- dovecot - dovecot.org

Auto Subscribe not working for LDA/Sieve created Mailbox?
by Larry Rosenman 25 Feb '20

25 Feb '20

I have auto-subscribe turned on, but I had to doveadm mailbox subscribe to a LDA/Sieve created mailbox today. Did something break? doveconf -n attached. FreeBSD dovecot-2.3.9.3 Secure, fast and powerful IMAP and POP3 server dovecot-pigeonhole-0.5.9_1 Sieve plugin for the Dovecot 'deliver' LDA and LMTP -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 (c) E-Mail: larryrtx(a)gmail.com US Mail: 5708 Sabbia Dr, Round Rock, TX 78665-2106

2 4

doveadm(nfsnobody) Error
by 横山航平 23 Feb '20

23 Feb '20

Please tell me about maillog Error. I get the following error in maillog：－－－ dovecot: doveadm(nfsnobody): Error: sync: User init failed dovecot: doveadm(nfsnobody): Error: User initialization failed: Namespace '': mkdir(/var/lib/nfs/Maildir) failed: Permission denied (euid=65534(nfsnobody) egid=65534(nfsnobody) missing +w perm: /var/lib/nfs, dir owned by 0:0 mode=0755) －－－ I am using Dsync and the configuration is below：－－－ service replicator { process_min_avail = 1 } dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u plugin { mail_replica = remote:root@XXX } service aggregator { fifo_listener replication-notify-fifo { mode = 0777 } unix_listener replication-notify { mode = 0777 } } service replicator { unix_listener replicator-doveadm { mode = 0600 } } replication_max_conns = 10 plugin { # When saving a new mail via IMAP or delivering a mail via LDA/LMTP, # wait for the mail to be synced to the remote site. If it doesn't finish # in 2 seconds, return success anyway. # replication_sync_timeout = 2s } －－－ Is the Dsync setting bad? please tell me.

2 1

Help needed with managesieve
by Laura Smith 22 Feb '20

22 Feb '20

Hi, I'm really struggling with the following inbound filtering: Let's say:• My email address is "my.email(a)example.com" • I've setup a filtered address "filtered.email(a)example.com" • I've setup a sending/reply address "send.email(a)example.com" I am sending a message to a small group of people where detailed tracking is required (yes, I know there are better automated ways outside of Dovecot to do this... but let's leave that topic for another day shall we !) My desired action is as follows : • Message "From" shows "send.email(a)example.com" • Message "To" is set as "filtered.email(a)example.com" • General recipients in Bcc When I send a test to an *external* address, it works as expected, i.e. : • External address receives mail in its inbox • Copy of mail gets put in relevant IMAP folder for "filtered.email(a)example.com" When I send a test to my own address, it does not work, the following happens instead: • Copy of mail gets put in relevant IMAP folder for "filtered.email(a)example.com" (this is good and as expected) • The BCC "my.email(a)example.com" never gets deposited in my inbox (this is not good) My dovecot sieve (as applied to "my.email(a)example.com") is as follows (I have tried both with and without the "stop" as you can see from the comment: anyof (address :is :all "to" ["send.email(a)example.com"], header :contains ["Cc", "Delivered-To"] ["send.email(a)example.com"]) { fileinto :create "XYZmail-replies"; # Ignore stop for this rule only # stop; } elsif anyof (address :is :all "to" ["filtered.email(a)example.com"], header :contains ["Cc", "Delivered-To"] ["filtered.email(a)example.com"]) { fileinto :create "XYZmail-sent"; # Ignore stop for this rule only # stop; }

2 1

Strategy for fts and Replication
by Francis Augusto Medeiros-Logeay 22 Feb '20

22 Feb '20

Hi there, I got successfully to replicate my mail server to another dovecot install using dsync, mainly for redundancy, and it works great. I want to try to install fts, as some of the mailboxes have tens of thousands of messages, and it takes minutes to get some results when searching via IMAP on a Roundcube interface. I want to experiment with fts-solr first, and firstly on my redundant server, ie., not on my main dovecot install. Is it ok to do this? I ask because I am afraid of how this whole reindexing on the redundant install will affect the production server. Also, any tips on something else than fts-solr? I tried it once, but it was so hard to get it right, so many configurations, java, etc., that I'd rather try something else. I also could try fts-elastic or something like that, but, again, having to maintain an elasticsearch install might use more resources than I think is worth. Any thoughts on that? Best, -- Francis

6 10

My sieve is failing
by ＠lbutlr 21 Feb '20

21 Feb '20

I have an active sieve file for my list account that alters the headers for this list (sets the reply-to address to the list instead of the poster) which is suddenly failing. require [ "regex", "variables", "fileinto", "envelope", "mailbox", "imap4flags", "editheader" ]; /* other stuff */ elsif header :contains "List-id" "dovecot.dovecot.org" { if header :matches "Reply-to" "*" { deleteheader "From"; addheader "From" "${1}"; deleteheader "Reply-To"; addheader "Reply-To" "dovecot(a)dovecot.org"; addheader "X-Covisp-Reply-To" "True"; } fileinto :create "dovecot"; stop;} And the trace file: 55: header test 55: starting `:contains' match with `i;ascii-casemap' comparator: 55: extracting `List-id' headers from message 55: matching value `Dovecot Mailing List <dovecot.dovecot.org>' 55: with key `dovecot.dovecot.org' => 1 55: finishing match with result: matched 55: jump if result is false 55: not jumping 56: header test 56: starting `:matches' match with `i;ascii-casemap' comparator: 56: extracting `Reply-to' headers from message 56: finishing match with result: not matched 56: jump if result is false 56: jumping to line 63 63: fileinto action 63: store message in mailbox `dovecot' 64: stop command; end all script execution ## Finished executing script '.active_sieve’ Neither the reply-to header nor the x- header are actually getting added, but the block is getting executed and the mail is filed in the right folder. In dovecot.conf I (still) have: managesieve_sieve_capability = editheader fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave

1 1

Test failure on ARM: backtrace_append
by Julien Lepiller 21 Feb '20

21 Feb '20

Hi, I am a packager in Guix and user of dovecot on an ARM server (armhf). The Guix package fails to build because of a test error (see the last lines of the full build log: https://ci.guix.gnu.org/log/f5if2qb5rsqag3a6jy5vga1l9hm9pkj0-dovecot-2.3.9.3) As the name suggests, this is dovecot 2.3.9.3, the latest version. Previous versions built fine, as well as the same version on x86 and x86_64. Note that the build on guix's build farm was done in a qemu vm, but I got the same test failure on real hardware. I'm not sure what the best course of action is. Did I find a legitimate bug, or should I simply ignore that test for that architecture? Dovecot itself seems to be running fine when I ignore the tests. Thanks for any guidance you could provide!

