- dovecot - dovecot.org

Understanding quotas
by Robert Moskowitz 23 Mar '17

23 Mar '17

Just to level-set, I am using Centos7-arm which supplies Dovecot 2.2.10. I don't have access to a arm build or mock environment and use what is available (I DID try to install them but had dependency issues). Much of what I have is from campworld, but some I have picked up from other Centos mailserver builders. Also I am using Postfixadmin which provides quotas per user in mysql database. To access those quotas for dovecot, I have the following script: cat <<EOF>/etc/dovecot/dovecot-dict-quota.conf || exit 1 connect = host=localhost dbname=postfix user=postfix password=$Postfix_Database_Password map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } EOF Where $Postfix_Database_Password is an env variable in my install howto. I am setting up quota plugins as follows: sed -i "/#mail_plugins/ a mail_plugins = quota sieve" /etc/dovecot/conf.d/15-lda.conf sed -i "/#mail_plugins / a mail_plugins = quota imap_quota trash" /etc/dovecot/conf.d/20-imap.conf sed -i "/#mail_plugins/ a mail_plugins = quota" /etc/dovecot/conf.d/20-pop3.conf But I am having 'challenges' with how to actually enable quotas and understanding 90-quota.conf. I am starting from campworld's 'reduced' dovecot.conf seeing: dict { quotadict = mysql:/etc/dovecot/dovecot-dict-quota.conf } and plugin { quota = dict:user::proxy::quotadict acl = vfile:/etc/dovecot/acls trash = /etc/dovecot/trash.conf sieve_global_path = /home/sieve/globalfilter.sieve sieve = ~/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /home/sieve/ #sieve_extensions = +notify +imapflags sieve_max_script_size = 1M } I have put the sieve plugin lines into the 90-sieve.conf and the acl into 10-acl.conf. Trash is a separate matter for a later question... So I am looking for guidance as to how to integrate the Postfixadmin quota information properly into 90-quota.conf thank you

