- dovecot - dovecot.org

Re: a bit further along - OpenSSL - Re: trouble compiling Dovecot 2.2.31 on Solaris 10 SPARC - libssl_iostream_openssl.so is not portable!
by Joseph Tam 26 Aug '17

26 Aug '17

Jerry Kemp <dovecot(a)oryx.us> wrote: > same ENV variable setup and configure statement as originally used, but again, :( > ended up failing here: > .......................................................................... > libtool: link: gcc -std=gnu99 -g -O2 -Wall -W -Wmissing-prototypes > -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 > -Wbad-function-cast -fno-builtin-strftime > -I/Applications/openssl-1.0.2l.32/include > -I/Applications/openssl-1.0.2l.32/include/openssl -o .libs/test-http-client > test-http-client.o -L/Applications/openssl-1.0.2l.32/lib ./.libs/libhttp.a > ../lib-dns/.libs/libdns.a ../lib-ssl-iostream/.libs/libssl_iostream.a > ../lib-master/.libs/libmaster.a ../lib-settings/.libs/libsettings.a > ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a > ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so -lcrypto -lrt -lnsl > -lsocket -lsendfile -lcrypt -R/Applications/dovecot-2.2.31.32/lib/dovecot I simulated your compile arguments as best as I could, and compared the libtool command in my compile logs with your's. (mine) Mine: -lssl -lcrypto -lrt -lnsl -lsocket -lsendfile (your's) -lcrypto -lrt -lnsl -lsocket -lsendfile -lcrypt You're missing "-lssl" but have a spurious "-lcrypt". Probably all your missing symbols are actually in libssl.so. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: trouble compiling Dovecot 2.2.31 on Solaris 10 SPARC - libssl_iostream_openssl.so is not portable!
by Joseph Tam 26 Aug '17

26 Aug '17

I would also check where the "... is not portable!" messaage is generated. If it's done by the configure script, you can look at the test to give you a hint as to why this message was generated. For my setup, I did much the same as you but didn't have to set the SSL_CFLAGS, SSL_LIBS environment variables, nor did I set the --with-ssldir configure option (although your setup may need it). Maybe check output of file /Applications/openssl-1.0.2l.32/lib/libssl.so.1.0.0 just to make sure your library's arhitecture matches your expectation. > # ./configure \ > --prefix=/Applications/dovecot-2.2.31.32 \ > --with-ssl=openssl \ > --with-ssldir=/Applications/dovecot-2.2.31.32/certs \ > --with-storages=mbox,maildir,imapc,pop3c I believe "--with-storages" option is now obsolete: all the storage backends are built, whether you ask for it or not. Joseph Tam <jtam.home(a)gmail.com>

2 2

trouble compiling Dovecot 2.2.31 on Solaris 10 SPARC - libssl_iostream_openssl.so is not portable!
by Jerry Kemp 26 Aug '17

