication so I need to use a local file, but I can not make any sense of the documentation, can someone please help on which files I need to change and to which values. I tried several options but getting all kind of errors with UID. Horst

2 1

Re: Error: Can't load SSL certificate
by Horst Simon 22 Mar '23

22 Mar '23

The others are on openSUSE 15.4 and macOS, all are binary installs Entware build options Build options: ioloop=epoll openssl io_block_size=8192 SQL drivers: mysql Passdb: checkpassword ldap passwd passwd-file shadow sql Userdb: checkpassword ldap passwd prefetch passwd-file sql macOS build options Build options: ioloop=kqueue notify=kqueue openssl io_block_size=8192 SQL drivers: mysql Passdb: checkpassword pam passwd passwd-file sql Userdb: checkpassword passwd prefetch passwd-file sql openSUSE build options Build options: ioloop=epoll notify=inotify openssl io_block_size=8192 SQL driver plugins: mysql postgresql sqlite Passdb: checkpassword ldap pam passwd passwd-file shadow sql Userdb: checkpassword ldap(plugin) passwd prefetch passwd-file sql The libz.so are for OpenSUSE and the QNap in the same directories withe the same permissions The macOS does not have a libz.so, this dovecot was build by macports. All servers are running dovecot with the same user accounts. At the moment I will look into this issue later and will try to authenticate without using SSL. On the MACs and openSUSE I authenticate using pam, the QNAP does not use pam so I want to authenticate using a local password file, but I have problems to set it up correctly I have changed it 10-auth.conf to use auth-passwdfile.conf.ext and created a password file called userdb. I don’t know what else to change and what exactly should be in the userdb file. The log only shows Mar 20 23:52:45 auth: Debug: auth client connected (pid=6966) Mar 20 23:52:45 imap-login: Info: Disconnected: Aborted login by logging out (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<AhJNZ1T3GcDAqHUF> I need to fix this first before I can enable SSL again. Maybe I should open a new threat Horst > > My suggests to look for: > > 1. Are your other servers setups installed from "Entware for QNAP" too? > 2. Do your other servers have libz.so* located under /opt/lib/ too? > 3. Did you compare owner and permissions of every libz.so* file between > servers too? > 4. Are other servers running Dovecot with same user account? > > > El 20/3/23 a les 4:01, Horst Simon ha escrit: >> I try to logon to map using dovecot with SSL required. I get following >> entries in the log:Mar 20 13:49:30 auth: Debug: Loading modules from >> directory: /opt/lib/dovecot/modules/auth >> Mar 20 13:49:30 auth: Debug: Module loaded: >> /opt/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so >> Mar 20 13:49:30 auth: Debug: Read auth token secret from >> /opt/var/run/dovecot/auth-token-secret.dat >> Mar 20 13:49:30 auth: Debug: passwd-file /opt/etc/dovecot/userdb:Read 1 >> users in 0 secs >> Mar 20 13:49:30 auth: Debug: auth client connected (pid=26120) >> Mar 20 13:49:30 imap-login: Error: Failed to initialize SSL server >> context: Can't load SSL certificate (ssl_cert setting): >> error:12800067:DSO support routines::could not load the shared library: >> filename(libz.so): libz.so: cannot open shared object file: No such file >> or directory, error:12800067:DSO support routines::could not load the >> shared library: user=<>, rip=192.168.117.5, lip=192.168.117.2, >> session=<eX3e+Uv3k8DAqHUF> >> Mar 20 13:49:30 imap-login: Info: Disconnected: TLS initialization >> failed. (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, >> lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF >> >> The library files exist in the include directory >> [/opt] # find . -name libz* -print >> >> ./lib/opkg/info/libzstd.control >> >> ./lib/opkg/info/libzstd.list >> >> ./lib/libz.so >> >> ./lib/libz.so.1 >> >> ./lib/libz.so.1.2.13 >> >> ./lib/libzstd.so >> >> ./lib/libzstd.so.1 >> >> ./lib/libzstd.so.1.5.2 >> >> ./lib/libz.a >> >> >> Have the dovecot settings the same on other servers and it works, >> Dovecot is v2.3.18, installed from Entware for QNAP. Any help?appreciated. >> >> Horst >> >> >> > > -- > > Narcis Garcia >

1 1

ot: how to t/s TBird problems ?
by Voytek Eymont 22 Mar '23

22 Mar '23

I have a Dovecot/Postfix/MariaDB on a Centos, just have a user ask me: ------------------ I recently upgraded my Thunderbird email client and have experienced problems since. It appears that when Tbird polls for new messages it gets held up waiting for a response from the server I'm using POP port 995. Any ideas as to why I'm having a problem ? ------------------- how to investigate such issue ? CentOS release 6.10 (Final) # dovecot --version 2.3.11.3 (502c39af9) load average on server 0.05/0.01 user log shows like: Oct 12 10:08:50 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17371, TLS, session=<E83xW8rqDPkxw3EW> Oct 12 10:09:34 pop3(user(a)tld.com.au)<17371><E83xW8rqDPkxw3EW>: Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/114194, size=10616009472 Oct 12 10:14:36 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17460, TLS, session=<ftiLcMrqR/gxw3EW> Oct 12 10:14:37 imap(user(a)tld.com.au)<17460><ftiLcMrqR/gxw3EW>: Info: Logged out in=152 out=69724 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=68628 Oct 12 10:28:27 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17714, TLS, session=<+WsXosrqK/gxw3EW> Oct 12 10:29:16 pop3(user(a)tld.com.au)<17714><+WsXosrqK/gxw3EW>: Info: Disconnected: Logged out top=0/0, retr=1/76174, del=0/114195, size=10616085600 Oct 12 10:32:19 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=17817, TLS, session=<bZftr8rqq/gxw3EW> Oct 12 10:32:20 imap(user(a)tld.com.au)<17817><bZftr8rqq/gxw3EW>: Info: Logged out in=153 out=135592 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=134503 Oct 12 10:45:58 imap-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=18081, TLS, session=<U3674Mrqzfgxw3EW> Oct 12 10:45:59 imap(user(a)tld.com.au)<18081><U3674Mrqzfgxw3EW>: Info: Logged out in=152 out=24602 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=23514 Oct 12 10:48:49 pop3-login: Info: Login: user=<user(a)tld.com.au>, method=PLAIN, rip=49.111.222.333, lip=103.xxx.yyy.zzz, mpid=18135, TLS, session=<y1/r6srqtPsxw3EW> Oct 12 10:49:53 pop3(user(a)tld.com.au)<18135><y1/r6srqtPsxw3EW>: Info: Disconnected: Logged out top=0/0, retr=2/166190, del=0/114197, size=10616251743 Oct 12 10:50:42 imap(user(a)tld.com.au)<3274><cr10yqTqifgxw3EW>: Info: Logged out in=192516 out=5957294 deleted=0 expunged=0 trashed=0 hdr_count=263 hdr_bytes=358656 body_count=126 body_bytes=5110403 Oct 12 10:50:42 imap(user(a)tld.com.au)<3271><hLl0yqTqh/gxw3EW>: Info: Logged out in=78324 out=58677 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Voytek

4 3

iPhone Mail clients generate high Solr I/O
by Alessio Cecchi 22 Mar '23

22 Mar '23

Hi, I'm running a mail server with Dovecot 2.3.20 and Apache Solr as FTS backend. It seems that iPhone/iPad Mail clients are generating some IMAP searches, especially on header Message-ID, that are increasing our Solr I/O load, especially during the night. Are these kind of queries normal? What are they? You can find some logs below. Dovecot logs: Mar 13 21:06:14 dovecot: imap-login: Login: user=<user@domain>, method=PLAIN, rip=x.x.x.x, lip=z.z.z.z, mpid=11263, secured, session=<PQSppM32gePCBJGh> Mar 13 21:06:14 dovecot: imap(user@domain) session=<PQSppM32gePCBJGh>: ID sent: name=iPhone Mail, version=20D67, os=iOS, os-version=16.3.1 (20D67) Mar 13 21:06:14 dovecot: imap(user@domain) session=<PQSppM32gePCBJGh>: Disconnected: Logged out in=207 out=1128 deleted=0 expunged=0 autoexpunged=0 trashed=0 appended=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Solr logs: 2023-03-13 21:06:14.411 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<DB8P189MB08692AE65580C36C3B7D6F53C1F59(a)domain6.tld>+OR+hdr:<\!\%26\!AAAAAAAAAAAYAAAAAAAAAI\/Oo\%2BConZZMkCvmEY7yWqjCgAAAEAAAAP968Yud4n1LmhwJxWgTURQBAAAAAA%3D%3D(a)domain5.tld>+OR+hdr:<CALEb\-gfyeQ1zJhjGKS3V8Rn3gk3byNa9co9nOU1L2BtUtKO0aw(a)domain7.tld>+OR+hdr:<AS4P195MB1790AA65F5F367F3CF0888BEDEA19(a)domain5.tld>+OR+hdr:<24E36A6E5BB2410C8090482B3E1EB40F(a)domain8.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=275 2023-03-13 21:06:14.511 INFO (qtp1671846437-1628) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<af03d59c\-2cd5\-1165\-aea5\-6ce7cfe16a89(a)domain.tld>+OR+hdr:<CAJbcrLvxCOGy6fcKBuhuu9B1SALwm9opS\-\-O\-kcMd3nevKrf1A(a)domain7.tld>+OR+hdr:<00eb01d8c8dc$caa8a580$5ff9f080$(a)domain1.tld>+OR+hdr:<VE1PR08MB4846DD525845DC743D47ED52EEBA9(a)domain7.tld>+OR+hdr:<00c701d8bb83$f307bc70$d9173550$(a)domain1.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=59 2023-03-13 21:06:14.714 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<AS4P195MB179002723893D3932AF83A4CDEA29(a)domain5.tld>+OR+hdr:<F3112D85FDF144319FB0ABE348A75AE5(a)domain8.tld>+OR+hdr:<AM9PR10MB510032098A44B16182C9AAF39C4D9(a)domain8.tld>+OR+hdr:<\!\%26\!AAAAAAAAAAAYAAAAAAAAAI\/Oo\%2BConZZMkCvmEY7yWqjCgAAAEAAAADl2MLfkWRxJjQW\%2B3dOhZn0BAAAAAA%3D%3D(a)domain5.tld>+OR+hdr:<CAJbcrLtAEjLO0wbK5AAp8a3p0iRaoUeKA1wsD2ppDFeMnhL\-kA(a)domain7.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=178 2023-03-13 21:06:14.771 INFO (qtp1671846437-1628) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<DU0P189MB208990AA60E3EB5CB2F9BE98DCD39@domain>+OR+hdr:<DDA00A9A19CE4864AD87EF31B0E2113F(a)domain8.tld>+OR+hdr:<GV1PR01MB882049EDFF560AF4F4444F4BB1EE9(a)domain7.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:d0f433254ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=88&wt=xml} hits=0 status=0 QTime=34 2023-03-13 21:06:14.899 INFO (qtp1671846437-1652) [ x:dovecot] o.a.s.c.S.Request [dovecot] webapp=/solr path=/select params={q={!lucene+q.op%3DAND}hdr:<AS4P195MB1790922D3154E37AEF263FD1DEDF9(a)domain5.tld>+OR+hdr:<02E5E16DF27945B6A764F49A5D9E055E(a)domain8.tld>+OR+hdr:<CAEK\-5TdF_f%3Dn\%2BL1VWj3EVP9i%3DQe\%2BWaYcW%3DFNy8GSLfE5O1U7dw(a)domain7.tld>+OR+hdr:<4edb1720076ab71575067b0fc2b5d96c(a)domain2.tld>+OR+hdr:<1657012847.68884591(a)domain6.tld>&fl=uid,score&sort=uid+asc&fq=%2Bbox:4830f5144ee1b161c82c00002e1056c4+%2Buser:user@domain&rows=1&wt=xml} hits=0 status=0 QTime=46 Thanks -- Alessio Cecchi Postmaster @http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Import collection of files containing one raw message each into dovecot
by Markus Schönhaber 21 Mar '23

21 Mar '23

Hi, given a bunch of files, each containing the raw source of a single email message. There's no structural or naming scheme like Maildir or something. Is there a (easy) way to import those mails into dovecot? AIUI doveadm import needs a source location in a supported mailbox format - which doesn't seem applicable here. -- Regards mks