2 8

How does dovecot determine users from /etc/passwd?
by Philip Colmer 20 Feb '20

20 Feb '20

We're using dovecot on a help desk ticketing system. The system doesn't perform any cleanup of IMAP mailboxes so we have a regular cronjob doing this: /usr/bin/doveadm flags add -A '\Deleted' SEEN SENTBEFORE 12w && /usr/bin/doveadm expunge -A DELETED MAILBOX '*' Recently, doveadm has been reporting this: doveadm(nobody): Error: User initialization failed: Namespace '': mkdir(/nonexistent/mail) failed: Permission denied (euid=65534(nobody) egid=65534(nogroup)) doveadm(nobody): Error: User init failed doveadm(DEFAULT-CW-USER): Info: User no longer exists, skipping Indeed, using doveadm user "*" does include "nobody" in the list but I can't understand why. The mail group in /etc/group does not include "nobody" and there are users in /etc/passwd with similar attributes to "nobody" that do not appear in the list of users from doveadm. What can I do to tell doveadm to forget about "nobody"? Thanks. Philip

4 4

BUG: dsync and folder names with "@"
by spamvoll＠googlemail.com 20 Feb '20

20 Feb '20

Hello, dovecot version: 2.3.9.2 When I use dsync: /usr/bin/dsync -v -D -o plugin/quota= -f -u my(a)email.dom backup maildir:/tmp/mailbackup/Maildir it always stops when it comes to a folder with an "@" in its name. Error Message: Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID (maybe it was just deleted?) I dont know if it makes a difference, but my dovecot uses mdbox and the backup export is maildir. Hans

2 2

RE: Unknown setting error with dovecot-sql.conf.ext
by Andy Woolley 20 Feb '20

20 Feb '20

OMG, that was it, so sorry to have wasted your time. The text editor I am using (Ultraedit) is adding a BOM (Byte Order Marker) to the beginning of the file. I have disabled this in settings but it keeps doing it. Thank you so much for pointing me in the right direction. After removing the 3 invisible characters from the dovecot-sql.conf.ext file it magically worked. Andy -----Original Message----- From: Aki Tuomi [mailto:aki.tuomi@open-xchange.com] Sent: 20 February 2020 11:26 To: Andy Woolley <andy(a)milonic.com> Subject: Re: Unknown setting error with dovecot-sql.conf.ext I am unable to reproduce the issue here, can you send me the file itself? Maybe it has some strange thing in it? On 20.2.2020 12.23, Andy Woolley wrote: > > doveconf -n > > # 2.3.9.2 (cf2918cac): /etc/dovecot/dovecot.conf > > # OS: Linux 5.4.19-200.fc31.x86_64 x86_64 Fedora release 31 (Thirty > One) > > # Hostname: data.tia3.com > > auth_mechanisms = plain login > > mail_location = /home/vmail/%d/%n > > mail_privileged_group = mail > > mbox_write_locks = fcntl > > namespace inbox { > > inbox = yes > > location = > > mailbox Drafts { > > special_use = \Drafts > > } > > mailbox Junk { > > special_use = \Junk > > } > > mailbox Sent { > > special_use = \Sent > > } > > mailbox "Sent Messages" { > > special_use = \Sent > > } > > mailbox Trash { > > special_use = \Trash > > } > > prefix = > > } > > passdb { > > driver = pam > > } > > passdb { > > args = /etc/dovecot/dovecot-sql.conf.ext > > driver = sql > > } > > service auth-worker { > > user = vmail > > } > > service auth { > > unix_listener /var/spool/postfix/private/auth { > > group = postfix > > mode = 0660 > > user = postfix > > } > > unix_listener auth-userdb { > > mode = 0600 > > user = vmail > > } > > user = dovecot > > } > > service imap-login { > > inet_listener imap { > > port = 143 > > } > > inet_listener imaps { > > port = 993 > > ssl = yes > > } > > } > > service lmtp { > > unix_listener lmtp { > > group = postfix > > mode = 0600 > > user = postfix > > } > > } > > service pop3-login { > > inet_listener pop3 { > > port = 110 > > } > > inet_listener pop3s { > > port = 995 > > ssl = yes > > } > > } > > ssl = required > > ssl_cert = </etc/letsencrypt/live/intelliset.co.uk/fullchain.pem > > ssl_cipher_list = PROFILE=SYSTEM > > ssl_key = # hidden, use -P to show it > > userdb { > > driver = passwd > > } > > userdb { > > args = /etc/dovecot/dovecot-sql.conf.ext > > driver = sql > > } > > > > > > > > > > dovecot-sql.conf.ext: > > driver = mysql > > connect = host=127.0.0.1 dbname=mail user=foo password=bar > > default_pass_scheme = SHA512-CRYPT > > password_query = SELECT email as user, password FROM users WHERE > email='%u'; > > > > > > > > > > Many thanks, > > Andy > > > > > > *From:*dovecot [mailto:dovecot-bounces@dovecot.org] *On Behalf Of *Aki > Tuomi > *Sent:* 20 February 2020 10:11 > *To:* Andy Woolley <andy(a)milonic.com <mailto:andy@milonic.com>>; > dovecot(a)dovecot.org <mailto:dovecot@dovecot.org> > *Subject:* Re: Unknown setting error with dovecot-sql.conf.ext > > > > > > On 20.2.2020 12.06, Andy Woolley wrote: > > Hi All, > > > > I am trying to install Dovecot connecting to MySQL and all seems to be > working until I try to send/receive. > > > > Im getting a Unknown setting error for anything that is inside > dovecot-sql.conf.ext > > > > dovecot-sql.conf.ext is inside /etc/dovecot and is referenced from > /etc/dovecot/conf.d/auth-sql.conf.ext > > > > The error I get is: > > > > auth: Fatal: sql /etc/dovecot/dovecot-sql.conf.ext: Error in > configuration file /etc/dovecot/dovecot-sql.conf.ext line 1: Unknown > setting: driver > > > > Can anybody help me? > > > > Andy > > > > Post 'doveconf -n' please and the contents of the sql.conf.ext file. > Mind passwords. > > Aki > > > > *From:*dovecot [mailto:dovecot-bounces@dovecot.org] *On Behalf Of *Aki > Tuomi > *Sent:* 20 February 2020 10:11 > *To:* Andy Woolley <andy(a)milonic.com>; dovecot(a)dovecot.org > *Subject:* Re: Unknown setting error with dovecot-sql.conf.ext > > > > > > On 20.2.2020 12.06, Andy Woolley wrote: > > Hi All, > > > > I am trying to install Dovecot connecting to MySQL and all seems > to be working until I try to send/receive. > > > > Im getting a Unknown setting error for anything that is inside > dovecot-sql.conf.ext > > > > dovecot-sql.conf.ext is inside /etc/dovecot and is referenced from > /etc/dovecot/conf.d/auth-sql.conf.ext > > > > The error I get is: > > > > auth: Fatal: sql /etc/dovecot/dovecot-sql.conf.ext: Error in > configuration file /etc/dovecot/dovecot-sql.conf.ext line 1: > Unknown setting: driver > > > > Can anybody help me? > > > > Andy > > > > Post 'doveconf -n' please and the contents of the sql.conf.ext file. > Mind passwords. > > Aki >