2 3

Re: replicator crashing - oom
by Daniel Miller 22 Mar '17

22 Mar '17

Think I got it: #0 0x00007fddaf597c37 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56 #1 0x00007fddaf59b028 in __GI_abort () at abort.c:89 #2 0x00007fddaf9c0c86 in default_fatal_finish (type=<optimized out>, status=status@entry=0) at failures.c:201 #3 0x00007fddaf9c0d6e in i_internal_fatal_handler (ctx=0x7fff7197d000, format=<optimized out>, args=<optimized out>) at failures.c:670 #4 0x00007fddaf958322 in i_panic (format=format@entry=0x7fddafa047b8 "data stack: Out of memory when allocating %lu bytes") at failures.c:275 #5 0x00007fddaf9bee3f in mem_block_alloc (min_size=536870912) at data-stack.c:341 #6 0x00007fddaf9bf08b in t_malloc_real (size=size@entry=536870912, permanent=permanent@entry=true) at data-stack.c:396 #7 0x00007fddaf9bf0ca in t_malloc (size=size@entry=536870912) at data-stack.c:442 #8 0x00007fddaf9da5f8 in pool_data_stack_realloc (pool=<optimized out>, mem=0x7fdd99f59038, old_size=268435449, new_size=536870912) at mempool-datastack.c:126 #9 0x00007fddaf9bcc42 in p_realloc (new_size=<optimized out>, old_size=<optimized out>, mem=<optimized out>, pool=<optimized out>) at mempool.h:88 #10 buffer_alloc (buf=buf@entry=0xf849a8, size=536870912) at buffer.c:36 #11 0x00007fddaf9bcfb4 in buffer_check_limits (data_size=32, pos=268435424, buf=0xf849a8) at buffer.c:75 #12 buffer_write (_buf=0xf849a8, pos=268435424, data=0xfa0420, data_size=32) at buffer.c:187 #13 0x000000000040519b in array_append_i (count=1, data=0xfa0420, array=<synthetic pointer>) at ../../../src/lib/array.h:168 #14 replicator_queue_handle_sync_lookups (user=0xfa3fc0, queue=0xf92260) at replicator-queue.c:278 ---Type <return> to continue, or q <return> to quit--- #15 replicator_queue_push (queue=0xf92260, user=0xfa3fc0) at replicator-queue.c:296 #16 0x00000000004049c2 in dsync_callback (reply=DSYNC_REPLY_OK, state=0xf84590 "AQAAAHX+sC3O3gNSjAoAAOEwx0RQoclMAwAAAAQ", 'A' <repeats 20 times>, "DAAAAEu2cNfSIZk0oMgAAO8QcX0yhyUwDAAAAlg", 'A' <repeats 20 times>, "IAAADFjqMEUPIEU+IlAACdtazLUaHJTAcAAAAI", 'A' <repeats 20 times>, "BwAAAEfYPTqXct9VYRMAAJ21"..., context=0xfa1560) at replicator-brain.c:121 #17 0x00000000004040a8 in dsync_callback (client=0xfa14a0, state=<optimized out>, reply=DSYNC_REPLY_OK) at dsync-client.c:65 #18 0x0000000000404275 in dsync_input_line (line=0xf84988 "+", client=0xfa14a0) at dsync-client.c:132 #19 dsync_input (client=0xfa14a0) at dsync-client.c:153 #20 0x00007fddaf9d47d2 in io_loop_call_io (io=0xfa15a0) at ioloop.c:599 #21 0x00007fddaf9d5d17 in io_loop_handler_run_internal (ioloop=ioloop@entry=0xf8c720) at ioloop-epoll.c:223 #22 0x00007fddaf9d486c in io_loop_handler_run (ioloop=ioloop@entry=0xf8c720) at ioloop.c:648 #23 0x00007fddaf9d4a28 in io_loop_run (ioloop=0xf8c720) at ioloop.c:623 #24 0x00007fddaf961fc3 in master_service_run (service=0xf8c5c0, callback=callback@entry=0x404720 <client_connected>) at master-service.c:641 #25 0x000000000040342a in main (argc=1, argv=0xf8c390) at replicator.c:112 Daniel On 3/22/2017 9:11 AM, Daniel Miller wrote: > Where would I find the core file? I'm not finding anything obvious. > > The replicator path is /usr/local/libexec/dovecot/replicator > > Daniel > > On 3/22/2017 12:52 AM, Aki Tuomi wrote: >> Can you provide us gdb bt full dump? >> >> gdb /usr/libexec/dovecot/replicator /path/to/core >> >> on some systems, it's /usr/lib/dovecot/replicator >> >> Aki >> >> On 21.03.2017 23:48, Daniel Miller wrote: >>> I have the following in my log: >>> >>> Mar 21 14:46:59 bubba dovecot: replicator: Panic: data stack: Out of >>> memory when allocating 1073741864 bytes >>> Mar 21 14:46:59 bubba dovecot: replicator: Error: Raw backtrace: >>> /usr/local/lib/dovecot/libdovecot.so.0(+0x97c90) [0x7f4638a7cc90] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(+0x97d6e) [0x7f4638a7cd6e] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f4638a14322] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(+0x95e3f) [0x7f4638a7ae3f] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(+0x9608b) [0x7f4638a7b08b] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(+0xb15f8) [0x7f4638a965f8] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(+0x93c42) [0x7f4638a78c42] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(buffer_write+0x74) >>> [0x7f4638a78fb4] -> dovecot/replicator(replicator_queue_push+0x13b) >>> [0x40519b] -> dovecot/replicator() [0x4049c2] -> dovecot/replicator() >>> [0x4040a8] -> dovecot/replicator() [0x404275] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x52) >>> [0x7f4638a907d2] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xe7) >>> >>> [0x7f4638a91d17] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x3c) >>> [0x7f4638a9086c] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) >>> [0x7f4638a90a28] -> >>> /usr/local/lib/dovecot/libdovecot.so.0(master_service_run+0x13) >>> [0x7f4638a1dfc3] -> dovecot/replicator(main+0x17a) [0x40342a] -> >>> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5) >>> [0x7f4638640ec5] -> dovecot/replicator() [0x4034c5] >>> Mar 21 14:47:00 bubba dovecot: replicator: Fatal: master: >>> service(replicator): child 15650 killed with signal 6 (core dumped) >>>

1 0

Permission denied when logrotating dovecot.log
by Michael Heuberger 22 Mar '17

22 Mar '17

Hello guys Having headaches here how to make logrotation for dovecot log files work. Having permission issues: michael.heuberger@xxx /e/l/daily ❯❯❯ sudo logrotate -fv dovecot.daily ⏎ reading config file dovecot.daily Handling 1 logs rotating pattern: /var/log/dovecot*.log forced from command line (10 rotations) empty log files are rotated, old logs are removed considering log /var/log/dovecot.log error: skipping "/var/log/dovecot.log" because parent directory has insecure permissions (It's world writable or writable by group which is not "root") Set "su" directive in config file to tell logrotate which user/group should be used for rotation. This is my current logrotation conf for dovecot: /var/log/dovecot*.log { rotate 10 missingok sharedscripts postrotate doveadm log reopen endscript } And the /var/log folder has these permissions: drwxrwxr-x 12 root syslog 4.0K Mar 19 12:43 log Any clues what's wrong? Thanks Michael -- Binary Kitchen Michael Heuberger 1/33 Parrish Road Sandringham Auckland 1025 (New Zealand) Mobile (text only) ... +64 21 261 89 81 Email ................ michael(a)binarykitchen.com Website .............. http://www.binarykitchen.com