2 2

"doveadm altmove -r" not working ?
by Benoit Branciard 21 Mar '23

21 Mar '23

Hello, I have some trouble using "doveadm altmove -r". Regular "doveadm altmove" is OK, selected mails were moved to alternate storage as expected. But I can't manage to get them back to original location, "doveadm altmove -r" has no effect. We are using Dovecot 2.3.4 (Debian Buster package). mail_location = mdbox:~/mdbox:DIRNAME=_@@_dbox-Mails_@@_:ALT=/slow%h/mdbox doveadm altmove -u myuser since 90d -> some message files are created under /slow/my/homedir/mdbox/storage doveadm altmove -r -u myuser all -> message files are still sitting under /slow/my/homedir/mdbox/storage, none were created into /my/homedir/mdbox/storage. Is there some known issues with doveadm altmove in this version ? Or am I missing something ? I can share more config details if needed. -- Benoit BRANCIARD Université Paris 1 Panthéon-Sorbonne - DSIUN-SIS B405 - Centre PMF - 90 rue de Tolbiac - 75013 Paris Tel. 01 44 07 89 68 http://dsiun.univ-paris1.fr

4 5

Read-only / archive mode for IMAP mailboxes?
by Rᴇɴᴇ́ Pꜰᴇɪꜰꜰᴇʀ 20 Mar '23

20 Mar '23

Hello! We are currently exploring email archiving solutions. Is there a way to use an IMAP mailbox in read-only / archive mode? The requirement is that delibveries of new emails should be possible (via SMTP/LMTP), but no messages should be deleted via IMAP access. Frankly I don't think this works, but maybe some of you have tried this already. Regards, René. -- )\._.,--....,'``. fL Let GNU/Linux work for you while you take a nap. /, _.. \ _\ (`._ ,. R. Pfeiffer <lynx at luchs.at> + https://web.luchs.at/ `._.-(,_..'--(,_..'`-.;.' - System administration + Consulting + Teaching - 📨 Got mail delivery problems? https://web.luchs.at/information/blockedmail.php 📯 Complete contact information: https://web.luchs.at/kontakt/ 🔏 Download latest GPG/PGP keys: https://web.luchs.at/kontakt/gpg.asc ⛔ W͇A͇R͇N͇I͇N͇G͇:͇ ͇D͇O͇ ͇_͇N͇O͇T͇_͇ ͇S͇E͇N͇D͇ ͇E͇M͇A͇I͇L͇S͇ ͇W͇I͇T͇H͇ ͇H͇T͇M͇L͇ ͇C͇O͇N͇T͇E͇N͇T͇ ͇T͇O͇ ͇M͇Y͇ ͇E͇M͇A͇I͇L͇ ͇A͇D͇D͇R͇E͇S͇S͇!͇ ⛔

3 3

Remote backup of IMAP user fails with dsync_remote epoll_ctl error
by dml＠plumeriahale.net 20 Mar '23

20 Mar '23

I’m trying backup a user’s IMAP folders from a system running dovecot 2.1.7. to a system running dovecot 2.3.19.1. After much perusing of the web and Dovecot documentation I tried this: 1) On the 2.1.7 host set up the doveadm server to listen on TCP port 2425 and defined a doveadm_password value 2) Issued the following command on the 2.13.19.1 system: doveadm -o doveadm_password=<password> backup -R -u <username> -S <host>:2425 tcp:<host> 3) The command returned the following errors: Error: doveadm server disconnected before handshake: EOF Error: Command backup failed for <username>: EOF 4) In the Dovecot log on the 2.1.7 system I found the following error message: dsync(<username>): Error: user <username>: Initialization failed: Namespace '': Unknown mail storage driver tcp dovecot: dsync(<username>): Fatal: User init failed A couple of questions: 1) I thought that setting up doveadm-server as an inet_listener (with a password) meant that all communications (including the backup) occurred over that link - is that not correct? Or does SSH also need to be enabled as well? 2) Am I specifying the arguments correctly? The definition of the destination argument is confusing in the documentation - if doveadm is trying to backup a user’s IMAP mailboxes from a remote source, and you’ve already specified the information needed to connect to the remote sources doveadm-server why would the source need to be specified again via the TCP: argument?

1 0

Disable folder creation for details username
by Robert Blayzor 20 Mar '23

20 Mar '23

This may be more of a CPanel issue than Dovecot but CPanel uses Dovecot and not sure if this is a knob we have available in Dovecot or we need to reach out to Cpanel directly to see if this is some custom code they added to their distros. Anyway, W/R/T emails sent with dtails/ + addresses ie: foo+bar(a)mydomain.com And with LDA/LMTP, in Cpanel by default the detials part, in this case "bar" will be created in it's own folder. Automatically. To us, this can be an attack vector/DOS from a malicious actor so we want to turn it off. We understand there is: lda_mailbox_autocreate Which we have yes, as we do want to create mailboxes automatically when the first message comes in, but not these folders. I don't know if this folder autocreation on detail part is a Dovecot thing, or specific to Cpanel. It appears CPanel has a patch/code to option to turn it off, but it's only on a per mailbox basis. We want to turn this behavior off globally. As far as I know, CPanel doesn't release whatever patches they made to make this happen, asking here if anyone has experience with this before we start chasing them for answers. -- inoc.net!rblayzor XMPP: rblayzor.AT.inoc.net PGP: https://pgp.inoc.net/rblayzor/

2 2

Dovecot unified event filtering
by Felix Auringer 20 Mar '23

20 Mar '23

Hello, I have an issue with debug logging when using a custom plugin for Dovecot. In my plugin, I create a child event of the session's user event: ```c struct event *plugin_event = event_create(list->ns->user->event); event_set_name(plugin_event, "oidc_shared_mailboxes_plugin"); event_set_min_log_level(plugin_event, LOG_TYPE_WARNING); event_set_append_log_prefix(plugin_event, "oidc-shared-mailboxes-plugin: "); ``` I then use passthrough events like the following: ``` e_debug(event_create_passthrough(data->event)->event(), "Modified mailbox_list_iter_init was called."); e_warning(event_create_passthrough(event)->event(), "Did not find required key 'roles' in the JWT body."); ``` `e_warning` and `e_error` work fine. If I understand the documentation for the unified event filtering (https://doc.dovecot.org/configuration_manual/event_filter/#unified-filter-l…) correctly, I should be able to enable debug logging for with `log_debug = event="oidc_shared_mailboxes_plugin"`. However, this setting has no influence on the logging behavior. The setting I have to set for the debug logging to work is `mail_debug = yes` (I do not have to set `log_debug` at all). Is this intended behavior or am I doing something wrong? Best regards, Felix Auringer Here is the output of `dovecot -n` (I removed the passdb, userdb, namespace, service, and managesieve settings as they cluttered the output): ``` # 2.3.19 (b3ad6004dc): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.10.0-15-amd64 x86_64 Debian 11.6 # Hostname: c3dd5b346d22 auth_mechanisms = plain login xoauth2 oauthbearer debug_log_path = /dev/stdout disable_plaintext_auth = no first_valid_uid = 1000 info_log_path = /dev/stdout last_valid_uid = 1000 log_debug = event="oidc_shared_mailboxes_plugin" log_path = /dev/stdout login_greeting = Hello there! .... GIZ Mail! mail_location = maildir:~/mail mail_plugins = " oidc_shared_mailboxes" plugin { oidc_shared_mailboxes_client_id = dovecot-test } protocols = imap lmtp ``` --- Gesellschaft für interkulturelles Zusammenleben gGmbH (GIZ) Felix Auringer IT Reformationsplatz 2 13597 Berlin Tel: 030/513 0100 00; Fax: 030/513 0100 09 www.giz.berlin; felix.auringer(a)giz.berlin Amtsgericht Charlottenburg HRB 200872 B Geschäftsführerin: Dr. Britta Marschke

2 1

Error: Can't load SSL certificate
by Horst Simon 20 Mar '23

20 Mar '23

I try to logon to map using dovecot with SSL required. I get following entries in the log:Mar 20 13:49:30 auth: Debug: Loading modules from directory: /opt/lib/dovecot/modules/auth Mar 20 13:49:30 auth: Debug: Module loaded: /opt/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 20 13:49:30 auth: Debug: Read auth token secret from /opt/var/run/dovecot/auth-token-secret.dat Mar 20 13:49:30 auth: Debug: passwd-file /opt/etc/dovecot/userdb:Read 1 users in 0 secs Mar 20 13:49:30 auth: Debug: auth client connected (pid=26120) Mar 20 13:49:30 imap-login: Error: Failed to initialize SSL server context: Can't load SSL certificate (ssl_cert setting): error:12800067:DSO support routines::could not load the shared library: filename(libz.so): libz.so: cannot open shared object file: No such file or directory, error:12800067:DSO support routines::could not load the shared library: user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF> Mar 20 13:49:30 imap-login: Info: Disconnected: TLS initialization failed. (no auth attempts in 0 secs): user=<>, rip=192.168.117.5, lip=192.168.117.2, session=<eX3e+Uv3k8DAqHUF The library files exist in the include directory [/opt] # find . -name libz* -print ./lib/opkg/info/libzstd.control ./lib/opkg/info/libzstd.list ./lib/libz.so ./lib/libz.so.1 ./lib/libz.so.1.2.13 ./lib/libzstd.so ./lib/libzstd.so.1 ./lib/libzstd.so.1.5.2 ./lib/libz.a Have the dovecot settings the same on other servers and it works, Dovecot is v2.3.18, installed from Entware for QNAP. Any help appreciated. Horst

2 1

Can't seem to setup remote access to doveadmI'm using
by dml＠plumeriahale.net 18 Mar '23

18 Mar '23

I’m running version 2.1.7 under Raspbian Wheezy (and have been for a number of years). I want to allow one of my other computers to remotely issue doveadm commands to my server but can’t seem to find the right way to add an inet listener to permit this. Using ‘doveconf -a’ I’ve found the default service definition for doveadm-server. So I copied that and added it to the dovecot configuration with an inet listener section added to it. But that was rejected as a duplicate service definition when I restarted dovecot. I then tried specifying a “host:port” value for the doveadm_socket_path value but that didn’t work as no listening socket at that port appeared when I restarted dovecot. I can’t seem to find in any of the dovecot documentation a way to do this and there seems to be nothing like a “Here’s how to setup doveadm remote access” section in the documentation (which would be most helpful). How can I get doveadm-server to listen not only locally (as it’s already doing) but also open an inet port for remote access?