1 0

Unknown setting error with dovecot-sql.conf.ext
by Andy Woolley 20 Feb '20

20 Feb '20

Hi All, I am trying to install Dovecot connecting to MySQL and all seems to be working until I try to send/receive. I'm getting a "Unknown setting" error for anything that is inside dovecot-sql.conf.ext dovecot-sql.conf.ext is inside /etc/dovecot and is referenced from /etc/dovecot/conf.d/auth-sql.conf.ext The error I get is: auth: Fatal: sql /etc/dovecot/dovecot-sql.conf.ext: Error in configuration file /etc/dovecot/dovecot-sql.conf.ext line 1: Unknown setting: driver Can anybody help me? Andy

2 2

Flush userdb cache entry
by Tom Sommer 19 Feb '20

19 Feb '20

Hi all I have a problem when users change quota in SQL, the change is not reflected in Dovecot immediately so quota_warning is still triggered on some occasions. I think it's because the quota is stored in userdb, and there is no way to flush userdb cache? Is there a way to flush userdb entries? What controls userdb cache TTL/size? auth_cache entries? I can't seem to find any documentation on this, sadly :( Thanks -- Tom

1 1

Message-id parsing by sieve
by Russell King 19 Feb '20

19 Feb '20

Hi, I'm using Dovecot for my mail with pigeonhole's sieve extension, from debian stable (2.3.4.1 (f79e8e7e4)). One of the sieve stanzas that I use is for duplicate elimination: if duplicate { discard; stop; } This mostly works fine, but I seem to have trouble with some messages that come from certain domains where duplicates are not eliminated. >From /var/log/mail.log, I see: Feb 18 12:48:50 mail dovecot: lmtp(24320:linux@xxx.armlinux.org.uk): sieve: msgid=? <VI1PR04MB513558BF77192255CBE12102B0110(a)VI1PR04MB5135.eurprd04.prod.outlook.com>: stored mail into mailbox 'INBOX' Feb 18 12:49:42 mail dovecot: lmtp(24320:linux@xxx.armlinux.org.uk): sieve: msgid=<VI1PR04MB513558BF77192255CBE12102B0110(a)VI1PR04MB5135.eurprd04.prod.outlook.com>: stored mail into mailbox 'INBOX' The first was received direct from the recipient with a message-id line formatted thusly: Message-ID: <VI1PR04MB513558BF77192255CBE12102B0110(a)VI1PR04MB5135.eurprd04.prod.outlook.com> The second was received from the mailing list with a message-id line formatted thusly: Message-ID: <VI1PR04MB513558BF77192255CBE12102B0110(a)VI1PR04MB5135.eurprd04.prod.outlook.com> It would appear that the parsed message-id value that dovecot uses includes white-space (including newline characters). RFC5322 gives the message-id header format as: message-id = "Message-ID:" msg-id CRLF msg-id = [CFWS] "<" id-left "@" id-right ">" [CFWS] It goes on to say: The message identifier (msg-id) itself MUST be a globally unique identifier for a message. and: Semantically, the angle bracket characters are not part of the msg-id; the msg-id is what is contained between the two angle bracket characters. However, it seems dovecot sieve is using the entire content of the msg-id, including CFWS, as the message id used for detecting duplicate messages. This seems wrong, and appears to lead to duplicates not being detected, and thus seems like a bug. Is there a workaround for this, and/or can it be changed? -- Russell King

2 1

Sieve junks mail script creating links
by ＠lbutlr 19 Feb '20

19 Feb '20

My Junk mailbox is still filling up with hard linked emails. There are some junk mails with over 3000 hard linked files and over half a million files in the .Junk/cur folder. I had a handy script to remove them all by doing a find for inodes and sorting the list by age and keeping the olds hard link and removing all the others, but I now can’t find it :/ so I have just taken to periodically nuking the entire folder, but I’d like to fix this. *everything is current on FreeBSD 12.1-RELEASE => dovecot.conf imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve => /usr/lib/dovecot/sieve/report-spam.sieve: require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.user" "*" { set "username" "${1}"; } pipe :copy "sa-learn-spam.sh" [ "${username}" ]; => /usr/lib/dovecot/sieve/sa-learn-spam.sh: #!/bin/sh exec /usr/local/bin/sa-learn -u ${1} —spam -- When the stars threw down their spears And watered heaven with their tears, Did He smile his work to see? Did He who made the Lamb make thee?

2 1

managesieve / sieve - append dot prefix on moving mails into folder
by Andre Hoepner - i.based: Systemhaus GmbH + Co. KG 18 Feb '20

18 Feb '20

Hello mailinglist-subscribers, i have an issue with the managesieve / sieve plugin in dovecot. We use roundcube as webmailer and if i define a new filter to move incoming mails directly into a subfolder i get the following sieve-code: require ["fileinto","imap4flags"]; # rule:[mail into folder] if allof (header :contains "from" "sender(a)domain.org") { fileinto "Foldername"; setflag "\\Seen"; } So anything seems to be right and there are no errors on creating the correct syntax. But if a mail comes from the named sender, sieve does not put the email in the folder "Foldername" but ".Foldername". It appends a dot (.) in front of the name and i have no idea, why this happens. There are no errors in logfile and all mails go into the .Folder. Maybe it is wrong separator for mailbox, at the moment there is no separator defined in "10-mail.conf" and we use "Maildir" as mail_location. I have also tried to change the target folder in sieve script an named him "INBOX/Monitoring" - as subfolder of INBOX but than i get an error in .dovecot.sieve.log with message: Invalid mailbox name: Name must not have '/' characters. I edited the new rule with roundcube / managesieve-plugin and maybe this needs separate configuration because of separator in foldernames? Please let me know if i should provide any extra information or dovecot configuration etc. best regards Andre Hoepner