5 9

SIS and mailbox restore
by Jean-Luc Oms 22 Mar '17

22 Mar '17

Still on the problem with dovecot 2.2.27 .... I use the single instance storage, and mdbox format. I use 2 zfs file systems, one for mailboxes, the other for attachements. I use znapzend to generate many zfs snapshots for backup purpose (inode numbers are preserved but it is unusefull). When I try to restore a deleted/purged mailbox with doveadm import I get the error of the first attachement missing in the SIS and the process stops. Option 1: the python script is working but it's really too long. * I restore all the SIS missing files since the snapshot date, preserving hard link count; * I restore the mailbox * I purge all the mailbox to delete the large number of unnecessery files restored Option 2: looking in the list archive I see that doveadm dump can guive me the msg.ext-ref that was missing to my knowledge. I try this use of doveadm dump: doveadm dump /MySnapShot/vmail/user/mdbox/storage/m.* Is this correct to get all the information I need ? I have to write a script to get msg.ext-ref for a particular msf.guid, or a specific mailbox Is there a way with doveadm dump to extract this type of information for a particular mailbox ? Thanks for your support. -- __________________________________________ Jean-Luc Oms STI-RéseauX - LIRMM - CNRS/UM2 161 rue Ada - BAT 4 - CC 477 34095 Montpellier cedex 5 Tel +33 4 67 41 85 93 Urg +33 6 32 01 04 17 __________________________________________

1 0

[Sieve] Is the way to run external script to get attachment?
by Konstantin Shalygin 22 Mar '17

22 Mar '17

Hello. Read all about Extprograms, but have a question. Use case: Every day we have couple messages with attachment (from one sender, this is one-way communication). This attachment is uploads to ownCloud. By hand... need some automation. As I see, pipe cat execute scripts with text data USER/FROM/SUBJECT - and I think with variables it can be any text data, how about attachment? How I see this: script executes and as arg receives from sieve attachment file, or message file and we can parse it for attachment. When we have attachment - upload to ownCloud via RESTapi and purge message. Found some realization for encrypt messages https://github.com/EtiennePerot/gpgit/blob/master/encmaildir.sh but for me more easy just connect to IMAP and do what I want (but I love sieve). Thanks. <http://wiki.dovecot.org/Pigeonhole/Sieve/Plugins/Extprograms>

2 2

Problem with sieve_before
by Ger Hooton Scoil Chroí Íosa Blarney 22 Mar '17

22 Mar '17

Hi All, I cannot get the sieve_before to work. I have dovecot & sieve installed on Debian 7 as follows /etc/dovecot/conf.d/90-sieve.conf : plugin { # The path to the user's main active script. If ManageSieve is used, this the # location of the symbolic link controlled by ManageSieve. sieve = ~/.dovecot.sieve # The default Sieve script when the user has none. This is a path to a global # sieve script file, which gets executed ONLY if user's private Sieve script # doesn't exist. Be sure to pre-compile this script manually using the sievec # command line tool. # --> See sieve_before fore executing scripts before the user's personal # script. sieve_default = /var/lib/dovecot/sieve/default.sieve # Directory for :personal include scripts for the include extension. This # is also where the ManageSieve service stores the user's scripts. sieve_dir = ~/sieve/ # Directory for :global include scripts for the include extension. sieve_global_dir = /var/lib/dovecot/sieve/ # Path to a script file or a directory containing script files that need to be # executed before the user's script. If the path points to a directory, all # the Sieve scripts contained therein (with the proper .sieve extension) are # executed. The order of execution within a directory is determined by the # file names, using a normal 8bit per-character comparison. Multiple script # file or directory paths can be specified by appending an increasing number. sieve_before = /var/lib/dovecot/sieve/before #####sieve_before2 = /var/lib/dovecot/sieve/before/default2.sieve #sieve_before3 = (etc...) # Identical to sieve_before, only the specified scripts are executed after the # user's script (only when keep is still in effect!). Multiple script file or # directory paths can be specified by appending an increasing number. #sieve_after = #sieve_after2 = #sieve_after2 = (etc...) # Which Sieve language extensions are available to users. By default, all # supported extensions are available, except for deprecated extensions or # those that are still under development. Some system administrators may want # to disable certain Sieve extensions or enable those that are not available # by default. This setting can use '+' and '-' to specify differences relative # to the default. For example `sieve_extensions = +imapflags' will enable the # deprecated imapflags extension in addition to all extensions were already # enabled by default. #sieve_extensions = +notify +imapflags ................................. In /var/lib/dovecot/sieve/before I have : drwxrwxrwx 3 mail mail 4096 Mar 20 23:47 .. -rw-rw-rw- 1 root root 195 Mar 21 09:57 default2.svbin -rwxrwxrwx 1 mail mail 157 Mar 21 11:12 default2.sieve default2.sieve is as follows: require ["fileinto"]; if allof (header :matches "subject" "*JUNK*") { fileinto "INBOX.Junk"; } The users personal filters work. Thanks for your help. __________________________________________________ Please consider the environment before printing this email. Ger