26 Aug '17

attempting to compile dovecot 2.2.31 on Sun/Oracle Solaris 10 SPARC. configure goes fine. First sign of problems during compile is with this warning: ............................................... *** libssl_iostream_openssl.so is not portable! ............................................... actual ERRORS - Soon, compile errors out with undefined symbols. Output at bottom of note. ............................................... additional system information. OpenSSL - just prior to dovecot compile attempt, I downloaded and successfully compiled OpenSSL version 1.0.2l (to include a successful "make test" ) in directory /Applications/openssl-1.0.2l.32 , want to link against current code and not mess with system provided SSL stuff in /usr/sfw/* ENV setting and configure command line prior to compile - # setenv CPPFLAGS "-I/Applications/openssl-1.0.2l.32/include -I/Applications/openssl-1.0.2l.32/include/openssl" # setenv LDFLAGS "-L/Applications/openssl-1.0.2l.32/lib" # setenv SSL_CFLAGS "-I/Applications/openssl-1.0.2l.32/include -I/Applications/openssl-1.0.2l.32/include/openssl" # setenv SSL_LIBS "-R/Applications/openssl-1.0.2l.32/lib -L/Applications/openssl-1.0.2l.32/lib" # ./configure \ --prefix=/Applications/dovecot-2.2.31.32 \ --with-ssl=openssl \ --with-ssldir=/Applications/dovecot-2.2.31.32/certs \ --with-storages=mbox,maildir,imapc,pop3c ................................................. What is the .32 stuff I see appended to directories? I did a 32 bit compile of the latest OpenSSL, then , the data shown here is also for a 32 bit dovecot build to link against the 32 bit OpenSSL build. I have been fighting this for a few days, and had also done an identical 64 bit OpenSSL, then dovecot build. The 64 bit dovecot build failed in the same way and place. Additionally, when I did the 64 bit compile, I ended up pulling down a current copy of ZLIB, and doing a 64 bit compile of that library also, and installing it under /Applications then linking against that. the system ZLIB library is/was 32 bit, and if there is a 64 bit version provided by Sun/Oracle, neither myself or the "configure" script could locate it. Not a big detail, ZLIB is an easy compile, just trying to share all relevant data. ................................................. Try again with the latest code. I have been working/fighting 2.2.31 for a couple of days. I see earlier today, dovecot 2.2.32 was released earlier today, so before anyone runs to put on their "*L*" cap and advise me to pull down the latest code, I already did that, and the compile errors out in the same place. ................................................. If your still reading, thank you, just want to provide as many relevant details as possible. Again, symbol errors from compile are at bottom. TIA for any helpful comments or suggestions, Jerry ............................................................... Undefined first referenced symbol in file ERR_clear_error ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_load_error_strings ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so BIO_ctrl_get_write_guarantee ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so EVP_PKEY_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_use_PrivateKey ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_get_peer_certificate ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CIPHER_get_bits ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CIPHER_get_name ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so DH_generate_parameters ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so sk_value ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so PEM_X509_INFO_read_bio ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_NAME_oneline ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ERR_get_error_line_data ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_write ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_NAME_get_text_by_NID ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_get_ex_new_index ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_get_error ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_init ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so BIO_ctrl_pending ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_INFO_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_get_ext_d2i ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ERR_get_error ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so PEM_read_bio_PrivateKey ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so OPENSSL_add_all_algorithms_noconf ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so BIO_write ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_set_default ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_accept ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ASN1_STRING_data ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ASN1_STRING_type ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSLv23_server_method ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_STORE_set_flags ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so sk_pop_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_use_PrivateKey ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ERR_error_string_n ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so CRYPTO_set_mem_functions ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so BIO_new_mem_buf ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_get_cert_store ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so CRYPTO_cleanup_all_ex_data ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so GENERAL_NAME_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so sk_num ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_NAME_get_entry ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_ctrl ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_read ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSLv23_client_method ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_alert_type_string_long ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_new ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so PEM_read_bio_X509 ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_new ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ERR_peek_error ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so DH_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_NAME_ENTRY_get_data ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so d2i_DHparams ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_load_verify_locations ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_set_bio ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_set_tmp_dh_callback ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so i2d_DHparams ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_NAME_get_index_by_NID ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_set_info_callback ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so sk_push ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_connect ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so BIO_new_bio_pair ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_shutdown ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so RAND_bytes ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so EVP_cleanup ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so OBJ_cleanup ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_verify_cert_error_string ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ASN1_STRING_length ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_STORE_add_crl ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_load_builtin_engines ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_set_client_CA_list ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so OBJ_txt2nid ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_use_certificate ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_use_certificate ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_ctrl ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_cleanup ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so sk_new_null ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ERR_peek_last_error ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_get_current_cipher ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_STORE_CTX_get_current_cert ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_get_ex_data_X509_STORE_CTX_idx ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so RSA_generate_key ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_STORE_CTX_get_error ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_state_string_long ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ERR_remove_state ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so BIO_free ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so BIO_read ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_STORE_add_cert ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_alert_desc_string_long ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_get_version ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_get_ex_data ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_set_cipher_list ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_set_ex_data ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_set_cipher_list ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_set_verify ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_STORE_CTX_get_ex_data ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ERR_free_strings ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_NAME_dup ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_set_tmp_rsa_callback ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_get_subject_name ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_library_init ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_finish ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_by_id ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ld: fatal: symbol referencing errors. No output written to .libs/test-http-client collect2: ld returned 1 exit status *** Error code 1 make: Fatal error: Command failed for target `test-http-client'