3 3

Re: Shared Mailboxes with Multiple Domains
by Daniel Miller 18 Feb '20

18 Feb '20

Any thoughts on this? --- Daniel ------ Original Message ------ From: "Daniel Miller" <dmiller(a)amfes.com> To: "Dovecot Mailing List" <dovecot(a)dovecot.org> Sent: 2/12/2020 6:16:05 PM Subject: Shared Mailboxes with Multiple Domains >Trying to track down a problem I've been dealing with for a while. Everything else works fine - the problem is with shared mailboxes. > >My present, and desired, prefix for the shared namespace is: > prefix = INBOX/shared/%%d/%%n/ > >Some mail clients, particularly Thunderbird and Android's AquaMail, have no problem with this. But other (presumably broken) clients don't show the shared mailboxes. This includes EM Client and Webmail Lite. Actually, Webmail Lite lists the mailboxes in the subscription window, but then the "live"folder list shows "shared" and "shared/domain" but none of the shared mailboxes below the domain. > >Changing to: > prefix = INBOX/shared/%%u/ > >Works across all clients - but I'd rather have the domain separation. Testing with telnet ". LIST '' '*'" yields the full list with either config. > >The files /var/mail/%d/shared-mailboxes contain entries like: >shared/shared-boxes/group/allshared/user(a)domain.com > 1 > > >Below is "doveconf -n" output. > ># 2.3.9.3 (9f41b88fa): /usr/local/etc/dovecot/dovecot.conf ># Pigeonhole version 0.5.9 (db4e9a2f) ># OS: Linux 5.3.0-28-generic x86_64 Ubuntu 18.04.4 LTS ># Hostname: bubba.amfes.lan >auth_cache_size = 4 k >auth_master_user_separator = * >auth_mechanisms = plain login >auth_policy_hash_nonce = # hidden, use -P to show it >auth_policy_hash_truncate = 8 >auth_policy_server_api_header = Authorization: Basic d2ZvcmNlOnVsdHJhLXNlY3JldC1zZWN1cmUtc2FmZQ >default_login_user = nobody >default_vsz_limit = 2 G >disable_plaintext_auth = no >imap_client_workarounds = tb-extra-mailbox-sep >imap_idle_notify_interval = 29 mins >listen = * >login_trusted_networks = 192.168.0.0/24 >mail_attachment_hash = %{sha512} >mail_plugins = fts fts_solr acl zlib virtual >mail_prefetch_count = 10 >mail_shared_explicit_inbox = yes >managesieve_notify_capability = mailto >managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihaveduplicate mime foreverypart extracttext >mdbox_rotate_size = 20 M >namespace archives { > list = children > location = mdbox:/var/mail/%d/%n/Archives/mdbox > mailbox Unsorted { > auto = no > special_use = \Archive > } > prefix = INBOX/Archives/ > separator = / > subscriptions = no > type = private >} >namespace inbox { > hidden = no > inbox = yes > list = yes > location = > mailbox "Deleted Messages" { > auto = no > autoexpunge = 30 days > special_use = \Trash > } > mailbox Drafts { > auto = subscribe > special_use = \Drafts > } > mailbox Sent { > auto = subscribe > special_use = \Sent > } > mailbox "Sent Items" { > auto = no > special_use = \Sent > } > mailbox "Sent Messages" { > auto = no > special_use = \Sent > } > mailbox Trash { > auto = subscribe > autoexpunge = 30 days > special_use = \Trash > } > prefix = INBOX/ > separator = / > subscriptions = no > type = private >} >namespace lists { > list = children > location = mdbox:/var/mail/%d/%n/Lists/mdbox > prefix = INBOX/Lists/ > separator = / > subscriptions = no > type = private >} >namespace subscriptions { > hidden = yes > list = no > location = > prefix = > subscriptions = yes >} >namespace usershares { > list = children > location = sdbox:/var/mail/%%d/%%n/sdbox:NO-NOSELECT > prefix = INBOX/shared/%%d/%%n/ > separator = / > subscriptions = no > type = shared >} >namespace virtual { > list = children > location = virtual:/var/mail/%d/%n/virtual > mailbox Flagged { > comment = All my flagged messages > special_use = \Flagged > } > prefix = INBOX/virtual/ > separator = / > subscriptions = no >} >passdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql >} >plugin { > acl = vfile > acl_shared_dict = file:/var/mail/%d/shared-mailboxes > fts = solr > fts_autoindex = yes > fts_autoindex_exclude = \Trash > fts_autoindex_exclude2 = \Junk > fts_autoindex_exclude3 = \Spam > fts_enforced = no > fts_index_timeout = 20s > fts_solr = url=http://127.0.0.1:8983/solr/dovecot/ > mailbox_alias_new = Sent Messages > mailbox_alias_new2 = Sent Items > mailbox_alias_new3 = Deleted Messages > mailbox_alias_old = Sent > mailbox_alias_old2 = Sent > mailbox_alias_old3 = Trash > sieve = file:~/sieve;active=~/.dovecot.sieve >} >protocols = imap lmtp sieve >service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > unix_listener auth-userdb { > group = mail > mode = 0600 > user = vmail > } >} >service dict { > unix_listener dict { > group = mail > mode = 0660 > user = vmail > } >} >service imap-login { > process_min_avail = 10 > service_count = 1 >} >service imap-postlogin { > executable = script-login /usr/local/etc/dovecot/post-login.sh > user = $default_internal_user >} >service imap { > executable = imap imap-postlogin > vsz_limit = 4 G >} >service indexer-worker { > process_limit = 3 >} >service lmtp { > process_min_avail = 5 > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = mail > mode = 0666 > user = vmail > } >} >service managesieve-login { > inet_listener sieve { > port = 4190 > } > inet_listener sieve_deprecated { > port = 2000 > } > process_min_avail = 0 > service_count = 1 >} >ssl_cert = </etc/ssl/letsencrypt/live/mail.amfes.com/fullchain.pem >ssl_dh = # hidden, use -P to show it >ssl_key = # hidden, use -P to show it >userdb { > driver = prefetch >} >userdb { > args = /usr/local/etc/dovecot/dovecot-sql.conf.ext > driver = sql >} >verbose_proctitle = yes >protocol lmtp { > mail_plugins = fts fts_solr acl zlib virtual sieve > postmaster_address = postmaster(a)amfes.com >} >protocol lda { > mail_plugins = fts fts_solr acl zlib virtual sieve >} >protocol imap { > mail_max_userip_connections = 50 > mail_plugins = fts fts_solr acl zlib virtual imap_acl imap_zlib mailbox_alias >} > > >-- Daniel > >

2 1

Postfix Dovecot Consultant Availability
by Asai 17 Feb '20

17 Feb '20

Greetings, We're in process of upgrading our Postfix / Dovecot installation, and would like to know if there are any qualified consultants out there that would be willing to work for us to help us verify and improve the deployment for our non-profit organization? This would be a fairly simple job of looking over configs and making recommendations, but may give way into more ongoing work. I know there are a lot of experts on this list that really know how Postfix and Dovecot work and we'd really appreciate some quality advice. I'm sending this request to both Postfix and Dovecot lists. Please email me directly with replies. -- Asai

1 0

Sieve setting a flag on the server (with sieve?)
by Marc Roos 17 Feb '20

17 Feb '20

I want to run a cron job for specific users. I thought the easiest would be a sieve plugin that sets some text in managesieve.sieve. And I just have my cron job check for this setting. This is the forward sieve: if false # true { redirect :copy "test(a)test.com"; } So maybe something like: if false # true { # cronjob1 } Or is there a better way of doing such a thing?