3 2

Re: [EXT] Re: Corrupted sizes using zlib plugin
by Tim Evers 16 Mar '23

16 Mar '23

Am 06.03.23 um 16:45 schrieb Aki Tuomi: >> On 06/03/2023 16:52 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >> >> >> Am 06.03.23 um 15:29 schrieb Aki Tuomi: >>>> On 06/03/2023 15:56 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>> >>>> >>>> Am 06.03.23 um 14:49 schrieb Aki Tuomi: >>>>>> On 06/03/2023 15:45 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>> >>>>>> >>>>>> Am 06.03.23 um 14:00 schrieb Aki Tuomi: >>>>>>>> On 06/03/2023 13:06 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>> >>>>>>>> >>>>>>>> Am 06.03.23 um 11:59 schrieb Aki Tuomi: >>>>>>>> >>>>>>>>>> On 06/03/2023 12:44 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Am 06.03.23 um 11:42 schrieb Aki Tuomi: >>>>>>>>>> >>>>>>>>>>>> On 06/03/2023 12:32 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Hi, >>>>>>>>>>>> >>>>>>>>>>>> since I did not get any feedback on my bug report post regarding >>>>>>>>>>>> corrupted sizes while using zlib >>>>>>>>>>>> (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I >>>>>>>>>>>> would like to confirm that this bug report reached someone in charge. >>>>>>>>>>>> >>>>>>>>>>>> Or if not - I would kindly ask for directions on how to post it in a way >>>>>>>>>>>> that spawns some action. >>>>>>>>>>>> >>>>>>>>>>>> Thx >>>>>>>>>>>> >>>>>>>>>>>> Tim >>>>>>>>>>> Can you try erasing dovecot.index.cache and see if the problem fixes itself? It's possible your cache contains invalid values from old errors. >>>>>>>>>>> >>>>>>>>>>> Aki >>>>>>>>>> Did that already several times (other dovecot.index.* files too). The >>>>>>>>>> only thing that helps is actually deleting the dovecot-uidlist file but >>>>>>>>>> the problem returns. >>>>>>>>>> >>>>>>>>>> Tim >>>>>>>>> I think it's because the value on the filename is wrong. The filename contains the virtual and physical size. >>>>>>>>> >>>>>>>>> Can you try if https://github.com/dovecot/tools/blob/main/maildir-size-fix.pl fixes your issue? >>>>>>>>> >>>>>>>>> Aki >>>>>>>> Quoting >>>>>>>> >>>>>>>> https://doc.dovecot.org/configuration_manual/zlib_plugin/ : >>>>>>>> >>>>>>>> "All mails must have ,|S=<size>|in their filename where <size> contains >>>>>>>> the original uncompressed mail size, otherwise there will be problems >>>>>>>> with quota calculation as well as other potential random failures." >>>>>>>> >>>>>>>> And the script you send: >>>>>>>> >>>>>>>> "# Check if the files are compressed. Use the uncompressed size for S=size." >>>>>>>> >>>>>>>> Which it does in my example. S= contains the uncompressed size, not the >>>>>>>> size on disk. Is this not correct? All Files are written exclusively by >>>>>>>> dovecot, no other software is involved. >>>>>>>> >>>>>>>> Tim >>>>>>> Can you send output from `doveconf -n`? I am having suspicion that zlib plugin isn't always involved in your config, which causes the compressed file to be cached wrongly. Especially it feels like your IMAP protocol does not have compression on while LMTP does. >>>>>>> >>>>>>> Aki >>>>>> Actually it is the other way round (I removed zlib from lmtp to reduce >>>>>> the impact of the problem): >>>>>> >>>>>> # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf >>>>>> # Pigeonhole version 0.5.20 (149edcf2) >>>>>> # OS: Linux 4.15.0-204-generic x86_64 Ubuntu 18.04.6 LTS >>>>>> # Hostname: node2.mst27.artfiles.de >>>>>> auth_verbose = yes >>>>>> auth_worker_max_count = 1000 >>>>>> default_client_limit = 5000 >>>>>> dict { >>>>>> sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >>>>>> } >>>>>> disable_plaintext_auth = no >>>>>> import_environment = TZ CLUSTERNAME >>>>>> lda_mailbox_autocreate = yes >>>>>> lda_mailbox_autosubscribe = yes >>>>>> mail_location = maildir:~/Maildir >>>>>> mail_plugins = " mail_log notify old_stats" >>>>>> mailbox_idle_check_interval = 10 mins >>>>>> maildir_broken_filename_sizes = yes >>>>>> managesieve_notify_capability = mailto >>>>>> managesieve_sieve_capability = fileinto reject envelope >>>>>> encoded-character vacation subaddress comparator-i;ascii-numeric >>>>>> relational regex imap4flags copy include variables body enotify >>>>>> environment mailbox date index ihave duplicate mime foreverypart >>>>>> extracttext editheader imapsieve vnd.dovecot.imapsieve >>>>>> namespace inbox { >>>>>> inbox = yes >>>>>> location = >>>>>> mailbox Drafts { >>>>>> auto = subscribe >>>>>> special_use = \Drafts >>>>>> } >>>>>> mailbox Junk { >>>>>> auto = subscribe >>>>>> special_use = \Junk >>>>>> } >>>>>> mailbox Sent { >>>>>> auto = subscribe >>>>>> special_use = \Sent >>>>>> } >>>>>> mailbox "Sent Messages" { >>>>>> special_use = \Sent >>>>>> } >>>>>> mailbox Trash { >>>>>> auto = subscribe >>>>>> special_use = \Trash >>>>>> } >>>>>> prefix = INBOX. >>>>>> separator = . >>>>>> } >>>>>> passdb { >>>>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>>>> driver = sql >>>>>> } >>>>>> plugin { >>>>>> imapsieve_mailbox1_before = file:~/af_report-spam.sieve >>>>>> imapsieve_mailbox1_causes = COPY >>>>>> imapsieve_mailbox1_name = INBOX.Junk >>>>>> imapsieve_mailbox2_before = file:~/af_report-ham.sieve >>>>>> imapsieve_mailbox2_causes = COPY >>>>>> imapsieve_mailbox2_from = INBOX.Junk >>>>>> imapsieve_mailbox2_name = * >>>>>> quota = dict:User quota::proxy::sqlquota >>>>>> quota_rule = *:storage=0:messages=0 >>>>>> sieve = file:~/sieve;active=~/.dovecot.sieve >>>>>> sieve_before = file:~/af_master.sieve >>>>>> sieve_before2 = file:~/af_konto.sieve >>>>>> sieve_before3 = file:~/af_domain.sieve >>>>>> sieve_before4 = file:~/af_spamfilter.sieve >>>>>> sieve_extensions = +editheader >>>>>> sieve_filter_bin_dir = /usr/local/bin/sieve >>>>>> sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.filter >>>>>> +vnd.dovecot.environment >>>>>> sieve_max_redirects = 100 >>>>>> sieve_pipe_bin_dir = /usr/local/bin/sieve >>>>>> sieve_plugins = sieve_imapsieve sieve_extprograms >>>>>> stats_refresh = 30 secs >>>>>> zlib_save = gz >>>>>> zlib_save_level = 6 >>>>>> } >>>>>> pop3_no_flag_updates = yes >>>>>> protocols = " imap lmtp sieve pop3" >>>>>> service anvil { >>>>>> client_limit = 6203 >>>>>> } >>>>>> service auth-worker { >>>>>> process_limit = 1000 >>>>>> } >>>>>> service auth { >>>>>> client_limit = 6300 >>>>>> } >>>>>> service dict { >>>>>> process_limit = 500 >>>>>> unix_listener dict { >>>>>> group = vmail >>>>>> mode = 0600 >>>>>> user = vmail >>>>>> } >>>>>> } >>>>>> service imap-login { >>>>>> process_limit = 4000 >>>>>> process_min_avail = 0 >>>>>> service_count = 0 >>>>>> vsz_limit = 512 M >>>>>> } >>>>>> service imap { >>>>>> client_limit = 1 >>>>>> process_limit = 4000 >>>>>> vsz_limit = 1 G >>>>>> } >>>>>> service lmtp { >>>>>> inet_listener lmtp { >>>>>> address = 127.0.0.1 >>>>>> port = 10024 >>>>>> } >>>>>> process_limit = 80 >>>>>> process_min_avail = 20 >>>>>> vsz_limit = 2 G >>>>>> } >>>>>> service pop3-login { >>>>>> process_limit = 2000 >>>>>> service_count = 0 >>>>>> vsz_limit = 512 M >>>>>> } >>>>>> service pop3 { >>>>>> client_limit = 1 >>>>>> process_limit = 2000 >>>>>> vsz_limit = 1 G >>>>>> } >>>>>> service stats { >>>>>> fifo_listener stats-mail { >>>>>> mode = 0600 >>>>>> user = vmail >>>>>> } >>>>>> } >>>>>> ssl_cert = </etc/dovecot/private/dovecot.pem >>>>>> ssl_client_ca_dir = /etc/ssl/certs >>>>>> ssl_key = # hidden, use -P to show it >>>>>> submission_host = smtp4.artfiles.de >>>>>> syslog_facility = local5 >>>>>> userdb { >>>>>> args = /etc/dovecot/dovecot-sql.conf.ext >>>>>> driver = sql >>>>>> } >>>>>> protocol lmtp { >>>>>> mail_plugins = " mail_log notify old_stats sieve quota" >>>>>> } >>>>>> protocol imap { >>>>>> mail_max_userip_connections = 50 >>>>>> mail_plugins = " mail_log notify old_stats quota imap_quota >>>>>> imap_sieve zlib imap_old_stats" >>>>>> rawlog_dir = /var/log/rawlog/%u >>>>>> } >>>>>> protocol pop3 { >>>>>> mail_max_userip_connections = 50 >>>>>> mail_plugins = " mail_log notify old_stats zlib" >>>>>> } >>>>> It will probably compound on the issue though, especially when rebuilding caches and indexes, as it will record the sizes wrong. I'm not sure if this is *really* the issue, but it's most likely culprit. The 8192 is very odd number to have there, which either indicates that the zlib plugin is not consistently used, or you have some issues with the gz library itself. >>>>> >>>>> Aki >>>> Not sure if I understand this - shouldn't dovecot always note the >>>> decompressed size in cache and filename regardless if it's compressed or >>>> not? >>>> >>>> I just removed the zlib plugin from lmtp to reduce the footprint of the >>>> problem. The problem itself showed up first while lmtp zlib was on. >>>> >>>> Tim >>> It is complaining about the **physical** size though, that is, the amount stored on disk. If you have a dovecot process which is unaware of compression, it can record the wrong size for the file. >>> >>> Aki >> OK, I see. Another thing I noticed: The uidlist entry for a suspicious >> number of these problematic files contains what looks like a GUID: >> >> G1674674677.M641373P33277.node2 >> >> If I remove the uidlist and let dovecot recreate it, it is usually gone. >> Might that be an indicator of some other process writing to the uidlist >> file? the GUID is not mentioned in the dovecot docs as far as I can see. >> >> Tim > It sure sounds like that. > > Aki OK, for future reference: I think I found the issue. There was a periodic doveadm quotacheck job that was unaware of the zlib compression. I fixed that and no new corruption occured (though I still see errors from already corrupted cache data - that will hopefully dry up over time). However: I have still no idea why dovecot is complaining about the index.* files. It seems that the source of the wrong data is the dovecot-uidlist. Also I don't see why the quotacheck cmd (doveadm quota recalc -u <>) **sometimes** updates the dovecot-uidlist file. The quota itself is stored in a sql dict. Thanks to all who provided their input and especially Aki for the support! Tim

1 0

Postfix : root and system user authentication
by Aymeric Agon-Rambosson 16 Mar '23

16 Mar '23

Hello everyone, >From what I understand of the documentation, it is impossible to log in to the dovecot server as root, or as any user not in the interval between first_valid_uid and last_valid_uid. I have been able to verify this. However, when we have a postfix server on the same machine, that delegates authentication to dovecot SASL according to the configuration described at https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/, we can indeed log in as root on the postfix server. Proof (/var/log/mail.log with auth=debug) : Mar 13 20:16:37 ricorambo dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=smtp#011nologin#011lip=<redacted>#011rip=<redacted>#011secured#011resp=<hidden> Mar 13 20:16:37 ricorambo dovecot: auth: Debug: pam(root,<redacted>): Performing passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): Server accepted connection (fd=13) Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): Sending version handshake Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: Handling PASSV request Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): Performing passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): lookup service=dovecot Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): #1/1 style=1 msg=Password: Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: pam(root,<redacted>): Finished passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth-worker(136499): Debug: conn unix:auth-worker (pid=136444,uid=111): auth-worker<1>: Finished Mar 13 20:16:37 ricorambo dovecot: auth: Debug: pam(root,<redacted>): Finished passdb lookup Mar 13 20:16:37 ricorambo dovecot: auth: Debug: auth(root,<redacted>): Auth request finished Mar 13 20:16:37 ricorambo dovecot: auth: Debug: client passdb out: OK#0111#011user=root#011 At this moment, the smtps client connecting to postfix produces "Authentication successful" and we can continue. In contrast, when we try to login to dovecot directly as root, we have the following : Mar 13 20:28:38 ricorambo dovecot: auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured=tls#011session=<redacted>#011lip=<redacted>#011rip=<redacted>#011lport=993#011rport=52004#011local_name=mail.ricorambo.su#011resp=<hidden> Mar 13 20:28:38 ricorambo dovecot: auth: Debug: pam(root,<redacted>,<redacted>): Performing passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): Server accepted connection (fd=13) Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): Sending version handshake Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: Handling PASSV request Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): Performing passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): lookup service=dovecot Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): #1/1 style=1 msg=Password: Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: pam(root,<redacted>,<redacted>): Finished passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<1>: Finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: pam(root,<redacted>,<eU8pHs32JMuE40wF>): Finished passdb lookup Mar 13 20:28:38 ricorambo dovecot: auth: Debug: auth(root,<redacted>,<eU8pHs32JMuE40wF>): Auth request finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: client passdb out: OK#0111#011user=root#011#011original_user=root(a)ricorambo.su Mar 13 20:28:38 ricorambo dovecot: auth: Debug: master in: REQUEST#<redacted> Mar 13 20:28:38 ricorambo dovecot: auth: Debug: passwd(root,<redacted>,<redacted>): Performing userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: Handling USER request Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): Performing userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: passwd(root,<redacted>,<redacted>): Finished userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth-worker(137089): Debug: conn unix:auth-worker (pid=137079,uid=111): auth-worker<2>: Finished Mar 13 20:28:38 ricorambo dovecot: auth: Debug: passwd(root,<redacted>,<redacted>): Finished userdb lookup Mar 13 20:28:38 ricorambo dovecot: auth: Debug: master userdb out: USER#<redacted> Mar 13 20:28:38 ricorambo dovecot: imap-login: Login: user=<root>, method=PLAIN, rip=<redacted>, lip=192.168.1.22, mpid=137090, TLS, session=<redacted> Mar 13 20:28:38 ricorambo dovecot: imap(root): Error: Invalid settings in userdb: userdb returned 0 as uid Mar 13 20:28:38 ricorambo dovecot: imap(root): Warning: Event 0xaaab0e9db2a0 leaked (parent=0xaaab0e9cdc80): mail-storage-service.c:1336 Mar 13 20:28:38 ricorambo dovecot: imap(root): Warning: Event 0xaaab0e9cdc80 leaked (parent=(nil)): main.c:246 At this moment, the imap client produces "Internal server error" and finishes. Steps to reproduce : - Delegate SASL authentication from postfix to dovecot as such : /etc/postfix/master.cf smtps inet n - y - - smtpd -o syslog_name=postfix/smtps -o smtpd_tls_wrappermode=yes -o smtpd_sasl_auth_enable=yes -o smtpd_relay_restrictions=permit_sasl_authenticated,reject -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject -o smtpd_sasl_type=dovecot -o smtpd_sasl_path=private/auth and of course : /etc/dovecot/conf.d/10-master.conf unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } - login to your server, port 465, with a client like openssl : openssl s_client -connect mail.example.org:465 EHLO whateveryouwant AUTH PLAIN \0root\0password (in base 64, ofc) You should be able to login, and produce the first log trace I have included. My question is, is this a feature or a bug ? The hardcoded impossibility to login as root to dovecot, and the honouring of the variables {first,last}_valid_{u,g}id, are those specific to login to dovecot directly, or should they be applicable to any other process that has delegated its authentication to dovecot ? If this is a feature, that is if postfix cannot profit from the variables {first,last}_valid_{u,g}id (or the hardcoded forbidding of root) through dovecot sasl : - This should maybe made more obvious somewhere in the documentation. - What would be the good way to prevent root login to postfix, when authentication is delegated to dovecot ? The dovecot version is 2.3.13 (89f716dc2) The system is the following : Linux 5.10.0-21-arm64 #1 SMP Debian 5.10.162-1 (2023-01-21) aarch64 GNU/Linux Thank you in advance for your time. I have included the output of dovecot -n for reference. Best regards, Aymeric