2 3

Install still locks up my server
by Marc Perkel 25 Aug '17

25 Aug '17

This is still broken in the 2.2.32. config.guess forks copies till the server dies. Running Centos 6.6 under OpenVZ. On 06/26/17 16:03, Marc Perkel wrote: > > > On 06/26/17 14:42, Timo Sirainen wrote: >> On 26 Jun 2017, at 23.19, Marc Perkel <marc(a)perkel.com> wrote: >>> Ever since 2.26 I haven't been able to upgrade. In fact the install >>> locks up my server. >>> >>> I get into and infinite recursive loop where the config-guess >>> program calls itself until the server locks up from overload. >>> >>> I'm running Centos 6 under OpenVZ. >>> >>> What am I missing? I think there's a serious bug. >>> >>> 31233 pts/3 S 0:00 /bin/sh ./config.guess >>> 31235 pts/3 S 0:00 \_ /bin/sh ./config.guess >>> 31238 pts/3 S 0:00 \_ /bin/sh ./config.guess >>> 31240 pts/3 S 0:00 \_ /bin/sh ./config.guess >> I think I remember seeing this before, but unfortunately can't >> remember what the solution was. Maybe it was something something >> messed up in the OS or in the build directory. Are you compiling from >> the tarballs? So it's the "configure" that fails? Also if you run >> "./config.guess" manually? What's the output if you run "bash -x >> ./config.guess"? >> >> >> > > bash -x ./config.guess > + timestamp=2015-08-20 > ++ sed -e 's,.*/,,' > ++ echo ./config.guess > + me=config.guess > + usage='Usage: ./config.guess [OPTION] > > Output the configuration name of the system `config.guess'\'' is run on. > > Operation modes: > -h, --help print this help, then exit > -t, --time-stamp print date of last modification, then exit > -v, --version print version number, then exit > > Report bugs and patches to <config-patches(a)gnu.org>.' > + version='GNU config.guess (2015-08-20) > > Originally written by Per Bothner. > Copyright 1992-2015 Free Software Foundation, Inc. > > This is free software; see the source for copying conditions. There is NO > warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR > PURPOSE.' > + help=' > Try `config.guess --help'\'' for more information.' > + test 0 -gt 0 > + test 0 '!=' 0 > + trap 'exit 1' 1 2 15 > + set_cc_for_build=' > trap "exitcode=\$?; (rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp > 2>/dev/null) && exit \$exitcode" 0 ; > trap "rm -f \$tmpfiles 2>/dev/null; rmdir \$tmp 2>/dev/null; exit 1" 1 > 2 13 15 ; > : ${TMPDIR=/tmp} ; > { tmp=`(umask 077 && mktemp -d "$TMPDIR/cgXXXXXX") 2>/dev/null` && > test -n "$tmp" && test -d "$tmp" ; } || > { test -n "$RANDOM" && tmp=$TMPDIR/cg$$-$RANDOM && (umask 077 && > mkdir $tmp) ; } || > { tmp=$TMPDIR/cg-$$ && (umask 077 && mkdir $tmp) && echo "Warning: > creating insecure temp directory" >&2 ; } || > { echo "$me: cannot create a temporary directory in $TMPDIR" >&2 ; > exit 1 ; } ; > dummy=$tmp/dummy ; > tmpfiles="$dummy.c $dummy.o $dummy.rel $dummy" ; > case $CC_FOR_BUILD,$HOST_CC,$CC in > ,,) echo "int x;" > $dummy.c ; > for c in cc gcc c89 c99 ; do > if ($c -c -o $dummy.o $dummy.c) >/dev/null 2>&1 ; then > CC_FOR_BUILD="$c"; break ; > fi ; > done ; > if test x"$CC_FOR_BUILD" = x ; then > CC_FOR_BUILD=no_compiler_found ; > fi > ;; > ,,*) CC_FOR_BUILD=$CC ;; > ,*,*) CC_FOR_BUILD=$HOST_CC ;; > esac ; set_cc_for_build= ;' > + UNAME_MACHINE=x86_64 > + UNAME_RELEASE=2.6.32-042stab123.3 > + UNAME_SYSTEM=Linux > + UNAME_VERSION='#1 SMP Fri May 5 12:29:05 MSK 2017' > + case "${UNAME_SYSTEM}" in > + LIBC=gnu > + eval trap '"exitcode=\$?;' '(rm' -f '\$tmpfiles' '2>/dev/null;' > rmdir '\$tmp' '2>/dev/null)' '&&' exit '\$exitcode"' 0 ';' trap '"rm' > -f '\$tmpfiles' '2>/dev/null;' rmdir '\$tmp' '2>/dev/null;' exit '1"' > 1 2 13 15 ';' : '${TMPDIR=/tmp}' ';' '{' 'tmp=`(umask' 077 '&&' mktemp > -d '"$TMPDIR/cgXXXXXX")' '2>/dev/null`' '&&' test -n '"$tmp"' '&&' > test -d '"$tmp"' ';' '}' '||' '{' test -n '"$RANDOM"' '&&' > 'tmp=$TMPDIR/cg$$-$RANDOM' '&&' '(umask' 077 '&&' mkdir '$tmp)' ';' > '}' '||' '{' 'tmp=$TMPDIR/cg-$$' '&&' '(umask' 077 '&&' mkdir '$tmp)' > '&&' echo '"Warning:' creating insecure temp 'directory"' '>&2' ';' > '}' '||' '{' echo '"$me:' cannot create a temporary directory in > '$TMPDIR"' '>&2' ';' exit 1 ';' '}' ';' 'dummy=$tmp/dummy' ';' > 'tmpfiles="$dummy.c' '$dummy.o' '$dummy.rel' '$dummy"' ';' case > '$CC_FOR_BUILD,$HOST_CC,$CC' in ',,)' echo '"int' 'x;"' '>' '$dummy.c' > ';' for c in cc gcc c89 c99 ';' do if '($c' -c -o '$dummy.o' > '$dummy.c)' '>/dev/null' '2>&1' ';' then 'CC_FOR_BUILD="$c";' break > ';' fi ';' done ';' if test 'x"$CC_FOR_BUILD"' = x ';' then > CC_FOR_BUILD=no_compiler_found ';' fi ';;' ',,*)' 'CC_FOR_BUILD=$CC' > ';;' ',*,*)' 'CC_FOR_BUILD=$HOST_CC' ';;' esac ';' set_cc_for_build= ';' > ++ trap 'exitcode=$?; (rm -f $tmpfiles 2>/dev/null; rmdir $tmp > 2>/dev/null) && exit $exitcode' 0 > ++ trap 'rm -f $tmpfiles 2>/dev/null; rmdir $tmp 2>/dev/null; exit 1' > 1 2 13 15 > ++ : /tmp > ++ tmp=/tmp/cgpmW24a > ++ test -n /tmp/cgpmW24a > ++ test -d /tmp/cgpmW24a > ++ dummy=/tmp/cgpmW24a/dummy > ++ tmpfiles='/tmp/cgpmW24a/dummy.c /tmp/cgpmW24a/dummy.o > /tmp/cgpmW24a/dummy.rel /tmp/cgpmW24a/dummy' > ++ case $CC_FOR_BUILD,$HOST_CC,$CC in > ++ echo 'int x;' > ++ for c in cc gcc c89 c99 > >

1 0

Dovecot - Postfix Calender Synchronisation
by mca＠caloro.ch 25 Aug '17

25 Aug '17

Hello Together Please witch add-on possibilities exist to synchronize the Calednar with Dovecot and Postfix. Can give me here any a possible direction ? thanks regards Mauri