2 1

Question about noreplicate flag
by Bernardo Reino 17 Feb '20

17 Feb '20

Dear all, I've just setup replication between two servers. The e-mail accounts on both servers intersect but are not the same. In dovecot.conf (both are identical except one user /var/mail and the other uses /srv/vmail) I have: --<<-- userdb { driver = passwd-file args = username_format=%Lu /etc/dovecot/virtual_passwd default_fields = uid=vmail gid=vmail home=/var/mail/%d/%n } passdb { driver = passwd-file args = scheme=SHA512-CRYPT username_format=%Lu /etc/dovecot/virtual_passwd } -->>-- i.e. I use a passwd-like database. For the non-overlapping accounts in both servers I want to prevent replication, as it will otherwise fail with "Error: sync: Unknown user in remote". I have added "userdb_noreplicate" (also tried "userdb_noreplicate=y") for those users, but I still see the above error message in the logs. Like: reinob@bbmk.org:{SHA512-CRYPT}$6$e10...4c::::::userdb_noreplicate=y If I run "doveadm user -u reinob(a)bbmk.org" I get the following: userdb: reinob(a)bbmk.org user : reinob(a)bbmk.org uid : 5000 gid : 5000 home : /var/mail/bbmk.org/reinob noreplicate: y Note that I use "userdb_noreplicate" instead of "noreplicate" (which I also tried just in case), as from what I understood the "userdb_" prefix is required when adding the flag to the passwd file. As far as I can tell I'm doing everything right, but for some reason the replication is ignoring that flag. Thanks in advance for any help with this. (Let me know if you need to see the $(doveconf -n), but I believe the only relevant parts are the userdb and passdb.

2 6

Re: .IMAP
by Jos Chrispijn 16 Feb '20

16 Feb '20

On 15-2-20 11:55, Thomas Zajic wrote: > That's probably because the second part of Aki's advise hasn't been followed yet > ("... and ensure the mails are under there, ..."). You need to physically move all > mail related files and folders to the ~/mail subdir of each user. The "Deleted" > mailbox probably still shows up because your MUA has been configured to use a local > folder for it instead of an IMAP folder. Just to let you know that I also noticed that in a far past I created in the BSD root a symbolic link 'home -> usr/home'. That works for most programs, but obviously the use of this '/home' link in my old Dovecot config is not picked up by Dovecot as being redirected to '/usr/home'. ./joz

1 0

shared folder name or public folder with mail address
by Armin Schindler 16 Feb '20

16 Feb '20

Hello! we are about to move from cyrus to dovecot and have one open issue for that migration. With cyrus we have "shared/" folders with a name that is self defined like shared/project-xyz but the email address for direct delivery to that folder my be different (not project-xyz(a)domain.com) With dovecot we try to have it similar (at least how the user sees it in the client) like it is now. When configuring a namespace of type=shared, I see in the docs the the prefix can be configured with %%u , %%n or %%d. But is it possible to configure the name different to the email address? E.g. to hide the email address of that folder and show a nice name instead? I also thought about using public namespace instead. Does this make sense here? With public (maybe configured with prefix=shared/) folder I can set any name as subdir in prefix, right? So would this be more like what we have with cyrus shared folder? If so, how could these public folders have an email address for direct mail delivery into? Can something like a global sieve rule do that? Or can a public folder have an email address? Thanks in advance. Armin