6 10

Build dovecot from source
by Horst Simon 15 Mar '23

15 Mar '23

I am sorry if this is not the correct list for asking this. T try to build dovecot 2.3.20 from source on a QNAP NAS, which is a linux variant. There is an dovecot available, but this does not include a pigeonhole sieve, that’s why I try to build it from source. The configure script works fine, but the make fails as follows: *** Warning: Linking the executable test-http-payload against the loadable module *** libssl_iostream_openssl.so is not portable! libtool: link: gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,--as-needed -o .libs/test-http-payload test-http-payload.o -Wl,--export-dynamic -L/share/CACHEDEV1_DATA/.qpkg/Entware/lib -L/share/CACHEDEV1_DATA/.qpkg/Apache81/lib ./.libs/libhttp.a ../lib-dns/.libs/libdns.a ../lib-ssl-iostream/.libs/libssl_iostream.a ../lib-master/.libs/libmaster.a ../lib-auth/.libs/libauth.a ../lib-settings/.libs/libsettings.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -ldl ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so -Wl,-rpath -Wl,/opt/lib/dovecot /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_set_default@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_init@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_load_builtin_engines@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_free@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_finish@OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_by_id@OPENSSL_1_1_0' collect2: error: ld returned 1 exit status make[3]: *** [Makefile:892: test-http-payload] Error 1 make[3]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20/src/lib-http' make[2]: *** [Makefile:573: all-recursive] Error 1 make[2]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20/src' make[1]: *** [Makefile:702: all-recursive] Error 1 make[1]: Leaving directory '/share/CACHEDEV1_DATA/temp/dovecot-2.3.20' make: *** [Makefile:546: all] Error 2 I already asked in the GitHub forum, but haven’t received any answers, that why I m asking here if anyone can help me to get it working. Horst

1 0

Bug with lmtp_save_to_detail_mailbox
by Dejan 15 Mar '23

15 Mar '23

> lmtp_save_to_detail_mailbox = yes Plus-delivery conflicts with existing, reserved files such as "subscriptions": Message for kim+subscriptions@ results in: lmtp(kim(a)***.com)<14493><SK7sEvaHEWSdOAAAvAYmHA>: Error: ....stat(/var/mails/***/kim/Maildir/subscriptions/tmp) failed: Not a directory Version: 2.3.18

2 4

dovecot crash with Panic: file istream-header-filter.c: line 663
by Patrick Mansfield 13 Mar '23

13 Mar '23

Hi - I'm hitting a crash in dovecot, I get this logged followed by a terse stack trace and systemd-coredump details not included here - full gdb stack trace and more details are further down: Mar 12 10:32:26 goffin dovecot[8269]: imap-login: Login: user=<patman>, method=PLAIN, rip=192.168.1.4, lip=192.168.1.1, mpid=8477, TLS, session=<5RvGYLf2RrDAqAEE> Mar 12 10:32:26 goffin audit[8304]: USER_AUTH pid=8304 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=PAM:authentication grantors=pam_usertype,pam_localuser,pam_unix acct="patman" exe="/usr/libexec/dovecot/auth" hostname=192.168.1.4 addr=192.168.1.4 terminal=dovecot res=success' Mar 12 10:32:26 goffin audit[8304]: USER_ACCT pid=8304 uid=0 auid=4294967295 ses=4294967295 subj=kernel msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="patman" exe="/usr/libexec/dovecot/auth" hostname=192.168.1.4 addr=192.168.1.4 terminal=dovecot res=success' Mar 12 10:32:26 goffin dovecot[8269]: imap-login: Login: user=<patman>, method=PLAIN, rip=192.168.1.4, lip=192.168.1.1, mpid=8479, TLS, session=<PnHKYLf2SrDAqAEE> Mar 12 10:32:27 goffin dovecot[8269]: imap(patman)<8452><r+ynYLf2PrDAqAEE>: Panic: file istream-header-filter.c: line 663 (i_stream_header_filter_snapshot_free): assertion failed: (snapshot->mstream->snapshot_pending) Mar 12 10:32:27 goffin audit[8452]: ANOM_ABEND auid=4294967295 uid=1000 gid=1000 ses=4294967295 subj=kernel pid=8452 comm="imap" exe="/usr/libexec/dovecot/imap" sig=6 res=1 email client is fairemail version 1.2042a on android, but an older version had the same problem. I mainly use fairemail to read emails on my phone, and that is working fine but I noticed that deleted emails were not actually getting deleted, that it has a bunch of "pending operations" it has were not running, and that dovecot has been crashing like this since about feb 2 (over a month ago). I can't figure out what changed at that time, but my cert says it should have expired over a year ago, but the cert as created 26 months ago. log files only go back to Feb 5 so just missed that. I generated a new cert but it's still crashing (I probably still need to do something on the client side or my setup is broken). I assume there is something wrong or some "snapshot" thing that's stuck, but since it's crashing I can't figure out what the undelysing problem is. Thanks for any help. More details: -------------------------------------------------------------------------------- # dovecot --version 2.3.20 (80a5ac675d) Running with up to date fedora core 37. -------------------------------------------------------------------------------- # dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.15-200.fc37.x86_64 x86_64 Fedora release 37 (Thirty Seven) # Hostname: specu mail_location = mbox:~/Mail:INBOX=~/Mail/inbox mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { driver = passwd } -------------------------------------------------------------------------------- gdb backtrace via coredumpctl debug PID: Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. --Type <RET> for more, q to quit, c to continue without paging-- #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 44 return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0; (gdb) bt #0 __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44 #1 0x00007fa3840afec3 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78 #2 0x00007fa38405fa76 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #3 0x00007fa3840497fc in __GI_abort () at abort.c:79 #4 0x00007fa3847541e3 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #5 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #6 0x00007fa3847ff5f7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #7 0x00007fa3847540e1 in i_panic (format=0x7fa384844040 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #8 0x00007fa38474fdf8 in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #9 i_stream_header_filter_snapshot_free (_snapshot=0x56150ea92250) at ../lib-mail/istream-header-filter.c:655 #10 0x00007fa38480cb6c in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x56150ea9d2a0) at ../lib/istream.c:253 #11 0x00007fa38480cc14 in i_stream_unref (stream=0x56150ea9d338) at ../lib/istream.c:66 #12 0x00007fa3847dd179 in message_parse_header_deinit (_ctx=_ctx@entry=0x56150ea9d0c8) at ../lib-mail/message-header-parser.c:52 #13 0x00007fa3847deea1 in preparsed_parse_next_header (ctx=0x56150ea9d050, block_r=0x7ffc8222ca70) at ../lib-mail/message-parser-from-parts.c:310 #14 0x00007fa3847dfedc in message_parser_parse_next_block (ctx=ctx@entry=0x56150ea9d050, block_r=block_r@entry=0x7ffc8222ca70) at ../lib-mail/message-parser.c:838 #15 0x00007fa3847e0029 in message_parser_parse_header (ctx=0x56150ea9d050, hdr_size=hdr_size@entry=0x56150ea5ff00, callback=callback@entry=0x7fa3849aa3f0 <index_mail_parse_part_header_cb>, context=context@entry=0x56150ea5fc78) at ../lib-mail/message-parser.c:877 #16 0x00007fa3849aa60a in index_mail_parse_headers_internal (mail=mail@entry=0x56150ea5fc78, headers=headers@entry=0x0) at index/index-mail-headers.c:465 #17 0x00007fa3849aa71e in index_mail_parse_headers (mail=0x56150ea5fc78, headers=0x0, reason=<optimized out>) at index/index-mail-headers.c:499 #18 0x00007fa3849b021e in index_mail_parse_bodystructure_full (mail=0x56150ea5fc78, field=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index/index-mail.c:1491 #19 0x00007fa3849b02b3 in index_mail_parse_bodystructure (mail=mail@entry=0x56150ea5fc78, field=field@entry=MAIL_CACHE_IMAP_BODYSTRUCTURE) at index/index-mail.c:1515 #20 0x00007fa3849b06cd in index_mail_get_special (_mail=0x56150ea5fc78, field=<optimized out>, value_r=0x7ffc8222cbe0) at index/index-mail.c:1713 #21 0x00007fa38492fa1e in mail_get_special (mail=<optimized out>, field=field@entry=MAIL_FETCH_IMAP_BODYSTRUCTURE, value_r=value_r@entry=0x7ffc8222cbe0) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/lib-storage/mail.c:418 #22 0x000056150dcf458c in fetch_bodystructure (ctx=0x56150ea57530, mail=<optimized out>, context=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:740 #23 0x000056150dcfa3f3 in imap_fetch_more_int (ctx=ctx@entry=0x56150ea57530, cancel=false) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:562 #24 0x000056150dcfa6cd in imap_fetch_more (ctx=0x56150ea57530, cmd=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-fetch.c:617 #25 0x000056150dceed11 in cmd_fetch (cmd=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/cmd-fetch.c:382 #26 0x000056150dcf79a5 in command_exec (cmd=cmd@entry=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-commands.c:201 #27 0x000056150dcfd712 in client_command_input (cmd=<optimized out>, cmd@entry=0x56150ea57368) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1232 #28 0x000056150dcfd7b8 in client_command_input (cmd=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1302 #29 0x000056150dcfdc05 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1344 #30 client_handle_input (client=client@entry=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1358 #31 0x000056150dcfdfd4 in client_input (client=0x56150ea567f8) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/imap-client.c:1402 #32 0x00007fa3848183ad in io_loop_call_io (io=0x56150ea890b0) at ../lib/ioloop.c:737 #33 0x00007fa38481973a in io_loop_handler_run_internal (ioloop=ioloop@entry=0x56150ea2def0) at ../lib/ioloop-epoll.c:222 #34 0x00007fa3848197e4 in io_loop_handler_run (ioloop=ioloop@entry=0x56150ea2def0) at ../lib/ioloop.c:789 #35 0x00007fa3848199a0 in io_loop_run (ioloop=0x56150ea2def0) at ../lib/ioloop.c:762 #36 0x00007fa384788bf7 in master_service_run (service=0x56150ea2dd40, callback=callback@entry=0x56150dd00ae0 <client_connected>) at ../lib-master/master-service.c:869 #37 0x000056150dce9c4d in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dovecot-2.3.20-1.fc37.x86_64/src/imap/main.c:566 (gdb)

3 6

Option to disable client-initiated renegotiation
by Serg 13 Mar '23

13 Mar '23

Hello, is there any way to disallow client-initiated renegotiation at the dovecot? I haven't found any mention of this feature within source code as well as at the documentation. I am asking about it because without this feature mail server is vulnerable to a TLS renegotiation DoS attack which can consume a lot of CPU and is harder to combat comparing to a basic TLS connections flood.