13 22

Dovecot - Postfix Calender Synchronisation
by Maurizio Caloro 25 Aug '17

25 Aug '17

Hello Together Please witch add-on possibilities exist to synchronize the Calednar with Dovecot and Postfix. Can give me here any a possible direction ? thanks regards Mauri

2 1

socketpair failed: Too many open files on Debian 9
by Patrick Westenberg 25 Aug '17

25 Aug '17

Hi @all, after re-installing one of my two frontends/proxy-servers I get the following error messages after some time (sometimes after 1h, sometimes after 24h): 11:23:55 imap-login: Error: socketpair() failed: Too many open files 11:23:55 imap-login: Error: socketpair() failed: Too many open files 11:23:56 imap-login: Error: socketpair() failed: Too many open files 11:23:56 imap-login: Error: socketpair() failed: Too many open files 11:23:57 imap-login: Error: socketpair() failed: Too many open files 11:26:17 imap-login: Error: socket() failed: Too many open files 11:26:17 imap-login: Error: proxy(post(a)example.com): connect(172.17.1.1, 143) failed: Too many open files (after 0 secs): user=<post(a)example.com>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<FgPWTWhXa8dQjLoi> 11:26:17 imap-login: Error: socketpair() failed: Too many open files 11:26:17 imap-login: Error: proxy: SSL handshake failed to 172.17.1.1:143: user=<post(a)example.com>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<HALWTWhXasdQjLoi> 11:26:17 imap-login: Error: socket() failed: Too many open files 11:26:17 imap-login: Error: proxy(post(a)example.com): connect(172.17.1.1, 143) failed: Too many open files (after 0 secs): user=<post(a)example.com>, method=LOGIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<HALWTWhXasdQjLoi> 11:26:17 imap-login: Error: socketpair() failed: Too many open files 11:26:17 imap-login: Error: proxy: SSL handshake failed to 172.17.1.1:143: user=<post(a)example.com>, method=LOGIN, rip=x.x.x.x, lip=x.x.x.x, TLS, session=<FgPWTWhXa8dQjLoi> 11:26:17 imap-login: Error: socket() failed: Too many open files As I switched from KVM to LXC my first idea was that this could be caused by LXC but this even happens with KVM. I tried dovecot 2.2.31 and 2.2.32.rc2. OS is Debian 9. These problems don't occur on my old machine (Debian 7). Any ideas? Regards Patrick # 2.2.32.rc2 (a350120ca): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.4.67-1-pve x86_64 Debian 9.1 auth_mechanisms = plain login director_mail_servers = 172.17.1.1 172.17.1.2 director_servers = 172.17.1.32 172.17.1.3 director_user_expire = 5 mins lmtp_proxy = yes log_path = /var/log/dovecot.log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = 172.17.1.32 port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director process_min_avail = 1 service_count = 0 } service lmtp { inet_listener lmtp { address = 172.17.1.32 port = 24 ssl = yes } process_min_avail = 20 } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/certs/certum_wildcard.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes verbose_proctitle = yes protocol !smtp { passdb { args = proxy=y nopassword=y starttls=any-cert driver = static name = } } protocol smtp { passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql name = } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql name = } } protocol lmtp { auth_socket_path = director-userdb } ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 7978 max locked memory (kbytes, -l) 64 max memory size (kbytes, -m) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 7978 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited ########################### This machine has no problems: # 2.2.18: /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 3.16.0-0.bpo.4-amd64 x86_64 Debian 7.11 auth_mechanisms = plain login director_mail_servers = 172.17.1.1 172.17.1.2 director_servers = 172.17.1.3 172.17.1.32 director_user_expire = 5 mins lmtp_proxy = yes log_path = /var/log/dovecot.log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { user = dovecot } } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { address = 172.17.1.3 port = 9090 } unix_listener director-userdb { mode = 0600 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director process_min_avail = 1 service_count = 0 } service lmtp { inet_listener lmtp { address = 172.17.1.3 port = 24 ssl = yes } process_min_avail = 20 } service managesieve-login { executable = managesieve-login director inet_listener sieve { port = 4190 } } service pop3-login { executable = pop3-login director } ssl_cert = </etc/ssl/certs/certum_wildcard.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/ssl/private/certum_wildcard.key ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv3 !SSLv2 verbose_proctitle = yes protocol !smtp { passdb { args = proxy=y nopassword=y starttls=any-cert driver = static name = } } protocol smtp { passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql name = } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql name = } } protocol lmtp { auth_socket_path = director-userdb } ulimit -a core file size (blocks, -c) 0 data seg size (kbytes, -d) unlimited scheduling priority (-e) 0 file size (blocks, -f) unlimited pending signals (-i) 257548 max locked memory (kbytes, -l) 64 max memory size (kbytes, -m) unlimited open files (-n) 1024 pipe size (512 bytes, -p) 8 POSIX message queues (bytes, -q) 819200 real-time priority (-r) 0 stack size (kbytes, -s) 8192 cpu time (seconds, -t) unlimited max user processes (-u) 257548 virtual memory (kbytes, -v) unlimited file locks (-x) unlimited