4 13

doveadm backup -R -m -s not picking up a new message
by Daniel Shahaf 16 Feb '20

16 Feb '20

Good morning, I use «doveadm backup -R -m foo -s $state» to create a local mirror of an imapc remote folder. When I run that command, wait for it to finish, deliver a new message to the remote folder, and run that command again, the new message does not get downloaded from the remote. I'll attach the rawlog, doveconf, etc at the end. Allow me first to summarize what I've already checked: - I used «openssl s_client» to issue EXAMINE on the remote mailbox before and after delivering a mail to the remote mailbox, and HIGHESTMODSEQ does increase. - I looked at rawlog for both runs. doveadm issues a «STATUS foo (UIDNEXT UIDVALIDITY)» and receives a correct response (UIDNEXT in the second run is one larger than in the first run). - Other than that STATUS command, doveadm only issues LOGIN, LOGOUT, LIST, and LSUB commands. The remote server's responses do not report the new HIGHESTMODSEQ value for the folder. - The message does get mirrored locally when I run without the -s flag. I'm running dovecot 2.3.9.2 from FreeBSD ports. I've reviewed the FreeBSD port¹; it does have some patches, but none of them seem relevant to this issue. The remote server runs Cyrus. Debug output, etc follow: [[[ % doveconf -n # 2.3.9.2 (cf2918cac): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 12.1-RELEASE amd64 # Hostname: imapmirror.v.shahaf.local2 disable_plaintext_auth = no first_valid_uid = 1000 imapc_features = " rfc822.size fetch-headers modseq" imapc_host = imap.fastmail.com imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_ssl = imaps imapc_user = ... last_valid_uid = 65500 mail_location = maildir:~/Maildir:UTF-8 mail_prefetch_count = 99 namespace { inbox = yes location = prefix = separator = / } passdb { driver = pam } protocols = imap lmtp service imap { drop_priv_before_exec = yes } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </usr/local/etc/dovecot/cert.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { auth_username_format = %n } ]]] [[[ # Baseline % rm -rf /home/fmsync/Maildir % rm -rf /home/fmsync/imapcdir % rm -rf /mnt/rawlog % mkdir /mnt/rawlog % mdmfs -s 1024m auto /mnt/rawlog # mount a tmpfs % chown fmsync /mnt/rawlog # doveadm -o mail_fsync=never backup -u fmsync -s "" -l 15 -R -m lists/zsh imapc:/home/fmsync/imapcdir | sponge state.out dsync(fmsync): Info: imapc(imap.fastmail.com:993): Connected to 66.111.4.135:993 (local 192.168.122.253:56226) # doveadm -o mail_fsync=never backup -u fmsync -s "$(cat state.out)" -l 15 -R -m lists/zsh imapc:/home/fmsync/imapcdir | sponge state.out dsync(fmsync): Info: imapc(imap.fastmail.com:993): Connected to 66.111.4.136:993 (local 192.168.122.253:39150) % openssl s_client -verify_return_error -connect imap.fastmail.com:imaps ⋮ b EXAMINE lists/zsh * 24117 EXISTS * 1 RECENT * FLAGS (\Answered \Flagged \Draft \Deleted \Seen $X-ME-Annot-2 $IsMailingList $IsNotification $HasAttachment $HasTD hasnoatt hasnotd hasatt $X-ME-Annot-1 Old $NotJunk $Junk $Forwarded) * OK [PERMANENTFLAGS ()] Ok * OK [UNSEEN 1759] Ok * OK [UIDVALIDITY 1529153257] Ok * OK [UIDNEXT 24289] Ok * OK [HIGHESTMODSEQ 4910711] Ok * OK [URLMECH INTERNAL] Ok * OK [ANNOTATIONS 65536] Ok b OK [READ-ONLY] Completed c CLOSE c OK Completed ]]] [[[ # In another terminal % swaks -t lists.zsh@… ⋮ <- 250 2.0.0 Ok: queued as 48CjYx6xvmzWp ⋮ ]]] [[[ # Back in s_client d EXAMINE lists/zsh * 24118 EXISTS * 2 RECENT * FLAGS (\Answered \Flagged \Draft \Deleted \Seen $X-ME-Annot-2 $IsMailingList $IsNotification $HasAttachment $HasTD hasnoatt hasnotd hasatt $X-ME-Annot-1 Old $NotJunk $Junk $Forwarded) * OK [PERMANENTFLAGS ()] Ok * OK [UNSEEN 1759] Ok * OK [UIDVALIDITY 1529153257] Ok * OK [UIDNEXT 24290] Ok * OK [HIGHESTMODSEQ 4910779] Ok * OK [URLMECH INTERNAL] Ok * OK [ANNOTATIONS 65536] Ok d OK [READ-ONLY] Completed e CLOSE e OK Completed ]]] [[[ # doveadm -o imapc_rawlog_dir=/mnt/rawlog -Dv backup -u fmsync -s "$(cat state.out)" -l 15 -R -m lists/zsh imapc:/home/fmsync/imapcdir | sponge state.out Debug: Loading modules from directory: /usr/local/lib/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/local/lib/dovecot/doveadm/lib10_doveadm_acl_plugin.so: Undefined symbol "acl_user_module" (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/local/lib/dovecot/doveadm/lib10_doveadm_expire_plugin.so: Undefined symbol "expire_set_init" (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/local/lib/dovecot/doveadm/lib10_doveadm_quota_plugin.so: Undefined symbol "quota_user_module" (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/local/lib/dovecot/doveadm/lib20_doveadm_fts_plugin.so: Undefined symbol "fts_list_backend" (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/local/lib/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: Undefined symbol "mail_crypt_user_get_public_key" (this is usually intentional, so just ignore this message) doveadm(fmsync)<966><>: Debug: auth-master: userdb lookup(fmsync): Started userdb lookup doveadm(fmsync)<966><>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting doveadm(fmsync)<966><>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (uid=0): Client connected (fd=10) doveadm(fmsync)<966><>: Debug: auth-master: userdb lookup(fmsync): auth USER input: fmsync system_groups_user=fmsync uid=1002 gid=1002 home=/home/fmsync doveadm(fmsync)<966><>: Debug: auth-master: userdb lookup(fmsync): Finished userdb lookup (username=fmsync system_groups_user=fmsync uid=1002 gid=1002 home=/home/fmsync) doveadm(fmsync): Debug: Effective uid=1002, gid=1002, home=/home/fmsync doveadm(fmsync): Debug: Namespace : type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/Maildir:UTF-8 doveadm(fmsync): Debug: maildir++: root=/home/fmsync/Maildir, index=, indexpvt=, control=, inbox=/home/fmsync/Maildir, alt= doveadm(fmsync): Debug: brain M: Imported mailbox states: doveadm(fmsync): Debug: brain M: Mailbox $guid1 state: uidvalidity=1529153257 uid=24288 modseq=4910711 pvt_modseq=0 messages=24117 changes_during_sync=0 doveadm(fmsync): Debug: brain M: Namespace has location maildir:~/Maildir:UTF-8 doveadm(fmsync): Debug: Namespace : Using permissions from /home/fmsync/Maildir: mode=0700 gid=default dsync(fmsync): Debug: Effective uid=1002, gid=1002, home=/home/fmsync dsync(fmsync): Debug: Namespace : type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=imapc:/home/fmsync/imapcdir dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Created new connection dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Looking up IP address (reconnect_ok=true, last_connect=1580957435) dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Connecting to 66.111.4.135:993 dsync(fmsync): Info: imapc(imap.fastmail.com:993): Connected to 66.111.4.135:993 (local 192.168.122.253:59074) dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Starting SSL handshake dsync(fmsync): Debug: imapc(imap.fastmail.com:993): SSL handshake successful dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Server capabilities: IMAP4 IMAP4rev1 LITERAL+ ENABLE UIDPLUS SASL-IR NAMESPACE CONDSTORE SORT LIST-EXTENDED QRESYNC MOVE SPECIAL-USE CREATE-SPECIAL-USE IDLE AUTH=PLAIN dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Authenticating as ... dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Server capabilities: IMAP4rev1 LITERAL+ ID ENABLE ACL RIGHTS=kxten QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY CATENATE CONDSTORE ESEARCH SEARCH=FUZZY SORT SORT=MODSEQ SORT=DISPLAY SORT=UID THREAD=ORDEREDSUBJECT THREAD=REFERENCES THREAD=REFS ANNOTATE-EXPERIMENT-1 METADATA LIST-EXTENDED LIST-STATUS LIST-MYRIGHTS LIST-METADATA WITHIN QRESYNC SCAN XLIST XMOVE MOVE SPECIAL-USE CREATE-SPECIAL-USE DIGEST=SHA1 X-REPLICATION STATUS=SIZE OBJECTID SAVEDATE X-CREATEDMODSEQ PREVIEW=FUZZY XAPPLEPUSHSERVICE LOGINDISABLED XCONVERSATIONS COMPRESS=DEFLATE X-QUOTA=STORAGE X-QUOTA=MESSAGE X-QUOTA=X-ANNOTATION-STORAGE X-QUOTA=X-NUM-FOLDERS IDLE dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Authenticated successfully dsync(fmsync): Debug: imapc: root=/home/fmsync/imapcdir, index=, indexpvt=, control=, inbox=, alt= dsync(fmsync): Debug: maildir++: root=/home/fmsync/imapcdir, index=, indexpvt=, control=, inbox=, alt= dsync(fmsync): Debug: brain M: Locking done locally in /home/fmsync/.dovecot-sync.lock (local hostname=imapmirror.v.shahaf.local2, remote hostname=imapmirror.v.shahaf.local2) dsync(fmsync): Debug: brain S: Namespace has location imapc:/home/fmsync/imapcdir dsync(fmsync): Debug: Namespace : Using permissions from /home/fmsync/imapcdir: mode=0700 gid=default dsync(fmsync): Debug: brain M: Local mailbox tree: lists guid=00000000000000000000000000000000 uid_validity=0 uid_next=0 subs=no last_change=0 last_subs=0 dsync(fmsync): Debug: brain S: Local mailbox tree: lists guid=00000000000000000000000000000000 uid_validity=0 uid_next=0 subs=no last_change=0 last_subs=0 dsync(fmsync): Debug: brain M: Local mailbox tree: lists/zsh guid=$guid1 uid_validity=1529153257 uid_next=24289 subs=yes last_change=0 last_subs=1580956711 dsync(fmsync): Debug: brain S: Local mailbox tree: lists/zsh guid=$guid1 uid_validity=1529153257 uid_next=24290 subs=yes last_change=0 last_subs=0 dsync(fmsync): Debug: brain M: Remote mailbox tree: lists guid=00000000000000000000000000000000 uid_validity=0 uid_next=0 subs=no last_change=0 last_subs=0 dsync(fmsync): Debug: brain M: Remote mailbox tree: lists/zsh guid=$guid1 uid_validity=1529153257 uid_next=24290 subs=yes last_change=0 last_subs=0 dsync(fmsync): Debug: brain S: Remote mailbox tree: lists guid=00000000000000000000000000000000 uid_validity=0 uid_next=0 subs=no last_change=0 last_subs=0 dsync(fmsync): Debug: brain S: Remote mailbox tree: lists/zsh guid=$guid1 uid_validity=1529153257 uid_next=24289 subs=yes last_change=0 last_subs=1580956711 dsync(fmsync): Debug: brain M: Mailbox lists: local=00000000000000000000000000000000/0/0, remote=00000000000000000000000000000000/0/0: Directory name paths are equal dsync(fmsync): Debug: brain M: Mailbox lists/zsh: local=$guid1/0/1, remote=$guid1/0/1: Mailboxes are equal dsync(fmsync): Debug: brain S: Mailbox lists: local=00000000000000000000000000000000/0/0, remote=00000000000000000000000000000000/0/0: Directory name paths are equal dsync(fmsync): Debug: brain S: Mailbox lists/zsh: local=$guid1/0/1, remote=$guid1/0/1: Mailboxes are equal dsync(fmsync): Debug: brain M: Skipping mailbox $guid1 with unchanged state uidvalidity=1529153257 uidnext=24289 highestmodseq=4910711 highestpvtmodseq=0 messages=24117 dsync(fmsync): Debug: imapc(imap.fastmail.com:993): Disconnected dsync(fmsync): Debug: brain M: Exported mailbox states: dsync(fmsync): Debug: brain M: Mailbox $guid1 state: uidvalidity=1529153257 uid=24288 modseq=4910711 pvt_modseq=0 messages=24117 changes_during_sync=0 dsync(fmsync): Debug: brain M: Unlocked /home/fmsync/.dovecot-sync.lock dsync(fmsync): Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (uid=0): Disconnected: Connection closed (fd=10) % grep -v LOGIN < /mnt/rawlog/20200206-025036.966.1.out 1580957437.093905 1 CAPABILITY 1580957437.403048 3 LIST "" "" 1580957437.550179 4 LIST "" "*" 1580957437.725211 5 STATUS "lists/zsh" (UIDNEXT UIDVALIDITY) 1580957437.874174 6 LSUB "" "*" 1580957438.184244 7 LOGOUT % grep -w -B 2 5 < /mnt/rawlog/20200206-025036.966.1.in 1580957437.705302 4 OK Completed (...) 1580957437.869540 * STATUS lists/zsh (UIDNEXT 24290 UIDVALIDITY 1529153257) 1580957437.869540 5 OK Completed % doveadm search -u fmsync mailbox lists/zsh HEADER Received 48CjYx6xvmzWp | wc -l 0 % ]]] [[[ # Back in s_client: f EXAMINE lists/zsh ⋮ g UID SEARCH HEADER Received 48CjYx6xvmzWp * SEARCH 24289 g OK Completed (1 msgs in 5.268 secs) ]]] So, my question is: Why doesn't «doveadm backup» sync the new message? (Message number 24118, UID 24289, ESMTP ID 48CjYx6xvmzWp) Cheers, Daniel ¹ https://svn.freebsd.org/ports/head/mail/dovecot