3 13

getmail with dovecot delivering problems
by Samuel Reina Calvo 22 Mar '17

22 Mar '17

Hi there, I put together a mail server with postfix+dovecot+mysql with virtual users and it works just fine as internal mail server, but when i put ir under a multidrop email server it sends ok but so far coulnd make getmail to deliver mails correctly. the use of getmail + dovecot downloads email via pop3 but then put all the emails in the same inbox. my maildir is /var/vmail/[domain] getmalirc conf is [retriever]type = MultidropPOP3Retriver server username password envelope_recipient = delivered-to:1 [destination] type = MDA_external path = /usr/local/libexec/dovecot/deliverthen when i run sudo -H -u vmail bash -c 'getmail -g /etc/.getmail -r /etc/.getmail/getmailrc' i get all the time all the messages delivered into /var/vmail/vmail (being vmail the linux user who handles my virtual users) __________ Información de ESET NOD32 Antivirus, versión de la base de firmas de virus 14929 (20170213) __________ ESET NOD32 Antivirus ha comprobado este mensaje. http://www.eset.com

2 1

last_login LDAP - killed with signal 11 (core dumped)
by Leon Kyneur 22 Mar '17

22 Mar '17

Hi I am trying to configure the last_login plugin with LDAP dictionary which is causing dict service to crash. Not sure if this is a bug or some configuration parameter I'm getting wrong? Running latest dovecot but was having the same problem in earlier version 2.2.25 # dovecot --version 2.2.28 (bed8434) I have configured dovecot like so: dovecot.conf (before conf.d/*.conf: dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext lastlogin = ldap:/etc/dovecot/dovecot-ldap-dict.conf.ext } conf.d/10-master.conf service dict { # If dict proxy is used, mail processes should have access to its socket. # For example: mode=0660, group=vmail and global mail_access_groups=vmail unix_listener dict { mode = 0660 user = vmail group = vmail } } conf.d/20-imap.conf: protocol imap { # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins last_login # Maximum number of IMAP connections allowed for a user from each IP address. # NOTE: The username is compared case-sensitively. #mail_max_userip_connections = 10 } 90-plugins.conf plugin { #setting_name = value #last_login_dict = proxy::lastlogin last_login_dict = proxy:dict:lastlogin zlib_save = gz zlib_save_level = 6 } dovecot-ldap-dict.conf.ext: uri = ldap://ldap.internal bind_dn = cn=Manager,dc=mail,dc=com password = XXXX tls = no debug = 1 map { pattern = last-login/$user filter = (&(mail=%{user})(objectClass=mailUser)) # the () is required base_dn = o=domains,dc=mail,dc=com username_attribute = mail value_attribute = lastLoginTime fields { mail=$user } } I don't see dovecot ever making a connection to the LDAP server I've configured in the dovecot-ldap-dict.conf.ext file. Log shows ==> /var/log/dovecot.log <== Mar 22 07:49:30 imap-login: Info: Login: user=<leon(a)mail.com>, method=PLAIN, rip=X.X.X.X, lip=X.X.X.X, mpid=36105, secured, session=<o0Lu/0xL4N3LhgGR> Mar 22 07:49:30 dict: Fatal: master: service(dict): child 36107 killed with signal 11 (core dumped) Mar 22 07:49:30 imap(leon(a)mail.com): Error: dict-client: Commit may have failed: Connection closed (reply took 0.015 secs) Mar 22 07:49:30 imap(leon(a)mail.com): Error: last_login_dict: Write was unconfirmed (timeout or disconnect) for user leon(a)mail.com Backtrace: # gdb /var/core/36107 GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... [New LWP 36107] Reading symbols from /usr/libexec/dovecot/dict...Reading symbols from /usr/lib/debug/usr/libexec/dovecot/dict.debug...done. done. Missing separate debuginfo for Try: yum --enablerepo='*debug*' install /usr/lib/debug/.build-id/b0/07fede01895dec1aca9d8b8993fe27d70a3a20 [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Core was generated by `dovecot/dict'. Program terminated with signal 11, Segmentation fault. #0 0x0000000000000000 in ?? () (gdb) bt full #0 0x0000000000000000 in ?? () No symbol table info available. #1 0x00007fbcf11bd04f in cmd_begin (cmd=0x7fbcf2c02910, line=<optimized out>) at dict-commands.c:365 trans = 0x7fbcf2c029a0 id = 1 #2 0x00007fbcf11bdef8 in dict_command_input (conn=conn@entry=0x7fbcf2bf24d0, line=line@entry=0x7fbcf2bf48cb "B1") at dict-commands.c:625 cmd_func = 0x7fbcf13c85c0 <cmds+32> cmd = 0x7fbcf2c02910 ret = <optimized out> #3 0x00007fbcf11bc6ee in dict_connection_input_more (conn=0x7fbcf2bf24d0) at dict-connection.c:117 _data_stack_cur_id = 3 line = 0x7fbcf2bf48cb "B1" ret = <optimized out> #4 0x00007fbcf11bc7d2 in dict_connection_input (conn=0x7fbcf2bf24d0) at dict-connection.c:167 line = <optimized out> conn = 0x7fbcf2bf24d0 #5 0x00007fbcf0d1b2d2 in io_loop_call_io (io=0x7fbcf2bf2890) at ioloop.c:599 ioloop = 0x7fbcf2be0740 t_id = 2 __FUNCTION__ = "io_loop_call_io" #6 0x00007fbcf0d1c95f in io_loop_handler_run_internal (ioloop=ioloop@entry=0x7fbcf2be0740) at ioloop-epoll.c:223 ctx = 0x7fbcf2beded0 events = <optimized out> list = 0x7fbcf2bf28f0 io = <optimized out> tv = {tv_sec = 2147483, tv_usec = 0} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #7 0x00007fbcf0d1b36c in io_loop_handler_run (ioloop=ioloop@entry=0x7fbcf2be0740) at ioloop.c:648 No locals. #8 0x00007fbcf0d1b528 in io_loop_run (ioloop=0x7fbcf2be0740) at ioloop.c:623 __FUNCTION__ = "io_loop_run" #9 0x00007fbcf0ca4603 in master_service_run (service=0x7fbcf2be05e0, callback=callback@entry=0x7fbcf11be150 <client_connected>) at master-service.c:641 No locals. #10 0x00007fbcf11bbff9 in main (argc=1, argv=0x7fbcf2be0390) at main.c:161 set_roots = {0x7fbcf13c88a0 <dict_setting_parser_info>, 0x0} error = 0x0