4 5

Error: mdbox .../storage: Duplicate GUID
by Dennis Schridde 24 Aug '17

24 Aug '17

Hi! When I force-resync a mailbox of mine, I see following output: # doveadm force-resync -u $USER $PATH doveadm($USER): Warning: mdbox .../storage: Inconsistency in map index ($X,$Y2 != $X,$Y2) doveadm($USER): Warning: fscking index file .../storage/dovecot.map.index doveadm($USER): Warning: mdbox .../storage: rebuilding indexes doveadm($USER): Error: mdbox .../storage: Duplicate GUID $G in m.$N1:$N2 (size=$N3) and m.$N1:$N2 (size=$N3) doveadm($USER): Warning: fscking index file .../storage/dovecot.map.index doveadm($USER): Warning: mdbox .../storage: Inconsistency in map index ($X,$Y1 != $X,$Y3) doveadm($USER): Warning: fscking index file .../storage/dovecot.map.index doveadm($USER): Warning: fscking index file .../storage/dovecot.map.index Different numbers are represented by different $variables, e.g. $N3 != $M3 and $Y2 != $Y3. How can I fix this? Since the two messages are not the same (they have different sizes), I would expect a cleanup operation to give each message a unique GUID and write both GUIDs into all places where the old GUID was referenced. I am using Dovecot 2.2.31. Please CC me, since I am not on the list. Best regards, Dennis

1 1

dmarc report faild ?
by Maurizio Caloro 24 Aug '17

24 Aug '17

Hello Together Please i have new following Error, from DMARC Report, if i check my domain on example mxtoolbox i dont see any problems. Any from you know this Eror report, what i need to do to fix this issue? C:\folder>nslookup 94.237.32.243 Server: dns204.data.ch Address: 211.232.23.124 Name: wursti.dovecot.fi Address: 94.237.32.243 -- I check also dkim and spif but i don't see the mistake, i dont want that me Mailserver become seriussly mail problems. Regards Mauri <?xml version="1.0" encoding="UTF-8" ?> <feedback> <report_metadata> <org_name></org_name> <email>mreport(a)vmfacility.fr</email> <report_id>caloro.ch:1503564302</report_id> <date_range> <begin>1503477902</begin> <end>1503564302</end> </date_range> </report_metadata> <policy_published> <domain>caloro.ch</domain> <adkim>s</adkim> <aspf>s</aspf> <p>none</p> <sp>none</sp> <pct>100</pct> </policy_published> <record> <row> <source_ip>94.237.32.243</source_ip> <count>1</count> <policy_evaluated> <disposition>none</disposition> <dkim>pass</dkim> <spf>fail</spf> </policy_evaluated> </row> <identifiers> <header_from>caloro.ch</header_from> </identifiers> <auth_results> <spf> <domain>dovecot.org</domain> <result>unknown</result> </spf> <dkim> <domain>caloro.ch</domain> <result>pass</result> </dkim> </auth_results> </record> </feedback>

4 6

dovecot umask for mail boxes
by vadim 24 Aug '17

24 Aug '17

I want to control the mode of newly created boxes. The official documentation here: https://wiki.dovecot.org/SharedMailboxes/Permissions , under Permissions for new mailboxes says this: "When creating a new mailbox, Dovecot copies the permissions from the mailbox root directory. For example with mboxes if you have directories" But it seems to be untrue. I checked it, it soesn't work. I found a topic in mail list archive: https://dovecot.org/list/dovecot/2008-September/033395.html Its recommended to create a 'dovecot-shared' file in each mailbox with proper rights. But how can I do that if mailbox is not exists yet ? Can you provide any working solution to this problem ? -- С уважением, Бажов Вадим, Инженер отдела технической поддержки, Компания «Айдеко» -- Телефоны: +7 (495) 987-32-70; +7 (495) 662-87-34 (тех. поддержка); +7 (343) 220-77-55; Факс: +7 (343) 220-77-85 Электронная почта: Вопросы по приобретению: sales(a)ideco.ru Технические вопросы: support(a)ideco.ru Сайт: http://ideco.ru Форум: http://forum.ideco.ru

2 1

doveadm client not compatible with this server (mixed old and new binaries?)
by Kevin Golding 24 Aug '17

24 Aug '17

I'm getting the error "doveadm(10.0.0.10): Error: ddoveadm client not compatible with this server (mixed old and new binaries?)" on the source server (10.0.05) when trying to sync with a new destination server and I feel the error seems very obvious and self-explanatory except for one small thing - both servers claim to be the same version dovecot -n reports: Source (10.0.0.5): # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-RELEASE-p1 amd64 Destination (10.0.0.10): # 2.2.31 (65cde28): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: FreeBSD 11.1-RELEASE-p1 amd64 The only difference between the two outputs of dovecot -n are the mail_replica host (which are set to each other) and the ssl_cert location (which have their own domain names in the path). Replication is set to use tcp and the ports and passwords match. I was wondering if it's something they may depend on but the ones I'm aware cause most problems in general (libressl-2.5.5 and maridb-client-10.1.26) match. Any pointers that can be offered would be appreciated because I feel I'm missing something obvious. TIA Kevin