1 2

.IMAP
by Jos Chrispijn 15 Feb '20

15 Feb '20

Dear team, I have my users in /usr/home/user1 for user1, user2 for user2 etc. As these users also have a website, these folders have a /usr/home/user1/www folder, which is the docroot of their website. What happens now is that Dovecot indexes also this /usr/home/user1/www folder and creates in every folder a .imap folder which content is an exact image of the folder it is created in. In practice this causes 2 times of webspace (which also in on the account of that user). Can you pls tell me what I do wrong and how to solve this? I might be missing an 'exclude' folder setting for each dovecot user. Thanks for you expertise, Jos

3 4

Dovecot 2.3 repo for CentOS 8.
by Reio Remma 15 Feb '20

15 Feb '20

Hello! Are there any plans for an official Dovecot repo for CentOS 8? Thanks, Reio

7 10

Very slow mail download/notification with dovecot 2.2.33 and Thunderbird
by ml_dovecot＠thorsten-reichelt.de 15 Feb '20

15 Feb '20

Hi! I know that there are many results if I search for "dovecot thunderbird very slow" on Google but none of them helped me with my problem. :( I am running Ubuntu 18.04 (4GB RAM, 40GB HDD with EXT4) with the following software: - Dovecot 2.2.33 ---- All accounts are using Maildir ---- Sieve filters - Postfix 3.3.0 ---- with opendkim, spamassassin, razor, pyzor, .... And as IMAP client I am using Thunderbird 68.4 on Windows10. Sieve is used to sort incoming mails into my 224 folders (56 INBOX. folders and its subfolders (output of "find .INBOX.* -maxdepth 4 -type d -print |wc -l")). My problem is that it takes very very long to synchonize the INBOX and its subfolders. Even if there are only a few new messages to be downloaded. Sometimes Thunderbird outputs something like "downloading message 1 of 19" and it takes at least 60 seconds to download all of them. None of these 19 mails is larger than 5kB. And sometimes it seems that the transfer is suspended for a long time and it takes >5 Minutes to synchronize only a few mails. :( Every helpful advice is welcome. I just don't know where to look for the cause right now, but I can provide configurations (like output of |doveadm config) |and some logfiles. Thank you very much! Thorsten

