- dovecot - dovecot.org

Re: ACL and virtual user
by Davide Marchi 15 May '17

15 May '17

...I had under my eyes the solution I have not seen: * user=foo lrw Public user=bar lrwstipekxa Public/* user=bar lrwstipekxa I was enough (in my case) add the initial "*" wildcards, like this: * user=info(a)mydomain.com lrwsi where the "*" wildcards means all groups. I have verified and so the configuration is perfect, the user can not delete their own messages The fact remains that on the wiki dovecot ACL these steps, in the case of virtual users, are not clear, at least in my opinion. :-) I hope at least that my experience can be of assistance to other users. Many many thanks! Davide

1 0

ACL and virtual user
by Davide Marchi 15 May '17

15 May '17

Hi friends, I would like to remove write rights for a specific virtual user/email address. I've read the wiki "https://wiki2.dovecot.org/ACL" but there is nothing about it. So I started reading and rereading some old ML, like this: https://www.dovecot.org/list/dovecot/2006-June/013683.html where they talk about something like that but I would like to implement current guidelines for the "Global ACL file" and for virtual user. So I've try: * user=foo lrw Public user=bar lrwstipekxa Public/* user=bar lrwstipekxa But in my case for virtual user, so I tried (obviously I changed the email address with a generic one): -------------- #user=info(a)mydomain.com lrwsi -------------- Log: May 15 10:40:44 server dovecot: imap(info(a)mydomain.com): Error: Global ACL file /etc/dovecot/dovecot-acl line 1: Unknown ID 'lrwsi' -------------- #owner #user=info at mydomain.com lrwsi -------------- Log: May 15 10:47:58 server dovecot: imap(info(a)mydomain.com): Error: Global ACL file /etc/dovecot/dovecot-acl line 1: Missing ACL rights -------------- #user=info at mydomain.com lrwsi -------------- Log: May 15 10:51:57 server dovecot: imap(info(a)mydomain.com): Error: Global ACL file /etc/dovecot/dovecot-acl line 2: Unknown ID 'at' But none of these gave results, could you explain better or gime me an example? Many many thanks! Davide Italy

1 0

[BUG] doveadm kick doesn't play well with hibernate
by Christian Balzer 15 May '17

15 May '17

Hello, Dovecot 2.2.27 (Debian Jessie backports). When issuing a "doveadm kick" for a specific user I was greeted by: --- "warning: other connections would also be kicked from following users:" --- and a list of 22odd thousand users. As it turns out, kick wants to smack the hibernation proces(ses) that have hibernated sessions for this user, obviously the wrong approach here. If there's doveadm command to wake up and thus un-hibernate sessions for a specific user this could be used as a workaround but a quick glance suggest no such thing. This functionality is absolutely crucial for us as we need this for our custom mailbox migration functionality. If there's no workaround or fix within 2 months I'll be forced to disable hibernation again (with a heavy heart). Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/

2 2

Dovecot 2.2.29.1 + VPopMail 5.4.33
by Nicholas Chua 12 May '17

12 May '17

Hi all, I have a fresh installation of a Vpopmail 5.4.33 + Dovecot 2.2.29.1 + SQL As usual I followed the AuthDatabase/VPopMail wiki password_query = SELECT CONCAT(pw_name, '@', pw_domain) AS user, \ pw_clear_passwd AS password \ FROM vpopmail \ WHERE pw_name = '%n' AND pw_domain = '%d' user_query = SELECT pw_dir as home, \ 89 AS uid, 89 AS gid \ FROM vpopmail \ WHERE pw_name = '%n' AND pw_domain = '%d' For VPopMail, I prefer to have an individual table in the vpopmail database for each domain. So my structure will be something like this vpopmail.abc_com vpopmail.xyz_com To achieve this I add this configure when compiling VPopMail --disable-many-domains But dovecot will not read vpopmail.abc_com, instead it keep looking for vpopmail.vpopmail auth-worker(8643): Warning: mysql: Query failed, retrying: Table 'vpopmail.vpopmail' doesn't exist If I remove --disable-many-domains in the configuration, I have no issue. Is there a new password and user query to have this working? The last working version I had installed is Dovecot 2.2.15 Thank you nic

1 0

folders in public namespace only visable to 2nd folder level in 2.2.29.1
by Andreas Oster 11 May '17