2 2

maildir boxes directory mode upon creation
by vadim 24 Aug '17

24 Aug '17

Hello, list ! Dovecot version is 2.2.27, running on Centos 6.7. Postfix is receiving mail and putting it into mailboxes. Dovecot just serves IMAP/POP3 connections to mailboxes. Virtual users are stored in DB. The problem is in directory mode (and thus file mode) for new mailboxes upon it's creation. If I create new record for new mailbox in DB and send mail to it, Postfix will create mailbox properly: Mode is 660, owner is imap:mail in my setup. If I create new record in DB and log in via IMAP for the first time, Dovecot creates mailbox and mode is 600, owner is imap:mail. Postfix cant put mails in tmp or new dirs in mailboxes created by dovecot with mode 600. I need dovecot to create new mailboxes (and files in it) within 660 mode. I tried to play around with "mail_access_groups" and "mail_privileged_group" wih no positive effect. I tried to change value for every "mode=" parameter in dovecot.conf to 660, but no luck. According to the documentation "Dovecot copies the permissions from the mailbox root directory". My mail_location is maildir:/var/mail/%u Rights for /var/mail/ (the root mail dir) are: [root@unknown-external-domain ~]# ls -lha /var/mail/ total 24K drwxrwx--- 5 postfix mail 4,0K Авг 23 14:27 . drwxrwxr-x 6 root root 4,0K Июл 29 12:18 .. drwx------ 6 imap mail 4,0K Авг 23 14:28 Administrator But, as you can see, Administrator's box was created by dovecot with 600 permissions. I am unable to enforce dovecot to create mailboxes with 660 permissions. Output of dovecot -n is in the attachment. Please tell me what's the right way to control mailbox permissions ? -- С уважением, Бажов Вадим, Инженер отдела технической поддержки, Компания «Айдеко» -- Телефоны: +7 (495) 987-32-70; +7 (495) 662-87-34 (тех. поддержка); +7 (343) 220-77-55; Факс: +7 (343) 220-77-85 Электронная почта: Вопросы по приобретению: sales(a)ideco.ru Технические вопросы: support(a)ideco.ru Сайт: http://ideco.ru Форум: http://forum.ideco.ru

2 3

Re: user data transfer when migrating to new server
by Joseph Tam 24 Aug '17

24 Aug '17

voytek(a)sbt.net.au writes: > I've tried imapsync, that seems to work well, but, what options do I have > for doing accounts or domains where I don't know user's password ? It depends on whether you're copying from an existing dovecot you control, but you can use the master password extension user={user}*{masterid}, password={masterppassword} in place of {user}/{userpasswqord} for imapsync to get the job done. Joseph Tam <jtam.home(a)gmail.com>

1 0

store into mailbox 'Junk' aborted
by kenneth topp 23 Aug '17

23 Aug '17

Hi, I've just switch from procmail to pigeonhole, and I'm seeing an issue (twice in six hours). I have spamassisn running via postfix milter, and dropping off via main.cf "mailbox_transport = lmtp:unix:/var/lib/imap/socket/lmtp" The issue is that I get a sequence of these log messages: Aug 21 19:43:59 lmtp(toppk): Debug: Junk: Mailbox opened because: lib-lda delivery Aug 21 19:43:59 lmtp(toppk): Debug: $MAILDIR/Junk: Mailbox opened because: lib-lda delivery Aug 21 19:43:59 lmtp(toppk): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: copying Aug 21 19:43:59 lmtp(toppk): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: virtual size (Cache file is unusable) Aug 21 19:43:59 lmtp(toppk): Info: YK1SNj9wm1kMaQAAjC58EQ: sieve: msgid=<E1cxyRv-000F7r-E9@tra-vmail-01>: store into mailbox 'Junk' aborted Aug 21 19:43:59 lmtp(toppk): Debug: INBOX: Mailbox opened because: lib-lda delivery Aug 21 19:43:59 lmtp(toppk): Debug: Mailbox <lmtp DATA>: Opened mail UID=1 because: copying Aug 21 19:43:59 lmtp(toppk): Info: YK1SNj9wm1kMaQAAjC58EQ: sieve: msgid=<E1cxyRv-000F7r-E9@tra-vmail-01>: stored mail into mailbox 'INBOX' Aug 21 19:43:59 lmtp(toppk): Info: YK1SNj9wm1kMaQAAjC58EQ: sieve: Execution of script /home/toppk/.dovecot.sieve failed, but implicit keep was successful (user logfile /home/toppk/.dovecot.sieve.log may reveal additional details) and in /home/toppk/.dovecot.sieve.log I get this: sieve: info: started log at Aug 21 19:43:59. error: msgid=<E1cxyRv-000F7r-E9@tra-vmail-01>: failed to store into mailbox '$MAILDIR/Junk': Mailbox doesn't exist: $MAILDIR/Junk. So instead of the email going into mbox /home/toppk/mail/Junk it goes into INBOX (/var/mail/toppk). I'm watching the Junk to see if is removed for even a split second and I don't see that. I'm not sure how to further track this down, or if there is a more optimal configuration (i'd prefer to stay mbox if possible). I was thinking of turning on mailbox_list_index. Below is the full doveadm -n output. Any guidance or suggestions welcome. Ken # 2.2.31 (65cde28): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.19 (e5c7051) # OS: Linux 4.12.4-300.fc26.x86_64 x86_64 Fedora release 26 (Twenty Six) auth_debug = yes auth_username_format = %Ln log_path = /var/log/dovecot.log mail_debug = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /etc/dovecot/sieve/default.sieve } protocols = imap lmtp sieve service auth { unix_listener auth-client { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = mail mode = 0660 user = mail } user = root } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { process_limit = 1024 } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv2 ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes protocol lmtp { mail_plugins = " sieve" } protocol lda { info_log_path = /var/log/dovecot-lda.log log_path = /var/log/dovecot-lda-errors.log } protocol sieve { info_log_path = /var/log/dovecot-sieve.log log_path = /var/log/dovecot-sieve-errors.log mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_max_line_length = 65536 }