2 1

bug: usersfile very weird behaviour regarding path to mbox
by Mikel Pérez 13 Mar '23

13 Mar '23

dovecot --version 2.3.20 (80a5ac675d) having the following setup: (1) aioria:/srv/franper/mail # cat /etc/dovecot/users ***snip*** ventas-respaldo@franper.net:*snip*:1001:1000::/srv/franper/mail/ventas (2) aioria:/srv/franper/mail # ls -lha total 0 drwxr-x---. 1 1001 1000 238 Mar 13 05:07 . drwxr-sr-x. 1 1000 1001 62 Oct 24 21:29 .. ***snip*** drwxr-x---. 1 1001 1000 578 Mar 4 18:53 ventas drwx------. 1 1001 1000 246 Mar 13 05:07 ventas-respaldo (3) aioria:/srv/franper/mail # date -u Mon Mar 13 05:09:06 UTC 2023 where (1) I'm trying to expose the contents of the mbox ventas as ventas-respaldo(a)franper.net, well, for some reason it disregards that I'm pointing at /srv/franper/mail/ventas BUT does take the directory path at /srv/franper/mail and then constructs a /srv/franper/mail/ventas-respaldo path, which you can confirm with (2) showing ventas-respaldo modification date being today's date (3) because a client (Thunderbird 103 if you're interested but I think that it's not its fault at all) tried accessing ventas-respaldo(a)franper.net which should have pointed to /srv/franper/mail/ventas but instead did this very weird thing. Nowhere in /etc/dovecot/users do I have a line pointing to /srv/franper/mail/ventas-respaldo. dovecut just generates it somehow. dovecot -n: # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: Linux 6.2.1-1-default x86_64 ## (OpenSUSE micro OS) # Hostname: aioria disable_plaintext_auth = no mail_location = maildir:/srv/franper/mail/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables b ody enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } ssl = required ssl_cert = <*snip* ssl_cipher_list = ALL:!DH:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_key = # hidden, use -P to show it ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } tell me if you need the sysreport tar and big thanks

1 0

set imap flags in user sieve scripts
by spi 11 Mar '23

11 Mar '23

Hi all Could anyone lead me into the right direction please? I use 'addflag ...' or 'fileinto :flags ...' in global sieve scripts to flag and sort incoming mail - that works. Trying to do that with custom user scripts doesn't work - I get the error that imap4flags only can be used in global scripts. Is there any way to get incoming mails labled and sorted by user sieve scripts? So something like this for a particular user doesn't work: if address :domain "From" "whatever.com"{ fileinto :flags ["\\todo"] "working/whatever"; } -- Cheers spi

3 4

Inconsistent filtering with debugging
by Christian Wolf 10 Mar '23

10 Mar '23

Hello, I have the problem, that I have a Postfix/Dovecot combination running with Sieve activated. The sieve script is running in general as some messages get filtered and moved to the appropriate folders. Now, I see that for the envelope filter, the behavior differs depending if I am debugging the rules or if the mails are received in a regular way. I have something like this: require "envelope"; # ... if envelope :is "to" "foo(a)subdaomin.example.com" { fileinto "INBOX.bar"; stop; } # ... The thing is if I call sieve-filter on the INBOX, I get the information that the mail is to be moved to the appropriate folder. However during delivery the mail is not moved there. Other rules in the script are working so it is installed in general. Of course, I could send mails to the mail address for testing but I have no clue on where to look for issues, especially as the "main debugging tool" for the rules (sieve-filter) is strangely behaving differently. The reason, I wanted to use the envelope was because the mails are delivered to foo(a)subdomain.example.com. From there, some virtual aliases are forwarded to a cental account bar(a)example.net using postfix virtual aliases. Thus, the Delivered-To header is always showing the value bar(a)example.net which is not suited for filtering. I could filter the Received headers but hoped for a more "high level" solution. Can you give me any advice? Christian

3 3

Winbind auhentication
by Luciano Mannucci 10 Mar '23

10 Mar '23

Helo all! I'm trying to set up a dovecot server so that it authenticates local user via /etc/passwd (I'm on a Freebsd 13.1) and via winbindd for those that it cannot find localy. The samba suite is alive and well, postfix gets happily mail from domain users and saves it with correct name and permissions from the windows domain. If I try to authenticate a domain user via wbinfo it works, with dovecot it doesn't. I guess I'v forgot something in the dovecot config... :) Here is my doveconf -n: # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.20 (149edcf2) # OS: FreeBSD 13.1-RELEASE-p5 powerpc ufs # Hostname: numeron.mcs.it auth_cache_size = 30 k auth_debug_passwords = yes auth_mechanisms = plain ntlm login auth_use_winbind = yes auth_username_format = %n auth_winbind_helper_path = /usr/local/bin/ntlm_auth default_client_limit = 1128 default_vsz_limit = 712 M disable_plaintext_auth = no first_valid_uid = 0 info_log_path = /var/log/dovecot/logfile.info listen = * lock_method = flock log_path = /var/log/dovecot/logfile login_greeting = Dovecot at Nameron Ready. mail_location = mbox:/var/spool/dovecot/%u:INBOX=/var/mail/%u mail_plugins = fts managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext passdb { driver = passwd } protocols = imap pop3 service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { user = root name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { service_count = 0 name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { process_limit = 255 service_count = 1 name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { unix_listener { group = mail mode = 0666 user = dovecot path = stats-reader } unix_listener { group = mail mode = 0666 user = dovecot path = stats-writer } name = stats } service submission { name = submission-login } service login/submission { name = submission } ssl = no userdb { driver = passwd } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes pop3_uidl_format = %08Xu%08Xv service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } protocol lda { debug_log_path = /var/log/dovecot/lda-debug.log info_log_path = /var/log/dovecot/lda.info log_path = /var/log/dovecot/lda.err mail_debug = yes postmaster_address = l(a)mcs.it service replication-notify-fifo { name = aggregator } service anvil-auth-penalty { name = anvil } service auth-worker { name = auth-worker } service auth-client { name = auth } service config { name = config } service dict-async { name = dict-async } service dict { name = dict } service login/proxy-notify { name = director } service dns-client { name = dns-client } service doveadm-server { name = doveadm } service imap-hibernate { name = imap-hibernate } service imap { name = imap-login } service imap-urlauth { name = imap-urlauth-login } service imap-urlauth-worker { name = imap-urlauth-worker } service token-login/imap-urlauth { name = imap-urlauth } service imap-master { name = imap } service indexer-worker { name = indexer-worker } service indexer { name = indexer } service ipc { name = ipc } service lmtp { name = lmtp } service log-errors { name = log } service sieve { name = managesieve-login } service login/sieve { name = managesieve } service old-stats-mail { name = old-stats } service pop3 { name = pop3-login } service login/pop3 { name = pop3 } service replicator-doveadm { name = replicator } service login/stats-writer { name = stats } service submission { name = submission-login } service login/submission { name = submission } } root@numeron:~# Thanks for any hint, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 02485781 FAX: +39 0248028247 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

2 2

NFS and performances
by tomate aceite 10 Mar '23

10 Mar '23

Thanks!!!!

1 0

how to setup timestamp
by tomate aceite 10 Mar '23

10 Mar '23

*Thanks** Alessio Cecchi*

1 0

index locally
by tomate aceite 10 Mar '23

10 Mar '23

Thanks guys for all the help. I will check if i can do a rsync script.

1 0

Backend doesn't support GUIDs
by Jose Celestino 09 Mar '23

09 Mar '23

Hi, Have some old dboxes where doveadm sync fails with "Backend doesn't support GUIDs, sync with header hashes instead". The error is right after reading from the folder dovecot.index.log.2. The dovecot version is 2.3.10. Any fix/workaround for the error?

1 0

how to setup timestamp
by tomate aceite 08 Mar '23

08 Mar '23

Does anyone got any example about how to implement delay_until = timestamp ? I am not sure where i can setup it. Thanks!

2 1

Missing mailboxes after migration from Maildir -> mdbox
by A 08 Mar '23

08 Mar '23

I migrated from existing dovecot Maildir to dbox. After adding separator to the namespace it migrated all Inbox mails, but the other mailboxes like user-created ones and "Junk", "Sent" and so on has not been migrated. Any advice would be helpful, here is my dovconf: https://pastebin.com/rDSeBcLe My migration I made using: 1. Edit dovecot.conf with new mdbox and adding separator 2. dsync mirror per user with old maildir:~/mail 3. missing mailboxes: tried with doveadm sync also with -f mode and specified mailboxes. No luck. dsync -v -u admin@(removed) mirror maildir:~/mail mail_home = /var/vmail/mailboxes/%d/%n #mail_location = maildir:~/mail:LAYOUT=fs mail_location=mdbox:~/mdbox My directorys: root@mail:/var/vmail/mailboxes/example.de/admin# ls -l insgesamt 56 drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 cur -rw-rw---- 1 vmail vmail 160 8. Mär 01:14 dovecot.index.log -rw-rw---- 1 vmail vmail 3712 8. Mär 01:14 dovecot.list.index.log -rw-rw---- 1 vmail vmail 96 8. Mär 01:14 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 51 8. Mär 01:14 dovecot-uidlist -rw-rw---- 1 vmail vmail 8 8. Mär 01:14 dovecot-uidvalidity -r--r--r-- 1 vmail vmail 0 8. Mär 00:57 dovecot-uidvalidity.6407cf6d drwxrwx--- 20 vmail vmail 4096 8. Mär 02:51 mail drwx------ 7 vmail vmail 4096 8. Mär 13:52 mailboxes drwx------ 13 vmail vmail 4096 8. Mär 02:36 Maildir drwx------ 5 vmail vmail 4096 8. Mär 04:20 mdbox drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 new -rw-rw---- 1 vmail vmail 28 8. Mär 01:14 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 01:14 tmp drwxrwx--- 2 vmail vmail 4096 8. Mär 00:57 xapian-indexes root@mail:/var/vmail/mailboxes/example.de/admin/mail# ls -l insgesamt 87576 drwxrwx--- 2 vmail vmail 9113600 8. Mär 02:20 cur -rw-rw---- 1 vmail vmail 1602296 8. Mär 02:20 dovecot.index -rw-rw---- 1 vmail vmail 73030876 8. Mär 02:41 dovecot.index.cache -rw-rw---- 1 vmail vmail 441656 8. Mär 02:39 dovecot.index.log -rw-rw---- 1 vmail vmail 83568 8. Mär 02:20 dovecot.index.log.2 -rwxrwx--- 1 vmail vmail 206490 17. Jun 2019 dovecot.index.thread -rwxrwx--- 1 vmail vmail 51 2. Aug 2019 dovecot-keywords -rw-rw---- 1 vmail vmail 1392 8. Mär 01:25 dovecot.list.index -rw-rw---- 1 vmail vmail 6712 8. Mär 02:41 dovecot.list.index.log -rwxrwx--- 1 vmail vmail 1464 8. Mär 02:20 dovecot.mailbox.log -rw-rw---- 1 vmail vmail 4875528 8. Mär 02:20 dovecot-uidlist -rwxrwx--- 1 vmail vmail 8 8. Mär 01:25 dovecot-uidvalidity -rwxrwx--- 1 vmail vmail 0 17. Jun 2019 dovecot-uidvalidity.5a6912f0 drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Drafts -rw-rw---- 1 vmail vmail 49 6. Mär 11:10 maildirsize drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 'Mailling Listen' drwxrwx--- 2 vmail vmail 204800 8. Mär 00:04 new drwxrwx--- 5 vmail vmail 4096 7. Mär 20:14 Sent drwxrwx--- 5 vmail vmail 4096 7. Mär 20:44 Spam drwxrwx--- 5 vmail vmail 4096 26. Feb 19:44 'SPF Fail' -rw-rw---- 1 vmail vmail 23 8. Mär 02:20 subscriptions drwxrwx--- 2 vmail vmail 4096 8. Mär 02:20 tmp drwxrwx--- 5 vmail vmail 4096 26. Feb 19:12 Trash drwxrwx--- 5 vmail vmail 4096 7. Mär 22:30 ubb drwxrwx--- 10 vmail vmail 4096 27. Feb 18:44 xapian-indexes

1 0

index locally
by tomate aceite 08 Mar '23

08 Mar '23

Hello, Do you know if is possible to store indexes locally instead of NFS in dovecot 2.2.7 ? Thanks.