11 May '17

Hi all, I am currently facing an issue with Dovevot version 2.2.29.1 where subfolders in a public namespace are only visible to the 2nd folder level: namespace Public -> folder "1st" -> folder -> "2nd" -> folder "3rd" .... When one user creates a subfolder below the 2nd level other users do not see that folder and are unable to subscribe to this folder. Folders created under the 1st level however are visible and subscribable by other users. namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = children type = public separator = / prefix = Public/ location = maildir:/var/vmail/public:INDEXPVT=~/Maildir/public subscriptions = no } I do not know at which point ( dovecot update ) this issue appeared. Does anyone face the same problem ? Thank you for your kind help best regards Andreas

5 5

Example for doveadm-save using Doveadm HTTP API
by KT Walrus 11 May '17

11 May '17

I could use an example of how to use curl to save a new message to a user’s INBOX using the Doveadm HTTP API. https://wiki2.dovecot.org/Design/DoveadmProtocol/HTTP <https://wiki2.dovecot.org/Design/DoveadmProtocol/HTTP> Do I really use the -d option and inline the entire new message in the command-line? Or, should I create a temporary .json file with the message wrapped in JSON and pass this filename to the -d option? Does anyone have a PHP class that abstracts the HTTP API commands? I’ve been using the Roundcube Framework to deliver new messages by IMAP, but I’m experimenting whether the Doveadm HTTP API might be a better solution. I eventually want my PHP code to do full administration of my users mailboxes. I was planning on using Sieve pipe PHP scripts in conjunction with IMAP to do full admin on mailboxes (as they receive new messages or change a flag, I would trigger maintenance on the mailbox such as deleting or moving to the trash old messages or filing a copy of a new message in a folder). Finally, is the Doveadm HTTP API stable enough to use in production? It seems like the documentation is rather minimal. Can this interface really be used for new message delivery instead of LMTP in production? Or, is this a bad idea to combine mailbox administration with new message delivery? Does anyone here use the Doveadm HTTP API in production? Kevin

3 5

confused with ssl settings and some error - need help
by Poliman - Serwis 09 May '17

09 May '17

Hi, To default dovecot.conf file I added (based on found documentation): ssl = required disable_plaintext_auth = yes #change default 'no' to 'yes' ssl_prefer_server_ciphers = yes ssl_options = no_compression ssl_dh_parameters_length = 2048 ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA 1. Are these settings good or can be improved? 2. Is this line proper: ssl_protocols = !SSLv2 !SSLv3 !TLSv1 !TLSv1.1 or maybe should be: ssl_protocols = !SSLv2 !SSLv3 3. Last thing. I have below errors (they appear in loop in mail.err log file): #Apr 25 14:08:09 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol #Apr 25 14:08:09 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:1408A10B:SSL routines:ssl3_get_client_hello:wrong version number #Apr 25 14:08:51 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac #Apr 25 14:08:51 serwer-1 dovecot: imap-login: Error: SSL: Stacked error: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher When I setup in postfix main.cf file (other lines default): tls_ssl_options = no_ticket, no_compression tls_preempt_cipherlist = yes smtpd_sasl_security_options=noanonymous,noplaintext smtpd_sasl_tls_security_options=noanonymous,noplaintext smtpd_tls_mandatory_ciphers = high smtpd_tls_dh1024_param_file = /etc/postfix/dh2048.pem #instead of below I tried smtpd_tls_mandatory_exclude_ciphers but I don't know what should be setup smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, DES-CBC3-SHA, RC4-MD5, RC4-SHA, ECDHE-RSA-RC4-SHA smtp_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CBC3-SHA, ECDHE-RSA-DES-CBC3-SHA, DES-CBC3-SHA, RC4-MD5, RC4-SHA, ECDHE-RSA-RC4-SHA Is between dovecot and postfix some communication using above ciphers or something that generate that errors in log or maybe some public client try connect and can't establish connection? Server with Ubuntu 16.04 LTS, postfix 3.1 and dovecot 2.2.22 and openssl 1.0.2k. -- *Pozdrawiam / Best Regards* *Piotr Bracha* *tel. 534 555 877* *serwis(a)poliman.pl <serwis(a)poliman.pl>*

2 8

error trying to access the doveadm http api
by KT Walrus 09 May '17

09 May '17

I’m trying out the the doveadm http api for the first time. When I do: $ curl -H "Authorization: Basic <base64 doveadm:doveadm_password>" http://localhost:8888 curl: (52) Empty reply from server In the logs, I see the following error: May 09 11:58:05 doveadm(10.0.0.17): Error: doveadm client not compatible with this server (mixed old and new binaries?) I am running Dovecot 2.2.29.1 in Docker containers. What am I doing wrong? Kevin