4 4

imapsieve: failed to read mailbox attribute
by Darac Marjal 23 Aug '17

23 Aug '17

Hello all, Hopefully this is something fairly simple. I've been trying to set up the Sieve Antispam system as detailed at https://wiki2.dovecot.org/HowTo/AntispamWithSieve, but at the moment, whenever I change mailboxes I get the following message logged: Aug 22 09:30:45 remy dovecot: imap(darac(a)darac.org.uk): Error: imapsieve: mailbox INBOX: Failed to read /shared/imapsieve/script mailbox attribute and my script does not run when I move files between folders. My sieve files are chmod'ed 0644 and the shell script used to pipe into spamassassin is 0755, so it *should* work, shouldn't it? Is there something I've missed? -- For more information, please reread.

3 4

Patch: acl list from ldap must be possible to have multiple values, that combined in one comma separated list
by DaLiV 23 Aug '17

23 Aug '17

diff to dovecot-2.2.31 hardcoded userdb_acl_groups /as currently not seeing any other fields that need similar way/ in ldap using dynlist - labeledURIObject - some attribute labeledURI :: ldap:///ou=DovecotGroups,dc=DOMAIN,dc=TLD,dc=root?specName?sub?(&(objectclass=posixgroup)(memberuid=XXXXX)) that returns groupnames for each user that he belongs, but as multiple values of same field ... must combine all in one CSV list diff -upbBr src/auth/passdb-ldap.c src/auth/passdb-ldap.c --- src/auth/passdb-ldap.c 2017-06-26 13:29:36.000000000 +0200 +++ src/auth/passdb-ldap.c 2017-08-22 09:56:59.697420441 +0200 @@ -52,13 +52,27 @@ ldap_query_save_result(struct ldap_conne auth_request_set_null_field(auth_request, name); continue; } + if (strcmp(name,"userdb_acl_groups")==0) { + int i = 1; + while (values[i] != NULL) { + strcat(values[0],","); + strcat(values[0],values[i]); + i++; + } + auth_request_log_warning(auth_request,AUTH_SUBSYS_DB, + "Multiple values found for '%s', " + "using combined value '%s'", name, values[0]); + auth_request_set_field(auth_request, name, values[0], + conn->set.default_pass_scheme); + } else { if (values[1] != NULL) { auth_request_log_warning(auth_request, AUTH_SUBSYS_DB, "Multiple values found for '%s', " "using value '%s'", name, values[0]); } auth_request_set_field(auth_request, name, values[0], conn->set.default_pass_scheme); } + } db_ldap_result_iterate_deinit(&ldap_iter); }

2 1

user data transfer when migrating to new server
by voytek＠sbt.net.au 23 Aug '17

23 Aug '17

I;m setting up new server, what are the options for transferring user's mail ? I've tried imapsync, that seems to work well, but, what options do I have for doing accounts or domains where I don't know user's password ? last time I've done, some users had lengthy period of re downloading 'old' mails from new server, is there a way to overcome this ? thanks, V

3 2

v2.2.32 release candidate 2 released
by Timo Sirainen 23 Aug '17

23 Aug '17

https://dovecot.org/releases/2.2/rc/dovecot-2.2.32.rc2.tar.gz https://dovecot.org/releases/2.2/rc/dovecot-2.2.32.rc2.tar.gz.sig A couple of changes since rc1: + Added apparmor plugin. See https://wiki2.dovecot.org/Plugins/Apparmor - director: v2.2.31 caused rapid reconnection loops to directors that were down. Also this was already in rc1's list of changes, but wasn't actually in rc1 yet: - dict-ldap: %variable values used in the LDAP filter weren't escaped. Plus a few other smaller fixes.

4 3

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 23 Aug '17

23 Aug '17

Robert Wolf wrote: >> else (NOT LOCALHOST) and you can see it says LOGINDISABLED unless you >> have enabled something like cram-md5. > > Hi, > > exactly, this is the reason, why plain-text is still needed. You don't need > encryption for authentication, if you have secure authentication. Without > knowing original password, the MITM cannot generate correct hash for login, so > the connection can be plain-text. You don't need plaintext to use CRAM-MD5: there's no problem have *both* CRAM-MD5 and SSL (it's overkill, but works). And mail data is worth protecting too. > Of cource, if you then download your emails, the MITM can still read these > emails too, if these emails are plain-text (not encrypted using e.g. SMIME or > GPG). But he cannot misuse your login. No argument here about using end-to-end encryption, but protecting mail data and metadata is important too. Don't forget also, it's not just about the privacy (reading) of mail data, but it's also important to guarantee the authenticity of mail data from tampering. By the way, if we assume a hostile network where MITM is possible, then even closing STARTTLS ports will not guarantee confidential transport: the MITM attacker can merely open up a fake plaintext-only service port, then proxy that to the target server. The client must deny non-secured transport to be fully protected. Joseph Tam <jtam.home(a)gmail.com>

2 1

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 22 Aug '17

22 Aug '17

Lest anyone think STARTTLS MITM doesn't happen, https://threatpost.com/eff-calls-out-isps-modifying-starttls-encryption-com… Not only for security, I prefer port 993/995 as it's just plain simpler to initiate SSL from the get-go rather than to do some handshaking that gets you to the same point. Joseph Tam <jtam.home(a)gmail.com>