3 2

Dovecot "Mailbox sharing between users".
by Jobst Schmalenbach 07 Mar '23

07 Mar '23

Hi I have appended the important bits of my server configuration to the end of this email I am trying to get "Mailbox sharing between users" to work. For starters it is very hard to follow the doc only https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo… without an actual example. I tried to use this (sorry in German) https://dokuwiki.tachtler.net/doku.php?id=tachtler:dovecot_shares and this got me a little further down the track. I followed the instructions required for the dovecot config files. Restarted dovecot, not errors displayed in the logs. I have got access to two user accounts, say USER1 and USER2. I executed this lines doveadm acl set -u USER1 INBOX user=USER2 admin create delete expunge insert lookup post read write write-deleted write-seen doveadm acl set -u USER2 INBOX user=USER1 admin create delete expunge insert lookup post read write write-deleted write-seen and created (just to be sure) two folders for each user /home/USER1/Mail/shared/USER1 /home/USER1/Mail/shared/USER2 /home/USER2/Mail/shared/USER1 /home/USER2/Mail/shared/USER2 The tried to create a mailboxes like so /home/USER1/Mail/shared/USER1/testa /home/USER1/Mail/shared/USER2/testb /home/USER2/Mail/shared/USER1/testa /home/USER2/Mail/shared/USER2/testb They are not created and no error is displayed - even looking at the dovecot logs. What I see in the folders for BOTH users though (for every folder) dovecot.list.index.log On the command line I can see the .imap files and do a 'ls -alR' in the folders, but no created mbox. I can definitely see the folders, but I cannot create a mbox file. What am I doing wrong? Help please. --------------------------------------------------------------------------------------------------------------------------------------------------------------- Here are the important configuration items # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-425.13.1.el8_7.x86_64 x86_64 AlmaLinux release 8.7 (Stone Smilodon) xfs namespace shared { list = children location = maildir:~/Mail/:INDEX=~/Mail/shared/%%u:CONTROL=~/Mail/shared/ prefix = shared/%%u/ separator = / subscriptions = yes type = shared } mail_location = mbox:/home/%u/Mail/:INBOX=/var/mail/%u mail_plugins = acl passdb { driver = pam } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db } service auth { unix_listener auth-userdb { group = dovecot mode = 0777 user = dovecot } } protocol imap { mail_plugins = " acl imap_acl" } --

1 0

Flags/tags lost when moving e-mails to another folder
by Alexis Ben Miloud--Josselin 06 Mar '23

06 Mar '23

Hi, I have an issue with e-mail tags/flags. The IMAP user is using Thunderbird or Roundcube with Thunderbird tags. When the user (with an IMAP client) moves an e-mail from a folder to another, tags set on the e-mail are lost. When we check the filesystem, we can see the "a" tag: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 'cur/1676643827.M563793P15241.<HOSTNAME>,S=2498,W=2551:2,a' When we move the e-mail to another folder, the tag disappear: -rw-rw---- 2 test mailusers 2498 Dec 29 15:31 '.test/cur/1676644340.M214404P22014.<HOSTNAME>,S=2498,W=2551:2,' In both folders, the dovecot-keywords file is: 0 $LABEL1 The problem appeared after a major system upgrade (Debian 9 to 10). Dovecot version went from 2.2.27 to 2.3.4.1. Some system informations: # dovecot --version 2.3.4.1 (f79e8e7e4) # cat /etc/debian_version 10.13 # uname -a Linux <HOSTNAME> 4.19.0-23-amd64 #1 SMP Debian 4.19.269-1 (2022-12-20) x86_64 GNU/Linux # findmnt /var TARGET SOURCE FSTYPE OPTIONS /var /dev/vda3 ext4 rw,nosuid,relatime # findmnt /home TARGET SOURCE FSTYPE OPTIONS /home /dev/vdb ext4 rw,nosuid,nodev,noexec,relatime The output of `dovecot -n output` is here (link expires in one year): https://paste.evolix.org/?96d46acaea638568#56g7AQLuzJxxy4xintpexJCPgiAAG23c… Here are the operations I see on an e-mail file using strace: 15507 link("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa", "/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>") = 0 15507 rename("/home/test/Maildir/.test/tmp/1672326456.M737812P15507.<HOSTNAME>", "/home/test/Maildir/.test/cur/1672326456.M737813P15507.<HOSTNAME>,S=2498,W=2551:2,S") = 0 15507 unlink("/home/test/Maildir/cur/1672326270.M619318P11927.<HOSTNAME>,S=2498,W=2551:2,Sa") = 0 Setting mbox_lazy_writes to yes and/or unsetting mail_cache_fields doesn't change anything. Any idea of what I am missing? Could this be a bug in Dovecot? Thanks in advance, -- Alexis Ben Miloud--Josselin <abenmiloud(a)evolix.fr> Evolix - Hébergement et Infogérance Open Source Marseille (37 rue Guibal, Pôle Média, 13003) / Paris / Montréal http://evolix.com | Twitter: @Evolix @EvolixNOC | http://blog.evolix.com

2 2

Re: Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Am 06.03.23 um 11:42 schrieb Aki Tuomi: >> On 06/03/2023 12:32 EET Tim Evers <te-ml-ext(a)artfiles.de> wrote: >> >> >> Hi, >> >> since I did not get any feedback on my bug report post regarding >> corrupted sizes while using zlib >> (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I >> would like to confirm that this bug report reached someone in charge. >> >> Or if not - I would kindly ask for directions on how to post it in a way >> that spawns some action. >> >> Thx >> >> Tim > Can you try erasing dovecot.index.cache and see if the problem fixes itself? It's possible your cache contains invalid values from old errors. > > Aki Did that already several times (other dovecot.index.* files too). The only thing that helps is actually deleting the dovecot-uidlist file but the problem returns. Tim

2 3

Corrupted sizes using zlib plugin
by Tim Evers 06 Mar '23

06 Mar '23

Hi, since I did not get any feedback on my bug report post regarding corrupted sizes while using zlib (https://dovecot.org/pipermail/dovecot/2023-February/126105.html) I would like to confirm that this bug report reached someone in charge. Or if not - I would kindly ask for directions on how to post it in a way that spawns some action. Thx Tim

2 1

Setting up the mail-crypt plugin with virtual accounts that have no home directories
by Jeremy 05 Mar '23

05 Mar '23

Hi again, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. After an initial topic from me about encrypting already existent mail, I could now use some pointers on how to set up the mail-crypt plugin for pure virtual accounts (i.e. that have no matching system users and/or home directories. I hope somebody can clarify a few things that are not entirely clear to me yet. After doing my own research, I believe the following should be possible: I'd like to use the password of virtual email accounts to let dovecot encrypt/decrypt the keys needed to encrypt/decrypt the mail in the relevant folders. As per the documentation @ https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ I believe this would be all the configuration I need: # Config mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_curve = secp521r1 # or some other preferred curve mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes # necessary for encrypting keys with user password } # File: /etc/dovecot/dovecot-sql.conf.ext password_query = SELECT \ email as user, password, \ '%w' AS userdb_mail_crypt_private_password \ FROM virtual_users WHERE email='%u'; My first question is: Is it possible to configure mail_attribute_dict in such a way as to not use home directories. Since I only use virtual accounts, without those accounts having home directories, can I somehow tell dovecot to save the attributes into the PostsreSQL database, for instance? If not, can you suggest another approach, without having to create home directories for virtual users? My second question is: The documentation warns about not using password directly in the above SQL query: > Choosing encryption key > DO NOT use password directly. It can contain % which is interpreted as > variable expansion and can cause errors. Does this refer to not accidentally substituting '%w' with password? In other words, if I leave the above query as is, should I be good, even if plain text passwords of users potentially have % signs in them? Or would I need to take further measurements? (The passwords in my database are already hashed, by the way). I hope somebody can offer some guidance on this. Thanks.

2 7

bug report: imap-login not killed
by Sacha 05 Mar '23

05 Mar '23

Hi, We have growing imap-login processes until we reach the max processes. This occurs when a particular user have a login error due to our LDAP misconfiguration: --- Mar 4 14:59:33 hera dovecot[2226963]: auth: Error: plain(john.doe,XX.XX.XX.XX,<13C0eBP2354lqXpO>): user not found from any userdbs Mar 4 14:59:33 hera dovecot[2226963]: imap: Error: auth-master: login: request [1001652225]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=1001652225 (auth connected 2 msecs ago, request took 1 msecs, client-pid=2235348 client-id=1) Mar 4 14:59:33 hera dovecot[2226963]: imap-login: Internal login failure (pid=2235348 id=1): user=<ohn.doe>, method=PLAIN, rip=XX.XX.XX.XX, lip=18 5.233.100.1, mpid=2235359, TLS, session=<13C0eBP2354lqXpO> --- The origin of is issue is when passdb finds the user and userdb not. The result is imap-login processes with no timeout growing until we reach the max processes. * OS version Debian stable - Bullseye * Dovecot version dpkg -l |grep dovecot ii dovecot-antispam 2.0+20171229-1+b7 amd64 Dovecot plugins for training spam filters ii dovecot-common 1:2.1.7-7+deb7u1 all Transitional package for dovecot ii dovecot-core 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - core files ii dovecot-core-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-core ii dovecot-imapd 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - IMAP daemon ii dovecot-imapd-dbgsym 1:2.3.13+dfsg1-2+deb11u1 amd64 debug symbols for dovecot-imapd ii dovecot-ldap 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - LDAP support ii dovecot-managesieved 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - ManageSieve server ii dovecot-mysql 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - MySQL support ii dovecot-pop3d 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - POP3 daemon ii dovecot-sieve 1:2.3.13+dfsg1-2+deb11u1 amd64 secure POP3/IMAP server - Sieve filters support * doveconf -n --- # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) doveconf: Warning: service auth { client_limit=1000 } is lower than required under max. load (4096) doveconf: Warning: service anvil { client_limit=1000 } is lower than required under max. load (4099) # OS: Linux 5.10.0-21-cloud-amd64 x86_64 Debian 11.6 ext4 # Hostname: XXX auth_mechanisms = plain login default_process_limit = 1024 first_valid_gid = 8 first_valid_uid = 109 last_valid_gid = 8 last_valid_uid = 109 login_greeting = XXX listening. mail_access_groups = mail mail_gid = 8 mail_location = maildir:/srv/vmail/%d/%n mail_privileged_group = mail mail_uid = 109 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy i nclude variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify imapsieve vnd.dovecot.imapsieve vnd.dovecot.filter namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-oauth2.conf.ext driver = oauth2 mechanisms = xoauth2 oauthbearer } plugin { quota_rule = *:storage=100M quota_rule2 = Trash:storage=10%% recipient_delimiter = + sieve = /srv/vmail/%d/%n/dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = /srv/vmail/%d/%n/sieve sieve_extensions = +notify +imapflags +vnd.dovecot.filter sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter sieve_global_extensions = +vnd.dovecot.pipe sieve_max_script_size = 1M sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_pipe_socket_dir = sieve-pipe sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = orig_recipient } protocols = imap pop3 sieve service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0600 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = vmail } unix_listener auth-userdb { group = mail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 0 } } service imap { vsz_limit = 1 G } service lmtp { executable = lmtp -L process_min_avail = 2 } service pop3-login { inet_listener pop3 { port = 0 } } ssl_cert = </srv/letsencrypt/pem/mail.aquilenet.fr.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } userdb { args = /etc/dovecot/dovecot-ldap-girondix.conf driver = ldap } protocol lmtp { auth_username_format = %n info_log_path = /var/log/dovecot-lmtp.log mail_plugins = " sieve" } protocol lda { mail_plugins = " mailbox_alias sieve" } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep imap_idle_notify_interval = 30 secs mail_max_userip_connections = 50 mail_plugins = quota mailbox_alias imap_quota } protocol pop3 { mail_plugins = quota mailbox_alias acl pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } ---

2 2

Multiple scripts with postlogin
by Dan Conway 03 Mar '23

03 Mar '23

Hello, I'm having trouble understanding how to execute separate scripts with postlogin. According to the documentation, it should be as simple as: You can run multiple post-login scripts by just giving multiple scripts as parameters to|script-login|, for example: executable = script-login rawlog /usr/local/bin/postlogin.sh /usr/local/bin/postlogin2.sh Given this information, I supplied two scripts to service imap-postlogin below: service imap { executable = imap imap-postlogin } service imap-postlogin { executable = script-login -d rawlog /usr/local/bin/postlogin.pl /usr/local/bin/postlogin2.pl user = $default_internal_user unix_listener imap-postlogin { } } Both scripts simply print "Script 1" and "Script 2" to STDERR. Here is what they look like: #!/usr/bin/perl use strict; use warnings; print STDERR "Script 1\n"; system("/usr/lib/dovecot/script-login"); After logging in, only the first script is executed. The second one is ignored. I tried not executing "/usr/lib/dovecot/script-login" in the first script, in hopes that it would execute the second script, but it only denies the connection after printing "Script 1" imap-postlogin: Error: Script 1 imap(<user>): Error: Post-login script denied access to user <user> Am I missing something? Thanks.