1 0

DoS (was IMAP-auth on LAN and otherwise)
by Rupert Gallagher 09 May '17

09 May '17

Today the problem raised its head again, with a twist. A LAN client lost the DNS setting that pointed directly to the LAN address of the IMAP server, and two things happened: the LAN client could not connect to IMAP as we know, and a telephone call from the external client reported the same. When the LAN client closed Thunderbird, then the external client regained access. There were no other clients online at the same time. It turns out that the single LAN client was making enough requests to saturate dovecot's authentication service. I already described the detail with wireshark. On Tue, May 2, 2017 at 3:46 PM, Rupert Gallagher <ruga(a)protonmail.com> wrote: Hello, Thunderbird has been bugging us with connection errors. Dovecot is installed on a local server that carries a local IP and a public IP. When Thunderbird on a local client connects successfully, Wireshark shows a SYN request from the client's IP on LAN to the public IP of the server, followed by the ACK from the same public IP. When Thunderbird on the same local client fails to connect, Wireshark shows a SYN request from the client's IP on LAN to the public IP of the server, followed by the ACK from the server's LAN address, the client does not accept the ACK as valid and sends a new SYN request. The loop eventually leads to time-out. At the client's console, the DNS query of the IMAP server always responds with the server's public IP address. It is evident from Wireshark that the dovecot server sends ACKs from two IPs. Is it possible to instruct Dovecot to use the public IP only?

2 2

2.2 -git fails to compile as of Apr 28 2017
by Reuben Farrelly 09 May '17

09 May '17

This has been broken for the last few days: libtool: link: ( cd ".libs" && rm -f "lib10_quota_plugin.la" && ln -s "../lib10_quota_plugin.la" "lib10_quota_plugin.la" ) libtool: link: x86_64-pc-linux-gnu-gcc -std=gnu99 -O2 -pipe -march=native -mtune=native -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -Wl,-O1 -o .libs/quota-status quota-status.o .libs/quota.o .libs/quota-count.o .libs/quota-fs.o .libs/quota-dict.o .libs/quota-dirsize.o .libs/quota-imapc.o .libs/quota-maildir.o .libs/quota-plugin.o .libs/quota-storage.o .libs/quota-util.o .libs/rquota_xdr.o -Wl,--export-dynamic -Wl,--as-needed ../../../src/lib-storage/.libs/libdovecot-storage.so /var/tmp/portage/net-mail/dovecot-9999_p20170427/work/dovecot-9999_p20170427/src/lib-dovecot/.libs/libdovecot.so ../../../src/lib-imap-storage/.libs/libimap-storage.a ../../../src/lib-dovecot/.libs/libdovecot.so -ldl -Wl,-rpath -Wl,/usr/lib64/dovecot .libs/quota-imapc.o: In function `imapc_quota_refresh': quota-imapc.c:(.text+0x8dd): undefined reference to `imapc_storage_client_register_untagged' quota-imapc.c:(.text+0x8f7): undefined reference to `imapc_storage_client_register_untagged' quota-imapc.c:(.text+0x90a): undefined reference to `imapc_client_get_capabilities' quota-imapc.c:(.text+0x964): undefined reference to `imapc_simple_context_init' quota-imapc.c:(.text+0x975): undefined reference to `imapc_simple_callback' quota-imapc.c:(.text+0x97e): undefined reference to `imapc_client_cmd' quota-imapc.c:(.text+0x996): undefined reference to `imapc_command_sendf' quota-imapc.c:(.text+0x99e): undefined reference to `imapc_simple_run' quota-imapc.c:(.text+0xaab): undefined reference to `imapc_simple_context_init' quota-imapc.c:(.text+0xabc): undefined reference to `imapc_simple_callback' quota-imapc.c:(.text+0xac5): undefined reference to `imapc_client_cmd' quota-imapc.c:(.text+0xadd): undefined reference to `imapc_command_sendf' quota-imapc.c:(.text+0xae5): undefined reference to `imapc_simple_run' collect2: error: ld returned 1 exit status make[4]: *** [Makefile:694: quota-status] Error 1 make[4]: Leaving directory '/var/tmp/portage/net-mail/dovecot-9999_p20170427/work/dovecot-9999_p20170427/src/plugins/quota'

3 7

PoC doveadm HTTP API client
by Hannu Ylitalo 09 May '17

09 May '17

Hi, In case you are interested in testing the Doveadm HTTP API in a bit more simplified fashion I have written a client for it in Python. Feedback is always appreciated (pull requests more appreciated). https://github.com/hnsk/doveadm-http-cli <https://github.com/hnsk/doveadm-http-cli> -Hannu

1 0

logging number of deleted messages
by David Mehler 07 May '17

07 May '17

Hello, I'm running Dovecot 2.29. I've got it going through a Mysql database. I've got the auto expunge plugin loaded. What I'm wanting to know is is there message count deletion ability? For example, does the mail_log, trash, or auto expunge plugins log how many messages were deleted? Thanks. Dave.