2 3

Help
by Bhushan Bhosale 22 Mar '17

22 Mar '17

Hello, I'm getting below error in /var/log/dovecot-proxy.log. Please help. Thanks in advance. Mar 21 14:40:36 tejas3 dovecot: director: Error: Director 192.168.1.11/in disconnected: Connection closed: Illegal seek (connected 0 secs, in=0 out=43, handshake ME not received Regards, Bhushan

2 1

dovecot POP3 log shows too many identical RETR entries
by Bappasaheb Nirmal 22 Mar '17

22 Mar '17

Hello, Dovecot log is showing too many POP3 RETR entries which are identical lines. I also suspect that it is causing high pop traffic eating most of the network bandwidth. Here are some of the lines out of 11009 in a day. Such pattern is observed only for few users. dovecot version is 2.1.17. ============== Mar 20 00:00:07 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:07 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=26645, secured, session=<5CGrmRlLyAAr861h> Mar 20 00:00:10 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:11 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=29932, secured, session=<k6/gmRlL3gAr861h> Mar 20 00:00:12 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:13 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=26819, secured, session=<3DX6mRlLUQAr861h> Mar 20 00:00:14 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:15 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=9636, secured, session=<x5ghmhlLjwAr861h> Mar 20 00:00:16 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:17 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=4585, secured, session=<8Yw+mhlL0AAr861h> Mar 20 00:00:18 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:18 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=30049, secured, session=<UsJOmhlLmAAr861h> Mar 20 00:00:19 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:20 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=9636, secured, session=<B6VimhlLNgAr861h> Mar 20 00:00:20 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:20 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=4584, secured, session=<pVpxmhlLPwAr861h> Mar 20 00:00:21 pi3 dovecot: pop3(user(a)example.com): Disconnected: Logged out top=0/0, retr=1/64014, del=0/1429, size=478762716 Mar 20 00:00:23 pi3 dovecot: pop3-login: Login: user=<user(a)example.com>, method=PLAIN, rip=43.243.173.97, lip=192.168.1.18, mpid=4585, secured, session=<MlGam ============== What could be the possible reason? Thanks, Bappasaheb

2 2

Crash on doveadm index
by Larry Rosenman 22 Mar '17

22 Mar '17

http://www.lerctr.org/~ler/dovecot/doveadm-2017-03-20.txt doveconf –n attached and at: http://www.lerctr.org/~ler/dovecot/doveconf.n.txt -- Larry Rosenman http://www.lerctr.org/~ler Phone: +1 214-642-9640 E-Mail: larryrtx(a)gmail.com US Mail: 17716 Limpia Crk, Round Rock, TX 78664-7281

2 4

Is it possible to use sieve when delivering via pipe to the dovecot deliver command ?
by Thomas Carrié 21 Mar '17