2 1

OAuth2: local validation with RFC9068 tokens
by Tomas Habarta 01 Mar '23

01 Mar '23

Hello, my IdP is kind of progressive and implemented RFC9068, where all access tokens now come with typ "at+JWT". Since the setup has used local validation, I had to switch and currently use introspection endpoint. Looked around at the src and there seems to be relatively simple check of the token typ checking the only fixed value of "JWT" -- do you think you could consider tuning it a little bit so that local validation works also with such tokens? I am not an expert on OAuth2 so have no idea whether this is a valid request, but think that such a token is still JWT but has the required structure per RFC, which should not anyhow be in collision with a simple "JWT" typ. Saying that, I would not wonder if the statement is not correct :) Many thanks, Tomas

1 0

Can't receive mail before connecting with mutt and sending mail
by efeizbudak 01 Mar '23

01 Mar '23

Hi everyone, I've recently set up an email server. I also have mail crypt plugin and the users are set up through pam. The problem is that whenever I set up a new user, it can send mail but not receive it until the account is connected with mutt and at least one mail is sent. I've noticed that the mail_attribute_dict file is also not set up before doing this. One peculiar thing about all this is that if an account is connected through the stock android email app, the same "send email to get email" trick does not work. How can I debug this? Thank you! -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

1 0

"sh: doveadm: command not found" with doveadm -Dv backup -R
by James Brown 01 Mar '23

01 Mar '23

I’m moving from an old mail server to a new one. On the new one, trying to transfer mailboxes from the old machine using doveadm. It fails saying it can’f find doveadm: % sudo doveadm -Dv backup -R -u myuser(a)bordo.com.au remote:mail.bordo.com.au Password: Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Feb 28 12:42:02 Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so, 0x000A): symbol not found in flat namespace '_acl_backend_nonowner_lookups_iter_deinit' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so, 0x000A): symbol not found in flat namespace '_quota_get_resource' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so, 0x000A): symbol not found in flat namespace '_fts_backend_lookup' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: dlopen(/usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so, 0x000A): symbol not found in flat namespace '_mail_crypt_acl_secure_sharing_enabled' (this is usually intentional, so just ignore this message) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Started userdb lookup Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb: Connecting Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Client connected (fd=9) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): auth USER input: myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: auth-master: userdb lookup(myuser(a)bordo.com.au): Finished userdb lookup (username=myuser(a)bordo.com.au home=/usr/local/virtual/bordo.com.au/myuser mail=maildir:/usr/local/virtual/bordo.com.au/myuser uid=102 gid=102 quota=*:storage=0) Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: mail=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au)<76814><>: Debug: Added userdb setting: plugin/quota=*:storage=0 Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Effective uid=102, gid=102, home=/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/stat) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: open(/proc/self/io) failed: No such file or directory Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: maildir++: root=/usr/local/virtual/bordo.com.au/myuser, index=, indexpvt=, control=, inbox=/usr/local/virtual/bordo.com.au/myuser, alt= Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: brain M: Namespace has location maildir:/usr/local/virtual/bordo.com.au/myuser Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Mailbox INBOX: Couldn't open mailbox in list index: Mailbox not found Feb 28 12:42:02 doveadm(myuser(a)bordo.com.au): Debug: Namespace : Using permissions from /usr/local/virtual/bordo.com.au/myuser: mode=0700 gid=default (root(a)mail.bordo.com.au) Password: sh: doveadm: command not found Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: read(mail.bordo.com.au) failed: EOF (version not received) Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Error: Remote command returned error 127: ssh mail.bordo.com.au doveadm dsync-server -umyuser(a)bordo.com.au -U Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: User session is finished Feb 28 12:42:06 dsync-local(myuser(a)bordo.com.au)<SJq/Iepb/WMOLAEAiJz6GQ>: Debug: auth-master: conn unix:/usr/local/var/run/dovecot/auth-userdb (uid=0): Disconnected: Connection closed (fd=9) Does this mean the remote machine can’t fine doveadm? (Both machines are running macOS) I could probably transfer the mailboxes using rsync, but I thought that doveadm was a better way. Thanks, James.

2 2

Re: Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

1 0

Auth variables unknown variable -- about to go crazy
by efeizbudak 28 Feb '23

28 Feb '23

Hi everyone, I'm trying to configure my email server to encrypt mails on a per user basis. I have the following in my conf: mail_plugins = $mail_plugins mail_crypt mail_attribute_dict = file:%h/Mail/dovecot-attributes plugin { mail_crypt_curve = secp521r1 mail_crypt_save_version = 2 mail_crypt_require_encrypted_user_key = yes mail_crypt_private_password = %N{password} } And I'm getting %password unknown variable error. I use pam to store the passwords. All I want is to be able to hash the user password and use that to encrypt/decrypt the keys. Can someone _please_ help me? -- All the best, Efe The funny quote of this email is trivial and left as an exercise.

2 1

re: "Timeout (180s) while waiting for lock for transaction log file" since 2.3 upgrade?
by graeme vetterlein 26 Feb '23

26 Feb '23

This is an old thread (but still the best search match for the error message). Several other people pointed at NFS, so it got me to look. Indeed what appear to happen (for me at least) was .... The folders being imapped, some of them were on a NFSv3 mount. The NFS server had been shutdown. The imap process appeared to hang (presumably trying to read from the defunct NFS mount point) this held the lock , so other imap processes (possibly not using NFS) hung awaiting the lock. The "fix" was to bing the NFS server back online ...and as it turned out restart a number of things like autofs and dovecot (Normally NFS clients just carry on, so the timeout must have affected things) My long-term fix came from: https://docs.oracle.com/cd/E19620-01/805-5233/z400163399f/index.html Namely to add -soft in /etc/auto_master This should cause a "fail" instead of a hang. -- Graeme

1 0

Cannot reach documentation site
by Ken Bass 26 Feb '23

26 Feb '23

doc.dovecot.org does not have a DNS entry. It worked a few days ago, but not now.

3 3

quota groups
by Ken Young 26 Feb '23

26 Feb '23

Hello, How can I set up groups to give each group a different quota? for example, group A has mail storage 1GB, and users in this group get 1GB quota etc. Thanks. Ken Y

1 0

Small suggestion for improvement of pigeonhole/imapsieve documentation
by Matthias Petermann 25 Feb '23

25 Feb '23

Hello all, this is my first post on this list and I would like to introduce myself briefly. My name is Matthias and I am from Saxony in Germany. I'm working with Unix and mail systems for a long time - actually with focus for NetBSD and Cyrus IMAP. Occasionally I also use Dovecot, which has several reasons. Today, one of the reasons was that I would like to trigger Sieve scripts when moving mail within mailbox folders - i.e. at an unspecified time after the actual mail arrival. In doing so, I came across the imapsieve extension for Pigeonhole fairly quickly and decided that the administrative Sieve scripts in imapsieve were exactly what I needed. However, despite having debug logging fully up, I couldn't figure out until just now why my sieve script wasn't running despite having IMAP events logged. Even intentionally defining an invalid script did not result in an error, so it seemed to be ignored altogether. Until I just now came across that I seem to have misunderstood the documentation. The template shown for the imapsieve_mailboxXXX_ parameters suggested to me that a sequence number of three digits must / can be specified here. Thus, I started numbering my parameters with imapsieve_mailbox001. However, while researching in various forums, I came across only examples that use imapsieve_mailbox1_ as the first parameter. In desperation I tried this out - now it works for me, too. Long story short - I don't know if I'm the only one who has made this mistake so far. A little hint in the documentation[1] would have helped me, how the XXX is meant exactly. I am referring to this section: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` What do you think about adding a small explanatory sentence to the documentation? For example: ``` This setting configures the name of a mailbox for which administrator scripts are configured. The `XXX’ in this setting is a sequence number, which allows configuring multiple associations between Sieve scripts and mailboxes. The sequence number must begin with the digit 1 without preceding zeros and may have a maximum of three digits. The settings defined hereafter with matching sequence numbers apply to the mailbox named by this setting. The sequence of configured mailboxes ends at the first missing imapsieve_mailboxXXX_name setting. This setting supports wildcards with a syntax compatible with the IMAP LIST command, meaning that this setting can apply to multiple or even all (“*”) mailboxes. ``` Many greetings Matthias [1] https://doc.dovecot.org/configuration_manual/sieve/plugins/imapsieve/

1 0

Restored mail folders conflict with renamed original ones
by Nikolaos Milas 24 Feb '23

24 Feb '23

Hello, We are running Dovecot 2.3.18 (together with Postfix) on CentOS 7. It uses a Maildir structure. We have a user who has organized his mailbox as shows up at the end of this mail. The user had forgotten that he had renamed his "Grants Active \ European" (.Grants Active.European) folder to "Grants Active \ International" (.Grants Active.International), he thought that it was lost and requested a restore of "Grants Active \ European" (with all of its subfolders) from backup. Since we did that (using a simple "cp -rp" from a backup, observing timestamps, ownership and permissions), mail client software won't see "European" mail folder in "Grants Active" mail folder; "International" mail folder shows up but only with two folders, those which do not exist in "European" branch (obviously, these were created later). I have tried to run the command "doveadm index -u userx Grants\ Active" and likewise for each and every mail subfolder under "Grants\ Active"; I have also tried deleting the dovecot.index.cache and dovecot.index.log from the latter ("Grants\ Active") and then run: doveadm -vD force-resync -u userx Grants\ Active but it didn't do the trick: Mail clients are still stuck as I explained. In the end, I thought that the snag might be that mail folders that are not appearing have identical (duplicate) UIDs; As an example: [root@mailx .Grants Active.European]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d [root@mailx .Grants Active.European]# cd .. [root@mailx Maildir]# cd .Grants\ Active.International [root@mailx .Grants Active.International]# cat dovecot-uidlist 3 V1548680759 N1 G64e70a1130343f61003c0000715faa8d If so, how should we overcome this issue? I guess I could simply delete the restored folders to return to an acceptable state? If nevertheless we need to restore the ".European" mail folder from a backup (as it was before getting renamed), what would be the right way to do so? Is there another way to resolve the issue without deleting the restored mail folders? Here is the list of mail folders in this mailbox (I have intentionally removed lots of them, to reduce irrelevant content; this mailbox includes a large number of mail folders): # doveadm mailbox list -u userx IGARSS 2024 IAC2022 Junk ... Junk E-mail INBOX.EMISSION ... Trash Trash.Equality Trash.sadf ... Grants Active Grants Active.European Grants Active.European.URBAN RELEAF Grants Active.European.SMURBS Grants Active.European.SMURBS.In Kind Grants Active.European.SMURBS.Final Reports Grants Active.European.RI-URBANS Grants Active.European.QA4EO Grants Active.European.ATMO-ACCESS Grants Active.European.IGOSP Grants Active.European.GAUSS Grants Active.European.E-SHAPE Grants Active.European.CIROCCO Grants Active.European.InCASE Grants Active.European.EIFFEL Grants Active.European.ARSINOE Grants Active.International Grants Active.International.2324 Grants Active.International.GAUSS Grants Active.International.CIROCCO Grants Active.International.IGOSP Grants Active.International.ATMO-ACCESS Grants Active.International.URBAN RELEAF Grants Active.International.InCASE Grants Active.International.ARSINOE Grants Active.International.RI-URBANS Grants Active.International.E-SHAPE Grants Active.International.EIFFEL Grants Active.International.QA4EO Grants Active.International.SMURBS Grants Active.International.SMURBS.Final Reports Grants Active.International.SMURBS.In Kind Grants Active.International.India Grants Active.Urban ReLeaf Grants Active.National Grants Active.National.ΑΓ ΠΑΡΑΣΚΕΥΗ Grants Active.National.ΠΕΤΡΟΥΠΟΛΗ Grants Active.National.CLIMATTICA Grants Active.National.ΝΑΥΠΛΙΟ Grants Active.National.ΕΔΒΜ Grants Active.National.PANGEA Grants Active.National.ΕΛΙΔΕΚ Grants Active.National.ΕΛΙΔΕΚ.OXONIAN - Δέσποινα Grants Active.National.ΕΛΙΔΕΚ.Νασια PhD Grants Active.National.CLIMPACT Sent ... INBOX Please, provide some guidance on what we should do to make these mail folders work correctly again. Sorry, I am not very knowledgeable on mail inner architecture and operations; please let me know if you need additional info. Thanks in advance, Nick