1 0

IMAP-auth on LAN and otherwise
by Rupert Gallagher 04 May '17

04 May '17

Hello, Thunderbird has been bugging us with connection errors. Dovecot is installed on a local server that carries a local IP and a public IP. When Thunderbird on a local client connects successfully, Wireshark shows a SYN request from the client's IP on LAN to the public IP of the server, followed by the ACK from the same public IP. When Thunderbird on the same local client fails to connect, Wireshark shows a SYN request from the client's IP on LAN to the public IP of the server, followed by the ACK from the server's LAN address, the client does not accept the ACK as valid and sends a new SYN request. The loop eventually leads to time-out. At the client's console, the DNS query of the IMAP server always responds with the server's public IP address. It is evident from Wireshark that the dovecot server sends ACKs from two IPs. Is it possible to instruct Dovecot to use the public IP only?

3 7

Re: dovecot log shows: service=imap ... Error: Temp file, creation to /tmp/dovecot.imap. failed: No such directory
by Peter 03 May '17

03 May '17

I am using dovecot 2.2 with plesk 12 and I have made no modifications to the dovecot config. >> Logwatch reports the messages below. >> The errors don't seem to appear for every imap connect as can be seen from the number of deliveries and successful logins. >> So what makes dovecot fail sometimes to create the /tmp/dovecot.imap? >> >> >> Dovecot Deliveries: 19 >> Dovecot IMAP and POP3 Successful Logins: 106 >> Dovecot disconnects: 72 >> >> **Unmatched Entries** >> dovecot: message repeated 4 times: [ service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory]: 1 Time(s) >> dovecot: message repeated 5 times: [ service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory]: 1 Time(s) >> dovecot: service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory: 10 Time(s) >> dovecot: service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory: 1 Time(s) >> Maybe you are chrooting dovecot yourself? The chroot must contain /tmp directory. << If this was the case I would expect the error for every imap connection and not only sometimes. Nonetheless: How can I check the chroot settings? Peter

1 0

Problem with Userid
by Luciano Mannucci 03 May '17

03 May '17

I have a problem with a physical user that was removed and recreated whith same name and different uid. The home dir, the mailbox file and the index directory where removed and recreated with the new uid/gid. I can feed the mailbox via procmail, though dovecot-lda complains that userids do not match: May 02 15:27:33 lda(alessandro_cmr): Error: stat(/var/spool/mailboxes/alessandro_cmr/INBOX) failed: Permission denied (euid=3525(alessandro_cmr) egid=111(poppers) missing +x perm: /var/spool/mailboxes/alessandro_cmr, dir owned by 1000:111 mode=0700) doveadm auth cache flush says 28 entries flushed but the situation does'nt change. here's my doveconf -n: # 2.2.29.1 (e0b76e3): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.17 (e179378) # OS: Linux 3.0.101-105-pae i686 openSUSE 11.4 (i586) ext3 auth_cache_size = 3 k auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes default_client_limit = 1249 default_vsz_limit = 712 M disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 100 info_log_path = /var/log/dovecot/logfile.info listen = * log_path = /var/log/dovecot/logfile login_greeting = Dovecot at Baobab ready. login_trusted_networks = 127.0.0.0/8 212.45.144.0/24 192.168.134.0/24 mail_location = mbox:/var/spool/mailboxes/%u:INBOX=/var/spool/mail/%u:DIRNAME=mbox:INDEX=/var/dovecot_indexes/%u maildir_copy_with_hardlinks = no managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_lock_timeout = 443 secs namespace { inbox = yes location = prefix = separator = . type = private } passdb { driver = pam } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size } protocols = pop3 imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { inet_listener imaps { address = * } process_limit = 512 } service pop3-login { chroot = executable = pop3-login -D inet_listener pop3s { address = * } process_limit = 512 } ssl_ca = </etc/ssl/ca.crt ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd } version_ignore = yes protocol imap { imap_client_workarounds = delay-newmail mail_plugins = mail_log notify } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_enable_last = yes } protocol lda { info_log_path = /var/log/dovecot/lda.log log_path = /var/log/dovecot/lda-errors.log postmaster_address = mostmaster(a)mcs.it } Any idea? Thanks in advance 2 any helper, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