7 10

LMTP and Postfix
by Jerry 22 Aug '17

22 Aug '17

I am setting up a new system that will be using Dovecot with Postifx. I am planning on using LMTP. I read the wiki and and found the settings I need to make in Dovecot and the Postfix main.cf file. However, I saw nothing about the Postfix master.cf file. Do I need to make and changes to it also? Thanks -- Jerry

3 2

Disconnected in APPEND depends on service_count?
by Hajo Locke 22 Aug '17

22 Aug '17

Hello, we have quite odd behaviour of dovecot under new OS. We use dovecot 2.2.18 for years under Ubuntu12 and Ubuntu14. Now we use Ubuntu16 and notice some strange errors. dovecot 2.2.18 is rather old, but runs reliable and we dont need newest features, so we packaged it again on Ubuntu16. For explanation: We use some own patches for dovecot and insert some functions in deb packages, so we want to reuse our code to minimize effort. Under ubuntu16 we see a lot of messages like this on high load servers: Aug 22 08:28:15 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 0 secs, 8192/136342 bytes) in=8379 out=830 Aug 22 08:28:16 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 0 secs, 8192/136342 bytes) in=8985 out=2931 Aug 22 08:42:58 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 29 secs, 13139969/42801634 bytes) in=13140054 out=404 Aug 22 08:43:01 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 3 secs, 1286145/42801634 bytes) in=1286230 out=404 Aug 22 08:43:29 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 2 secs, 704476/42801634 bytes) in=704561 out=404 Aug 22 08:44:29 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 60 secs, 27402241/42801634 bytes) in=27402326 out=404 Aug 22 08:45:30 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 3 secs, 1458177/42801634 bytes) in=1458262 out=404 Aug 22 08:46:15 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 45 secs, 20594652/42801634 bytes) in=20594737 out=404 Aug 22 08:47:38 hostname dovecot: imap(username): Disconnected in APPEND (1 msgs, 11 secs, 4907009/42801634 bytes) in=4907094 out=404 Error occured after sending a mail, when client tries to save sent mail in sent-messages folder. (mbox) Typically this is a client problem caused by firewall/virusguard or network erros. But we saw that many different users are effected and we could reproduce this behaviour on clean clients. In our logs and systemd journal we had no hints leading to other error-messages, no dovecot message which tells that limit xy was reached. Also no hints for other malfunctioning services. No helpful lines with mail_debug=yes We tried a lot and it seems that changing "service_count = 0" to "service_count = 1" is part of solution. After changing and restarting the behaviour is like expected. old: service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 1 service_count = 0 user = dovecot } new: service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 1 service_count = 1 user = dovecot process_limit = 10000 } service_count switches between number of handled client-connections. i dont see a relation between service_count and the permanent disconnects but it seems to be part of problem. Can anybody explain this behaviour or give some handy tips? Thanks, Hajo

1 0

Re: pop 110/995, imap 143/993 ?
by Robert Wolf 22 Aug '17

22 Aug '17

On Tue, 22 Aug 2017, Ivan Warren wrote: > Le 8/22/2017 à 10:03 AM, Robert Wolf a écrit : > > > > WRONG!!! The email is stored plain-text on the first server and then it can > > be > > sent to other few MX servers over plain-text connection. I.e. encrypted > > connection does not protect emails, but the authentication credentials. > > > > > Indeed. > > Encrypted (SSL/TLS) SMTP/IMAP/POP3 sessions only server 1 purpose : To encrypt > authentication. Once a message is sent through a MTA, there is no guarantee of > privacy whatsoever. > > End to End privacy can only be achieved through actual e-mail signing and > encryption (PGP, S/MIME) (but only the message body is encrypted, not the > headers). Hello Ivan yes, headers are not encrypted in plain-text SMTP, the same way as TCP and IP and DNS Requests are not encrypted. One can only hide behind some anonymization system (TOR, Proxy, VPN for TCP, IP, DNS) or some non-presonal mail system to anonymize mail headers to not be able to connect real persones with mail sender/recipient. Regards, Robert.

1 0

Re: pop 110/995, imap 143/993 ?
by Joseph Tam 22 Aug '17

22 Aug '17

Gary <lists(a)lazygranch.com> writes: > If I read this correctly, starttls will fail due to the MITM attack. > That is the client knows security has been compromised. I'm not sure what you man by "fail". STARTTLS is prone to MITM attacks if a client has not been configured to refuse non-STARTTLS/SSL sessions. For clients that will allow both secured and plaintext session (like most MTAs), an attacker can strip out the server's STARTTLS capability declaration and fool the client into using an unencrypted session. > Using SSL/TLS, the MITM can use SSL stripping. Since most Postifx conf > use "may" for security, the message would go though unencrypted. > Correct??? If it's what I described above, then yes. > Is there something to enable for perfect forward security with starttls? PFS is enabled using a particular choice of encryption algorithms (in particular, use of ephememeral keys algorithms like ECDHE-*), but this happens after SSL initiaton, whether by STARTTLS, or by connection to SSL ports. Joseph Tam <jtam.home(a)gmail.com>

1 0

Domain without certificate
by Andreas Meyer 22 Aug '17

22 Aug '17

Hello! I have a new domain integrated into dovecot but no certificate yet. In dovecot.conf there is ssl = yes and the other domains have certificates configured. How do I exclude this new domain from using SSL? Greetings Andreas

1 1