21 Mar '17

Hello, I am using Exim with this delivery configuration: virtual_delivery: driver = pipe command = /usr/lib/dovecot/deliver -d $local_part@$domain -f ... I have enabled manage-sieve and uploaded a simple sieve script that I can see on the server. man page of /usr/lib/dovecot/deliver says it supports sieve. Mail debug is enabled: $ dovecot -n | grep debug mail_debug = yes Delivering a mail shows only this line in dovecot log: Jan 21 17:38:51 myserver dovecot: lda(joe(a)something.com): msgid=<20170121183537.7313f219@homenetwork>: saved mail to INBOX According to page http://wiki2.dovecot.org/Pigeonhole/Sieve/Troubleshooting#Sieve_Scripts_are… I should have a log saying that the sieve plugin is loaded Here is the sieve relevant parts of dovecot -n: # 2.2.13: /etc/dovecot/dovecot.conf ... plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } ... protocols = " imap sieve pop3 sieve" ... protocol lda { mail_plugins = " sieve" } Is there a requirement to use delivery via service (unix socket) so that sieve is enabled? Or is there a configuration thing I forgot ? Thank you for your help Thomas

2 2

Re: Corruption & migration
by Daniel Miller 21 Mar '17

21 Mar '17

Now I'm seeing a bunch of these: 02:28 bubba dovecot: dsync-local(user(a)mydomain.com): Error: bzlib.read(/var/mail/mydomain.com/user/mdbox/storage/m.20): corrupted data at 24123649 Mar 21 11:02:28 bubba dovecot: dsync-local(user(a)mydomain.com): Error: dsync(oldserver.host): read(zlib(/var/mail/mydomain.com/user/mdbox/storage/m.20)) failed: read(/var/mail/mydomain.com/user/mdbox/storage/m.20) failed: bzlib.read(/var/mail/mydomain.com/user/mdbox/storage/m.20): corrupted data at 24123649 (last sent=mail, last recv=mail_request (EOL)) Mar 21 11:02:28 bubba dovecot: doveadm: Error: dsync-remote(user(a)mydomain.com): Error: dsync(localhost): read() failed: read((fd)) failed: dot-input stream ends without '.' line (last sent=mail_request (EOL), last recv=mail) Daniel On 3/20/2017 11:30 PM, Daniel Miller wrote: > I'm getting close - I believe I have one-way replication processing > now. It's amazing watching the mails magically appear in the new > server! I'll tender some updates to the wiki in the hopes it will > help others. > > At this time, I have two errors I haven't been able to eliminate with > config changes: > > dovecot: doveadm: Error: dsync-remote(user(a)mydomain.com): Warning: > Transaction log file > /var/mail/mydomain.com/user/sdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.log > was locked for 109 seconds (rotating while syncing) > Mar 20 23:22:04 bubba dovecot: dsync-local(user(a)mydomain.com): Error: > Remote command returned error 75: ssh -lvmail 192.168.0.4 doveadm > dsync-server -uuser(a)mydomain.com > > I don't know if the transaction lock issue will fix itself via > repeated replication runs. But I have no idea what the "error 75" is. > > Daniel > > > On 3/20/2017 10:05 PM, Daniel Miller wrote: >> I have an existing server using mdbox & sis. There is a quantity of >> corruption - I have no idea where it came in. I'd had a previous >> rebuild some years ago and I thought I had a clean datastore. By >> "corruption" I mean missing attachments and either missing or >> mixed-up emails. >> >> I've setup a new server on a virtual machine. Instead of copying the >> old configs I hand-adjusted individual settings using the current >> distribution example. The new server is running...but empty. >> >> So now my intent is to migrate the mail to the new machine. A few >> items to note: >> 1. The existing mail server is the virtual host. The mails are >> stored locally, in mdbox format, with sis enabled. And possibly zlib. >> 2. The new server, via VirtualBox, is presently configured for >> Maildir. I may change to sdbox - I'm now a little reserved about mdbox. >> 3. Instead of storing the mails within the virtual machine, I'm >> using the host's drive. This is via an exported NFS4 folder from the >> host, mounted on the guest, using the options: >> "auto,noatime,hard,intr,async,nordirplus". >> 4. My intent is to have the new virtual server become the primary >> mail server. The mail store will continue to be accessed by NFS4. No >> other servers or processes (besides backup) should access the mail >> store. >> >> So...my question is what is the best method for the migration? >> >> Reading the docs on Dovecot replication I'm still very unsure of how >> to implement it - particularly the "master-master" or "master-client" >> relationships. The docs are not 100% clear on which server gets >> which options. I can guess...which I'd really rather not do. But it >> seems to me getting one-way replication working would be the most >> "elegant" solution here. >> >> Manual dsync is also an option - but again I'm not on which machine I >> should execute which options. >> >> Imapsync is a possibility and the syntax is clear - but very slow in >> execution for 100k mails. >> >> Any suggestions or pointers would be welcome. >>