2 2

Sieve dict and bindir question
by Alessio Cecchi 03 May '17

03 May '17

Hi, I have setup the latest Dovecot and Sieve with dict in order to read rules from MySQL and works fine: sieve_before = dict:proxy::sieve;name=activesql;bindir=~/.sieve-bin dict { sieve = mysql:/etc/dovecot/dovecot-dict-sieve-sql.conf.ext } # cat /etc/dovecot/dovecot-dict-sieve-sql.conf.ext connect = host=10.1.1.1 dbname=dovecot user=dovecot password=Ciao map { pattern = priv/sieve/name/$script_name table = user_sieve_scripts username_field = username value_field = id fields { script_name = $script_name } } map { pattern = priv/sieve/data/$id table = user_sieve_scripts username_field = username value_field = script_data fields { id = $id } } But when I update the rules in mysql sieve continue to apply only the "old" rules stored in the binary. The only way to apply the new rules is to delete the .sieve-bin/activesql.svbin. If I remove ";bindir=~/.sieve-bin" works fine. This is a cache issue and can be fixed via setting, is an issue or is a "feature" :-) ? Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

3 4

dovecot log shows: service=imap ... Error: Temp file creation to /tmp/dovecot.imap. failed: No such directory
by Peter Kielbasiewicz 03 May '17

03 May '17

I am using dovecot 2.2 with plesk 12 and I have made no modifications to the dovecot config. Logwatch reports the messages below. The errors don't seem to appear for every imap connect as can be seen from the number of deliveries and successful logins. So what makes dovecot fail sometimes to create the /tmp/dovecot.imap? Dovecot Deliveries: 19 Dovecot IMAP and POP3 Successful Logins: 106 Dovecot disconnects: 72 **Unmatched Entries** dovecot: message repeated 4 times: [ service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory]: 1 Time(s) dovecot: message repeated 5 times: [ service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory]: 1 Time(s) dovecot: service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory: 10 Time(s) dovecot: service=imap, user=tester(a)example.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory: 1 Time(s)

2 1

Problem with Pigeonhole/Sieve
by Kamil Kapturkiewicz 03 May '17

03 May '17

Hi, I am trying to configure Pigeonhole to get filters in RoundCube working. Unfortunately I am getting following error in DoveCot log instead: May 01 14:35:41 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=248(<getpwuid() error>) egid=248(<getgrgid() error>) missing +x perm: /, we're not in group 202, dir owned by 0:202 mode=0750) May 01 14:35:41 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=248(<unknown>) egid=248(<unknown>) missing +x perm: /, we're not in group 202, dir owned by 0:202 mode=0750) May 01 14:36:00 master: Warning: Killed with signal 15 (by pid=37695 uid=0 code=kill) May 01 14:36:36 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=248(<getpwuid() error>) egid=248(<getgrgid() error>) missing +x perm: /, we're not in group 202, dir owned by 0:202 mode=0750) May 01 14:36:36 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=248(<unknown>) egid=248(<unknown>) missing +x perm: /, we're not in group 202, dir owned by 0:202 mode=0750) May 01 15:17:08 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=248(<getpwuid() error>) egid=248(<getgrgid() error>) missing +x perm: /, we're not in group 202, dir owned by 0:202 mode=0750) May 01 15:17:08 managesieve-login: Error: auth: connect(login) in directory / failed: Permission denied (euid=248(<unknown>) egid=248(<unknown>) missing +x perm: /, we're not in group 202, dir owned by 0:202 mode=0750) Above appears in log, when I am trying to access filters configuration in RC or manually connecting to sieve using telnet. My DoveCot configuration: # 2.2.27 (c0f36b0): /usr/local/dovecot/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.15 (97b3da0) # OS: Linux 4.4.38 x86_64 Slackware 14.2 ext4 debug_log_path = /var/log/dovecot/dovecot-debug.log first_valid_gid = 12 first_valid_uid = 8 info_log_path = /var/log/dovecot/dovecot-info.log last_valid_gid = 12 last_valid_uid = 8 listen = *, [::] log_path = /var/log/dovecot/dovecot.log mail_location = maildir:/var/mail/%d/%n managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocols = imap pop3 sieve service auth { user = dovecot } service imap-login { user = dovecot } service pop3-login { user = dovecot } ssl_cert = </etc/letsencrypt/live/domain/fullchain.pem ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:+HIGH:+MEDIUM ssl_key = # hidden, use -P to show it userdb { driver = prefetch } verbose_proctitle = yes protocol pop3 { pop3_uidl_format = %08Xu%08Xv } What could be a reason of that? -- skype. kamil.kapturkiewicz tel/whatsapp. +44 758 306 8467