2 1

Dovecot Proxy - Oauth2 mech add custom fields
by Domenico Pastore 14 Feb '20

14 Feb '20

Hi, I have a problem with configuring dovecot passdb for Oauth2 with keyclock. A user can access more mailbox, mailboxes are associated with the user. When a user login with this method: OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ AUTH=PLAIN] Dovecot ready. a login mailbox*user password Dovecot when requiring the grant_url send to Keyclock, for example, this post (I have already enabled raw_log for analysis): grant_type=password&username=domenico&password=test&client_id=imap-client&client_secret=99e26b26-0f2a-4b64-8f57-c0ca2147d3a0&scope=emailPOST /auth/realms/example/protocol/openid-connect/token/introspect The call pass to Keyclock only master_user and miss mailbox info. In fact, the JSON response after login return the only username without mailbox: [...] "scope": "profile email", "email_verified": false, "preferred_username": "dome.nico" [...] When Dovecot proxy connects to the backend, email attribute and user have the same value, master-user. This behavior is a problem because when backend tries login access, login with the user and not with the mailbox. This is backend logging: 2020-02-13 19:34:13 auth: Debug: client passdb out: OK 1 user=domenico token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJYVy1fSmNnVkF3aW9GUXh1NUhwdjVlbk5uNU8zaW42Y1VpaGJsM2dWX0V3In0.eyJqdGkiOiJhYTMwZ Dk0Yy0xNjE0LTQzN2QtOTA5Zi01ZTAwNGQ2YjNmZTIiLCJleHAiOjE1ODE2MTE5NTQsIm5iZiI6MCwiaWF0IjoxNTgxNjExNjU0LCJpc3MiOiJodHRwczovL2tleWNsb2FrLXBlYy1pYW0ucGVjLWFwcHMucGFyLXRlYy5pdC9hdXRoL3JlYWxtcy9wZWMiLCJhdWQiOiJhY2NvdW50Iiwi c3ViIjoiZjphNTA1NWUzMi1lYzhkLTRmZjgtOWZjNS00ODM4MmQ1MzRhODc6ZG9tZS5uaWNvIiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiaW1hcC1jbGllbnQiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiIyN2M0ZDMzYy01YjdlLTQzMWMtYjZmMi0yYmI4NjIzYzMyMjkiLCJ hY3IiOiIxIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2 ZpbGUiXX19LCJzY29wZSI6InByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6ImRvbWUubmljbyJ9.LlIx-QeRQPr3lK4Cs1vU0qMvHF3uq3h15BGi1atNCBASkM6oPoYWLV-sYdf8hzpRFyOaTcbxN53SN6LfD0hHvUZ2sKHxh7UJ idmxS4hf1SsZq8wJTASpebcPLtBIX5JBvXmpxa-cVnZDE1JVw5np5-LLNs0j4sgHwgg85mJEoE2VmYJzbGZjUsSTvaAAoCbvTA0MfsNoKyq0E5JrLVdkI-twX7HjAESFqFD4yHe7BS4FG_UjddrSr3uXmXreB44VLZ8B4xBgVRjK9K-sjjkXT8Bkv8WbxUdEEHaarWU_qanI5DlhA0CZXlJ CyDsNcRwQfwVHOESxXE7ehgIDPm-NjA I have a mechanism for adding other attributes with Dovecot when calling Keyclock? This for insert email or other fields into the token. Thanks all, Domenico ——— Dovecot Frontend # 2.3.9.2 (cf2918cac): /config/dovecot/dovecot-proxy/dovecot.conf # OS: Linux 3.10.0-693.17.1.el7.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) # Hostname: fe-new.example.it auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_verbose = yes auth_verbose_passwords = yes base_dir = /data/dovecot/var/run/dovecot-proxy default_vsz_limit = 768 M disable_plaintext_auth = no first_valid_gid = 101 first_valid_uid = 102 imap_id_send = import_environment = TZ MASTERPWD info_log_path = /LOGS/imap/dovecot-proxy.log instance_name = dovecot-proxy listen = fe-new_imap log_path = /LOGS/imap/dovecot-proxy.log log_timestamp = "%Y-%m-%d %H:%M:%S " mail_gid = 101 mail_location = maildir:%h/Maildir mail_max_userip_connections = 50 mail_plugins = quota expire mail_log notify mail_uid = 102 maildir_broken_filename_sizes = yes mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . subscriptions = yes type = private } passdb { args = /config/dovecot/dovecot-proxy/dovecot-oauth2.conf driver = oauth2 master = yes mechanisms = plain login } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } postmaster_address = posta(a)foo.it protocols = imap pop3 service anvil { client_limit = 3000 } service auth { client_limit = 4096 unix_listener auth-userdb { mode = 0600 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_limit = 2500 process_min_avail = 5 } service imap { drop_priv_before_exec = yes process_limit = 2500 process_min_avail = 5 } service lmtp { inet_listener lmtp { port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { drop_priv_before_exec = yes process_limit = 1024 } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 ssl = yes } process_limit = 300 process_min_avail = 5 } service pop3 { drop_priv_before_exec = yes process_limit = 300 process_min_avail = 5 } ssl_cert = </certs/cert-selfsigned.crt ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!RC4::!3DES:!IDEA ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it protocol lmtp { mail_plugins = quota expire mail_log notify } protocol lda { mail_plugins = quota expire mail_log notify } protocol imap { mail_plugins = quota imap_quota mail_log notify } protocol pop3 { mail_plugins = quota mail_log notify pop3_uidl_format = UID%u-%v } -> /config/dovecot/dovecot-proxy/dovecot-oauth2.conf grant_url = https://keycloak-iam.apps.example.com/auth/realms/example/protocol/openid-c… use_grant_password = yes introspection_mode = post introspection_url = https://keycloak-iam.apps.example.com/auth/realms/example/protocol/openid-c… username_attribute = username username_format = %Lu tls_ca_cert_file = /etc/ssl/certs/ca-certificates.crt active_attribute = active active_value = true scope = email send_auth_headers = yes debug = yes rawlog_dir = /LOGS/imap/oauth2/ client_id = imap-client client_secret = 99e26b26-0f2a-4b64-8f57-c0ca2147d3a0 pass_attrs = host=192.160.10.4 proxy=y proxy_mech=xoauth2 pass=%{oauth2:access_token}

1 0