1 0

New Member
by Ger Hooton Scoil Chroí Íosa Blarney 21 Mar '17

21 Mar '17

Hi All, Before I start posting where /how can I check to see if the question I wish to ask about has already been covered? __________________________________________________ Please consider the environment before printing this email. Ger

3 2

Re: Dovecot can't connect to openldap over starttls [REQUEST OF OPENLDAP]
by info＠gwarband.de 21 Mar '17

21 Mar '17

Can sombody say something about this request? This is an email from the openldap-technical mailinglist from openldap. Systemdetails are mention in the other email. -------- Originalnachricht -------- Betreff: Re: Dovecot can't connect to openldap over starttls Datum: 2017-03-20 16:18 Absender: Dan White <dwhite(a)cafedemocracy.org> Empfänger: info(a)gwarband.de Kopie: openldap-technical(a)openldap.org On 03/20/17 16:06 +0100, info(a)gwarband.de wrote: >> Debug Dovecot's implementation of ldap_start_tls_s(). > I don't have any idea how to set a higher debug level to dovecot. In > my opinion I have the highest. So I can't deliver a greater log. I recommend consulting Dovecot's advice on how to run a debugger, or dig into the code which calls libldap.

2 8

doveadm-sync stateful
by Cédric ML 21 Mar '17

21 Mar '17

Hello, I'm trying to migrate mail accounts from an old server to a new one. As I need to migrate dozens of accounts which take about 1G each, I need to do stateful sync to make my migration in two times : 1 - I run a : doveadm -D -o mail_fsync=never -o imapc_user=user1(a)olddomain.fr sync -s "" -R -1 -u user1(a)newdomain.fr imapc: > /tmp/firstsync.log 2>&1 my accounts are synced, and I get a "state" string (AQAAAHm4+Jk=) as the output of doveadm sync command. 2 - Changes are made on the old server, and I expect next dsync will sync only the changes / new mails. So I run a : doveadm -D -o mail_fsync=never -o imapc_user=user1(a)olddomain.fr sync -s "AQAAAHm4+Jk=" -R -1 -u user1(a)newdomain.fr imapc: > /tmp/secondsync.log 2>&1 My problem is that state of messages are not synchronized (mails marked as read on old server are still unread on new server, mails moved on a folder on the old server are still in the INBOX of new server). The full debug of ran commands is available here : http://fpaste.scsys.co.uk/557551 The result of "doveconf -n" is available here : http://fpaste.scsys.co.uk/557552 I'm using version 2.2.27 Can anyone tell me if I'm doing something wrong ? How can I debug more ? Regards, Cédric

2 2

Re: Corruption & migration
by Daniel Miller 21 Mar '17

21 Mar '17

I'm getting close - I believe I have one-way replication processing now. It's amazing watching the mails magically appear in the new server! I'll tender some updates to the wiki in the hopes it will help others. At this time, I have two errors I haven't been able to eliminate with config changes: dovecot: doveadm: Error: dsync-remote(user(a)mydomain.com): Warning: Transaction log file /var/mail/mydomain.com/user/sdbox/mailboxes/INBOX/dbox-Mails/dovecot.index.log was locked for 109 seconds (rotating while syncing) Mar 20 23:22:04 bubba dovecot: dsync-local(user(a)mydomain.com): Error: Remote command returned error 75: ssh -lvmail 192.168.0.4 doveadm dsync-server -uuser(a)mydomain.com I don't know if the transaction lock issue will fix itself via repeated replication runs. But I have no idea what the "error 75" is. Daniel On 3/20/2017 10:05 PM, Daniel Miller wrote: > I have an existing server using mdbox & sis. There is a quantity of > corruption - I have no idea where it came in. I'd had a previous > rebuild some years ago and I thought I had a clean datastore. By > "corruption" I mean missing attachments and either missing or mixed-up > emails. > > I've setup a new server on a virtual machine. Instead of copying the > old configs I hand-adjusted individual settings using the current > distribution example. The new server is running...but empty. > > So now my intent is to migrate the mail to the new machine. A few > items to note: > 1. The existing mail server is the virtual host. The mails are > stored locally, in mdbox format, with sis enabled. And possibly zlib. > 2. The new server, via VirtualBox, is presently configured for > Maildir. I may change to sdbox - I'm now a little reserved about mdbox. > 3. Instead of storing the mails within the virtual machine, I'm using > the host's drive. This is via an exported NFS4 folder from the host, > mounted on the guest, using the options: > "auto,noatime,hard,intr,async,nordirplus". > 4. My intent is to have the new virtual server become the primary > mail server. The mail store will continue to be accessed by NFS4. No > other servers or processes (besides backup) should access the mail store. > > So...my question is what is the best method for the migration? > > Reading the docs on Dovecot replication I'm still very unsure of how > to implement it - particularly the "master-master" or "master-client" > relationships. The docs are not 100% clear on which server gets which > options. I can guess...which I'd really rather not do. But it seems > to me getting one-way replication working would be the most "elegant" > solution here. > > Manual dsync is also an option - but again I'm not on which machine I > should execute which options. > > Imapsync is a possibility and the syntax is clear - but very slow in > execution for 100k mails. > > Any suggestions or pointers would be welcome. >