2 3

Re: Re: migrate Maildir to mdbox
by Joseph Tam 02 May '17

02 May '17

Michael Segel <dovecot_mjs(a)hotmail.com> writes: > Which is preferred? MailDir or Mbox? (directory vs flat file) Mailbox; I wish I converted when I had the chance. The only benefits I can see with mbox is that it's slightly less complicated, and if you're doing pattern searching or some global mailbox operation, less I/O intensive, but that's a niche case and usually ameliorated by indices. However, backing up mbox is a pain since changes results in the entire file being backed up for snapshotting filesystems, and atomicity of I/O operations is much harder. It just doesn't scale well for large mailboxes. As Aki recommends, use something other than mbox unless you got some legacy issue. > How would you do this when migrating from an old server to a new one? Lots of third party scripts out there that will convert for you. I think you can do dovecot->dovecot dsync to convert. Joseph Tam <jtam.home(a)gmail.com>

1 0

migrate Maildir to mdbox
by Tamas Papp 02 May '17

02 May '17

Hi, I replaced HDDs in my home server and reinstalled the OS (Ubuntu 17.04). Since I had some time I reviewed my Dovecot configuration and changed a couple of things, including mailbox format. Now I would like to migrate e-mail (about 20G -- I use this server as an e-mail archive). The Maildir is available on the (old) hard disk. The new dovecot is running. What should I use? Would mbsync work? I would prefer a solution that does not mess up the UUIDs, but I can live with that too. $ dovecot --version 2.2.27 (c0f36b0) Incidentally, would you recommend sdbox or mdbox? Lots of e-mails, many of them have large attachments. best, Tamas

4 4

Issue with parsing of forwarded messages with attachments and quotes in the subject
by Giovanni Salvatore Fois 02 May '17

02 May '17

Hi all, at work we use Roundcube acting as a mail client for the Dovecot Imap server. In Roundube the messages are parsed through the Imap BODYSTRUCTURE command If a message contains forwarded messages and attachments and some of the messages contains a quote (") in the subject, then the resulting BODYSTRUCTURE appears to be malformed. --- After some digging through the code of Dovecot, it seems to me that the problem is related to the function: imap_append_string_for_humans defined at the line 120 of the file src/lib-imap/imap-quote.c (dovecot sources v. 2.2.29) Said function is supposed to return a quoted version of the input string while removing unwanted characters from the input data. But, if I call it with a string containing quotes as argument (eg: I am a lazy " programmer) in the resulting output the quotes aren't escaped and the output string is not quoted. ---- This is related to the stated issue through the function calls in: part_write_body [ defined at line 142 of imap-bodystructure.c ] which calls imap_envelope_write [defined at line 46 of imap-envelope.c] which finally calls imap_append_string_for_humans ---- Thank you for your time. Best regards, Giovanni S. Fois