2 6

How to get a server listed in the IMAP Test wiki?
by Leander Beernaert 24 Feb '23

24 Feb '23

Hey, We recently announced Gluon (https://github.com/ProtonMail/gluon/) our IMAP server library we are using in Proton Bridge(https://github.com/ProtonMail/proton-bridge). We would love to have it have it listed in the IMAP Server Compliancy Status wiki page (https://imapwiki.org/ImapTest/ServerStatus) What do we need to do or whom do we need to contact to make this happen? Additionally, We have been using running imaptest (https://github.com/dovecot/imaptest) against our server library, but due to variety of configuration parameters, we would really appreciate it (if possible) if someone could point out to us the test setup used to validate each of those servers. Thank you in advance for your time. Kind Regards, Leander Beernaert Proton AG

4 6

creating a mailbox via imap
by Gabriele Bulfon 23 Feb '23

23 Feb '23

Hi, is there any way with Dovecot to open an admin imap connection and create a brand new mailbox? With Cyrus imapd I can do this by connecting as the Cyrus admin user and then create a folder "user/newuser(a)domain.tld". Thanks Gabriele Sonicle S.r.l. : http://www.sonicle.com Music: http://www.gabrielebulfon.com eXoplanets : https://gabrielebulfon.bandcamp.com/album/exoplanets

3 2

doveadm sending invalid AUTHENTICATE to uw-imap
by Chris Candreva 23 Feb '23

23 Feb '23

I'm migrating a legacy uw-imap system to Dovecot, on a Rocky (RHEL) 8 server running Dovecot 2.3.16-3 from their repos. I am using a master user to import all users for an imaps connection from the old server to the new. On a trial run however, it worked for about half the users. Half are giving an error of the form: dsync(user): Error: imapc(host:993): Command '1 AUTHENTICATE PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' failed with BAD: 1 Missing or invalid argument to AUTHENTICATE I can't seem to get the IMAP command for the users that did work. However, on the face of it, that is an invalid AUTHENTICATE command. If I take that string and brake it up into (what I've googled is) the proper form of multi-command form of 1 AUTHENTICATE PLAIN + xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx then the login succeeds. I have not been able to find anyone else with this problem in my search. Is this a known issue, is there a way to force the multi-line AUTHENTICATE, something else I'm missing ? Any help is appreciate on this! -Chris -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

3 4

Redundant Database, Pgsql ?
by Paul Kudla 23 Feb '23

23 Feb '23

I am aware that there are provising for redundant database connections Basically i was working on my main db server (which is also a mail sever) I current have this in the dovecot-pgsql.conf ______________________________________________________________________ driver = pgsql connect = host=localhost port=5433 dbname=scom_billing user=pgsql password=xxxxxxxxx default_pass_scheme = PLAIN password_query = SELECT username as user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' user_query = SELECT home, uid, gid FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' #iterate_query = SELECT user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' iterate_query = SELECT "username" as user, domain FROM email_users WHERE status = True and alias_flag = False _______________________________________________________________________ Basically I have replicaed servers all over the place but mail18 (because dovecot only knows of one db instance) went down as well. May I please get some guidance on what to add to talk to another postgresql server (i have 6 replicated servers so would probably want a couple worst case issue) -- Happy Sunday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

10 13

Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?
by mailinglist-subscriptions 23 Feb '23

23 Feb '23

Hi, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. I'd like to start using the mail-crypt plugin. However, I'm having a bit some difficulty understanding the documentation at https://doc.dovecot.org/configuration_manual/mail_crypt_plugin to reach my goal. I plan to ask questions about those issues by starting new threads in this mailing list. But before I even come to that, I'd like to investigate the following: The above documentation only addresses a clean install and doesn't seem to mention encrypting already existent unencrypted mails, like my server has. Is it possible to encrypt those before I start using the mail-crypt plugin, such that it will be able to decrypt those messages as well? If it is, I am assuming that how I would go about achieving that will be very dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). So I don't expect a full-fledged guide. However, if you could perhaps give a general overview of what would be needed to achieve this, I would very much appreciate that. Thank you.

4 4

Re: Auth-worker, unknown scheme ARGON2ID
by James Brown 22 Feb '23

22 Feb '23

On 21 Feb 2023, at 10:12 pm, James Brown <jlbrown(a)bordo.com.au> wrote: > > The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: > > Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) > Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID > > ./configure --with-ssl=openssl --with-mysql > > Was what I used to compile. > > Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. > > (Have also installed libsodium 1.0.18_1) > > Any help would be most appreciated. > > thanks, > > James. I’ve spent ages on this and am getting really desperate! :-( CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.0.8/include LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql ... Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : kqueue I/O notifys .... : kqueue SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file pam checkpassword sql : -shadow -bsdauth -ldap userdbs ........ : static prefetch passwd passwd-file checkpassword sql sudo doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 How do I get ARGON2I, ARGON2ID in that list? Has anybody got Dovecot to work on recent macOS with these password schemes? Any hints? Thanks, James.

2 8

Auth-worker, unknown scheme ARGON2ID
by James Brown 21 Feb '23

21 Feb '23

On my current mail server I was able to upgrade everyone’s password scheme to ARGON2ID with no issues, I just had to have: service auth { vsz_limit = 0 } This was an older version of macOS than the new server I’m trying to migrate to. The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID ./configure --with-ssl=openssl --with-mysql Was what I used to compile. Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. (Have also installed libsodium 1.0.18_1) Any help would be most appreciated. thanks, James.

1 0

service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument macOS
by James Brown 21 Feb '23

21 Feb '23

I fixed the issue with Dovecot not starting on macOS Ventura by adding this to 10-master.conf: service log { vsz_limit = 0 } But now when I try to login via Imap on port 143 I get the same error for imap-login: Feb 20 15:55:41 imap-login: Error: Feb 20 15:55:41 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 15:55:41 imap-login: Fatal: master: service(imap-login): child 11781 returned error 89 (Fatal failure) Feb 20 15:55:41 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Feb 20 16:13:04 imap-login: Error: Feb 20 16:13:04 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 16:13:04 imap-login: Fatal: master: service(imap-login): child 20370 returned error 89 (Fatal failure) Feb 20 16:13:04 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Config: sudo /usr/local/sbin/dovecot -n # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 22.3.0 arm64 apfs # Hostname: mail-server-mac-studio.local auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes default_internal_group = mail default_internal_user = _dovecot default_login_user = _dovenull first_valid_gid = 0 first_valid_uid = 102 last_valid_gid = 501 last_valid_uid = 105 log_path = /var/log/dovecot.log mail_gid = 102 mail_location = maildir:/usr/local/virtual/%d/%u mail_uid = 102 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { mode = 0660 user = _vmail } } service imap-login { vsz_limit = 0 } service log { vsz_limit = 0 } ssl_cert = </etc/letsencrypt/live/mail.bordo.com.au/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 40 } Quitting Dovecot and restarting and I now get: Feb 20 17:01:11 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 20 17:01:11 master: Error: service(anvil): command startup failed, throttling for 2.000 secs Then trying to connect on port 143 log says: Feb 20 17:20:08 master: Error: service(config): command startup failed, throttling for 2.000 secs Feb 20 17:20:08 config: Error: Feb 20 17:20:08 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 anvil: Fatal: master: service(anvil): child 43250 returned error 89 (Fatal failure) Feb 20 17:20:08 config: Fatal: master: service(config): child 52530 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Fatal: master: service(stats): child 52531 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Error: Feb 20 17:20:08 service(stats): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 master: Error: service(stats): command startup failed, throttling for 2.000 secs Feb 20 17:20:10 config: Error: Feb 20 17:20:10 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:10 config: Fatal: master: service(config): child 52532 returned error 89 (Fatal failure) Feb 20 17:20:10 master: Error: service(config): command startup failed, throttling for 4.000 secs Feb 20 17:20:10 imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: EOF - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Feb 20 17:20:10 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Any suggestions? This is really driving me crazy! thanks, James.

2 1

Get correct subjects in summary but wrong article body after transitioning between servers
by Steinar Bang 19 Feb '23

19 Feb '23

I am transitioning between servers (both debian 11.6 with dovecot 2.3.13) and I'm seeing some strange behaviour after the transition: it seems like dovecot is listing the correct subject for the test messages I'm sending in what's shown in my MUA's summary. But the body of the message is an old message. Dovecot is serving messages from Maildir folders in the users' home directories. And I may have messed up some things here: I rsynced the maildirs and then still got some deliveries both places when the MX records were in transition, so I did a belated rsync, thinking that "Maildir can handle that". But I weren't thinking about the dovecot files, ie: drwx------ 2 sb sb 155648 Feb 11 06:43 cur -rw------- 1 sb sb 30 Nov 23 18:14 dovecot-keywords -rw------- 1 sb sb 116407 Feb 11 06:43 dovecot-uidlist -rw------- 1 sb sb 8 Feb 28 2022 dovecot-uidvalidity -rw------- 1 sb sb 0 Mar 17 2011 dovecot-uidvalidity.4d821095 -rw------- 1 sb sb 38016 Jan 31 15:38 dovecot.index -rw------- 1 sb sb 203852 Feb 5 21:37 dovecot.index.cache -rw------- 1 sb sb 15076 Feb 11 06:43 dovecot.index.log -rw------- 1 sb sb 6424 Feb 4 08:06 dovecot.list.index -rw------- 1 sb sb 7796 Feb 11 06:43 dovecot.list.index.log -rw------- 1 sb sb 3048 Mar 6 2022 dovecot.mailbox.log drwx------ 2 sb sb 4096 Feb 11 06:43 new -rw------- 1 sb sb 738 Mar 6 2022 subscriptions drwx------ 2 sb sb 4096 Feb 6 22:05 tmp Are there any of these that could have been adversely affected by the rsync? Will regenerating these files fix the behaviour where I get the wrong article when fetching them? What is the best way to regenerate them? Can these feil be safely deleted and will be autogenerated? (I also see that some of these files are quite old. I had another server transition in 2017, so the files from 2011 has been rsynced into that server and not touched since) Thanks! - Steinar

1 2

Roundcube <-> Dovecot timeouts under very moderate load on big Dovecot nodes
by Malte Schmidt 18 Feb '23

18 Feb '23

Due to a recent topic regarding the performance of the Roundcube webmailer with Dovecot as a backend, I set up imapproxy successfully, shrinking the response latency of the webmailer heavily, which is great. However, I still encounter strange timeouts on some requests when Roundcube tries to access Dovecot. Be it for authentication or to FETCH data. I run the tests/benchmarks via distributed JMeter from 4 nodes, they access the webmailer which in turn accesses the Dovecot via imapproxy. There are 16 different mailaccounts spread over two dovecot nodes with the first one acting as a proxy if the account resides on the second. The problems start at around 100 concurrent users and gets worse the more users are added. The timeouts make up for a small percentage of the requests (0.0something percent). The timeout is reached after 30 seconds of Dovecot not answering, due to the timeout set in the webserver the webmailer is running on. Now I am wondering how to further debug this and what could be the reason. Some requests towards Dovecot are certainly taking longer than 30 seconds, while the average request takes mostly less than 1. The Dovecot is running on two big hardware machines with 48 cores, 96G memory and SSD storage. The load on the Dovecot nodes while the test is running is minimal. Best regards, M. Schmidt

1 0