2 2

Dovecot 2.2 maildir replication issue
by Joelly Alexander 01 May '17

01 May '17

Hello, I'm just trying to setup two mailservers with dovecot 2.2, postfix, mysql, postfixadmin where i would like to sync the maildirs between them; I'm at the point where sending/receiving and qouta is working and try the maildir replication but it only creates the maildir directories (as example: /srv/vmail/test.domain/screenie/) on the second server but nothing inside the maildir is copied over; Both servers are setup identical except the things which have to be different (ssl certs and mail_replica node entries); This is what i'm getting in the log but stuck at: dsync-server(screenie(a)test.domain): Error: User has no home directory I assume it's the user_query in dovecot-sql.conf.ext but not 100% sure nor an idea to fix it; May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: auth input: user=screenie(a)test.domain May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: auth input: screenie(a)test.domain mail=maildir:/srv/vmail/test.domain/screenie/ quota_rule=*:bytes=102400000 uid=5000 gid=5000 May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Added userdb setting: mail=maildir:/srv/vmail/test.domain/screenie/ May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Added userdb setting: plugin/quota_rule=*:bytes=102400000 May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Effective uid=5000, gid=5000, home= May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Quota root: name=User Quota backend=dict args=:proxy::sqluserquota May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Quota rule: root=User Quota mailbox=* bytes=102400000 messages=0 May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Quota rule: root=User Quota mailbox=Trash bytes=+10240000 (10%) messages=0 May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Quota grace: root=User Quota bytes=10240000 (10%) May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: dict quota: user=screenie(a)test.domain, uri=proxy::sqluserquota, noenforcing=0 May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/srv/vmail/test.domain/screenie/ May 1 18:09:48 mx1 dovecot: doveadm(192.168.1.10,screenie(a)test.domain): Debug: maildir++: root=/srv/vmail/test.domain/screenie, index=, indexpvt=, control=, inbox=/srv/vmail/test.domain/screenie, alt= May 1 18:09:48 mx1 dovecot: dsync-server(screenie(a)test.domain): Error: User has no home directory May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: auth input: user=screenie(a)test.domain May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: auth input: screenie(a)test.domain mail=maildir:/srv/vmail/test.domain/screenie/ quota_rule=*:bytes=102400000 uid=5000 gid=5000 May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Added userdb setting: mail=maildir:/srv/vmail/test.domain/screenie/ May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Added userdb setting: plugin/quota_rule=*:bytes=102400000 May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Effective uid=5000, gid=5000, home= May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Quota root: name=User Quota backend=dict args=:proxy::sqluserquota May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Quota rule: root=User Quota mailbox=* bytes=102400000 messages=0 May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Quota rule: root=User Quota mailbox=Trash bytes=+10240000 (10%) messages=0 May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Quota grace: root=User Quota bytes=10240000 (10%) May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: dict quota: user=screenie(a)test.domain, uri=proxy::sqluserquota, noenforcing=0 May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Namespace inbox: type=private, prefix=, sep=/, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/srv/vmail/test.domain/screenie/ May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: maildir++: root=/srv/vmail/test.domain/screenie, index=, indexpvt=, control=, inbox=/srv/vmail/test.domain/screenie, alt= May 1 18:09:53 mx1 dovecot: doveadm(screenie(a)test.domain): Debug: Namespace : Using permissions from /srv/vmail/test.domain/screenie: mode=0700 gid=default May 1 18:09:53 mx1 dovecot: dsync-local(screenie(a)test.domain): Error: User has no home directory root@mx1:/# dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-48-pve x86_64 Debian 8.7 simfs auth_mechanisms = plain login dict { sqluserquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } doveadm_password = password doveadm_port = 64500 mail_debug = yes mail_location = maildir:/srv/vmail/%d/%n/maildir mail_plugins = " notify quota replication zlib" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Items" { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:mx2:64500 quota = dict:User Quota::proxy::sqluserquota quota_rule2 = Trash:storage=+10%% sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = " imap lmtp sieve pop3" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service config { unix_listener config { user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service doveadm { inet_listener { port = 64500 ssl = no } user = vmail } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/ssl/certs/mx1.pem ssl_key = </etc/ssl/private/mx1.key userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " notify quota replication zlib quota" } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = " notify quota replication zlib quota" } protocol imap { mail_plugins = " notify quota replication zlib imap_quota" } protocol pop3 { mail_plugins = " notify quota replication zlib" } root@mx1:/# root@mx1:/etc/dovecot# grep -v '^ *$#.*$\?$' dovecot-sql.conf.ext driver = mysql connect = host=127.0.0.1 dbname=mailserver user=vmail password=password default_pass_scheme = SHA512-CRYPT password_query = SELECT CONCAT('*:bytes=', quota) AS userdb_quota_rule, password FROM mailbox WHERE username = '%u' user_query = SELECT CONCAT('maildir:/srv/vmail/',maildir) AS mail, CONCAT('*:bytes=', quota) AS quota_rule, 5000 AS uid, 5000 AS gid FROM mailbox WHERE username = '%u' iterate_query = SELECT username AS user FROM mailbox WHERE active = '1'; root@mx1:/etc/dovecot# thx, screenie

1 0

most secure password scheme
by David Mehler 30 Apr '17

30 Apr '17

Hello, I have a few questions on password schemes. Is SHA512 the most secure? Is there a difference between SHA512 and SHA512-CRYPT? What about SSHA512 and SSH512-CRYPT? Is there a problem with this sql statement: UPDATE virtual_users SET password=CONCAT(‘{SHA256-CRYPT}’, ENCRYPT (‘Password Goes Here’, CONCAT(‘$5$’, SUBSTRING(SHA(RAND()), -16)))) WHERE user=’user(a)example.xn--com-to0a; I'm getting an error 1064 at the ending email address. Thanks. Dave.

3 4

IMAP hibernate and scalability in general
by Christian Balzer 30 Apr '17

30 Apr '17

Hello, as some may remember, we're running very dense IMAP cluster here, in excess of 50k IMAP sessions per node (current record holder is 68k, design is for 200k+). The first issue we ran into was that the dovecot master process (which is single thread and thus a bottleneck) was approaching 100% CPU usage (aka using a full core) when trying to spawn off new IMAP processes. This was rectified by giving IMAP a service count of 200 to create a pool of "idling" processes eventually, reducing the strain for the master process dramatically. That of course required generous cranking up ulimits, FDs in particular. The next issues of course is (as mentioned before) the memory usage of all those IMAP processes and the fact that quite a few things outside of dovecote (ps, etc) tend to get quite sedate when dealing with tens of thousands of processes. We just started to deploy a new mailbox cluster pair with 2.2.27 and having IMAP hibernate configured. Getting this work is a PITA though with regards to ownership and access rights to the various sockets, this part could definitely do with some better (I know, difficult) defaults or at least more documentation (none besides the source and this ML). Initial results are very promising, depending on what your clients are doing (are they well behaved, are your users constantly looking at other folders, etc) the vast majority of IDLE processes will be in hibernated at any given time and thus not only using a fraction of the RAM otherwise needed but also freeing up process space. Real life example: 240 users, 86 imap processes (80% of those not IDLE) and: dovecot 119157 0.0 0.0 10452 3236 ? S Apr01 0:21 dovecot/imap-hibernate [237 connections] That's 237 hibernated connections and thus less processes than otherwise. I assume that given the silence on the ML what we are going to be the first hibernate users where the term "large scale" does apply. Despite that I have some questions, clarifications/confirmations: Our current default_client_limit is 16k, which can be seen by having 5 config processes on our 65k+ session node. ^_- This would also apply to imap-hibernate, one wonders if that's fine (config certainly has no issues) or if something smaller would be appropriate here? Since we have idling IMAP processes around most of the time, the strain of re-spawning proper processes from imap-hibernate should be just as reduced as for the dovecot master, correct? I'll keep reporting our experiences here, that is if something blows up spectacularly. ^o^ Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/

4 16

Re: Dovecot last_login plugin and Mysql
by David Mehler 29 Apr '17

29 Apr '17

Hi, Thanks for the pointing out of the oops! I missed that. Don't worry that has been changed. Any suggestions on my issue? Thanks. Dave. On 4/28/17, David Mehler <dave.mehler(a)gmail.com> wrote: > Hi, > > OOPS! I missed that one and it was big. > > Changing now. > > Thanks. > Dave. > > > On 4/28/17, Noel Butler <noel.butler(a)ausics.net> wrote: >> ummmmmm >> >> It's usually a good idea to redact user and passwords for databases, >> even if only local socket ;) >> >> I suggest you change it ASAP. >> >> On 29/04/2017 10:53, David Mehler wrote: >> >>> Hello, >>> >>> Here is the requested file: >>> >>> driver = mysql >>> connect = host=/tmp/mysql.sock dbname=mail user=mail_admin >>> password=MainBoard55 >>> >>> # Last Login >>> map { >>> pattern = shared/last-login/$user >>> table = virtual_users >>> username_field = user >>> value_field = lastlogin >>> fields { >>> user = $user >>> } >>> } >>> >>> Thanks. >>> Dave. >>> >>> On 4/28/17, Aki Tuomi <aki.tuomi(a)dovecot.fi> wrote: >>> On April 29, 2017 at 12:29 AM David Mehler <dave.mehler(a)gmail.com> >>> wrote: >>> >>> Hello, >>> >>> Trying to implement lastlogin via mysql. I'm getting an unknown column >>> username which I don't get. Here's the log: >>> >>> Apr 28 17:18:15 ohio dovecot: imap-login: Login: >>> user=<user(a)example.com>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, >>> mpid=16257, secured, session=<KxiSnEBOwUx/AAAB> >>> >>> Apr 28 17:18:15 ohio dovecot: dict(17099): Error: sql dict: commit >>> failed: Unknown column 'username' in 'field list' >>> >>> Apr 28 17:18:15 ohio dovecot: imap(user(a)example.com): Error: >>> dict-client: server returned failure: 1493414295 (reply took 0.026 >>> secs) >>> >>> Apr 28 17:18:15 ohio dovecot: imap(user(a)example.com): Error: >>> last_login_dict: Failed to write value for user user(a)example.com >>> >>> You can configure all this in dovecot-dict-sql.conf, which you have not >>> provided. The actual column names are defined there. >>> >>> Aki >> >> -- >> Kind Regards, >> >> Noel Butler >> >> This Email, including any attachments, may contain legally privileged >> information, therefore remains confidential and subject to copyright >> protected under international law. You may not disseminate, discuss, or >> reveal, any part, to anyone, without the authors express written >> authority to do so. If you are not the intended recipient, please notify >> the sender then delete all copies of this message including attachments, >> immediately. Confidentiality, copyright, and legal privilege are not >> waived or lost by reason of the mistaken delivery of this message. Only >> PDF [1] and ODF [2] documents accepted, please do not send proprietary >> formatted documents >> >> >> >> Links: >> ------ >> [1] http://www.adobe.com/ >> [2] http://en.wikipedia.org/wiki/OpenDocument >

2 1