1 0

Corruption & migration
by Daniel Miller 21 Mar '17

21 Mar '17

I have an existing server using mdbox & sis. There is a quantity of corruption - I have no idea where it came in. I'd had a previous rebuild some years ago and I thought I had a clean datastore. By "corruption" I mean missing attachments and either missing or mixed-up emails. I've setup a new server on a virtual machine. Instead of copying the old configs I hand-adjusted individual settings using the current distribution example. The new server is running...but empty. So now my intent is to migrate the mail to the new machine. A few items to note: 1. The existing mail server is the virtual host. The mails are stored locally, in mdbox format, with sis enabled. And possibly zlib. 2. The new server, via VirtualBox, is presently configured for Maildir. I may change to sdbox - I'm now a little reserved about mdbox. 3. Instead of storing the mails within the virtual machine, I'm using the host's drive. This is via an exported NFS4 folder from the host, mounted on the guest, using the options: "auto,noatime,hard,intr,async,nordirplus". 4. My intent is to have the new virtual server become the primary mail server. The mail store will continue to be accessed by NFS4. No other servers or processes (besides backup) should access the mail store. So...my question is what is the best method for the migration? Reading the docs on Dovecot replication I'm still very unsure of how to implement it - particularly the "master-master" or "master-client" relationships. The docs are not 100% clear on which server gets which options. I can guess...which I'd really rather not do. But it seems to me getting one-way replication working would be the most "elegant" solution here. Manual dsync is also an option - but again I'm not on which machine I should execute which options. Imapsync is a possibility and the syntax is clear - but very slow in execution for 100k mails. Any suggestions or pointers would be welcome. -- Daniel

1 0

Re: Dovecot 2.2.27 proxy - enforcing per client IP connection limits
by Joseph Tam 21 Mar '17

21 Mar '17

Sami Ketola writes: >> Can anyone with Solr installed confirm/refute this: does installing >> Solr keep iOS clients from roofing the connection count? > > I doubt it, but since IMAP SEARCH goes all the way down to the backends > mail_max_userip_connections can be used to limit the number of > connections. Understood -- that's the current situation I'm in now. Our iOS users would launch a search resulting in a connection burst, hit the connection cap, log out all IMAP sessions out, then start the cycle again. This sometimes lasts for 10's of minutes. I'm not sure what the users sees. Sample logs entries: Mar 19 01:21:30 server dovecot: imap-login: Login: user=<user> ... [... 14 similar logins removed ...] Mar 19 01:21:41 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:42 server dovecot: imap-login: Maximum number of connections from user+IP exceeded (mail_max_userip_connections=16) : user=<user> ... Mar 19 01:21:42 server dovecot: imap(user): Logged out in=425 out=1107 [... 14 similar logouts removed ...] Mar 19 01:21:42 server dovecot: imap(user): Logged out in=382 out=1107 Mar 19 01:21:42 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:42 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:43 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:44 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:44 server dovecot: imap(user): Logged out in=442 out=1173 Mar 19 01:21:44 server dovecot: imap(user): Logged out in=442 out=1155 Mar 19 01:21:44 server dovecot: imap(user): Logged out in=442 out=1166 Mar 19 01:21:44 server dovecot: imap(user): Logged out in=442 out=1174 Mar 19 01:21:44 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:47 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:47 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:48 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:48 server dovecot: imap-login: Login: user=<user> ... Mar 19 01:21:49 server dovecot: imap-login: Login: user=<user> ... { ... and on and on for the next 10 minutes ... } However, there is a pause between each login that might be long enough to squeeze the search results in if given quickly enough. From the I/O stats, most of these searches have empty results. It probably won't prevent the connection cap problem, but it might minimize the length and severity of these connection storms. Of course, the real fix is for iOS mail-app developers to stop assuming the IMAP server is owned exclusively by the user by configuring some reasonable connection throttles. Joseph Tam <jtam.home(a)gmail.com>

2 1

Dovecot can't connect to openldap over starttls
by info＠gwarband.de 20 Mar '17

20 Mar '17

Hello guys, actually I'm trying to configure dovecot to access openldap for passwordcheck. My openldap is only allow access over "secure ldap". The dovecot can communicate with the openldap server but there is maybe a failure in the sslhandshake. Additional information you can find in the logs or in the dump below. Also I have my ldap config from dovecot in the links below. I have already created an bug reporting in the system of openldap but the answer was to get support from her. All datalinks: https://gwarband.de/openldap/dovecot.log https://gwarband.de/openldap/dovecot-ldap.conf https://gwarband.de/openldap/openldap.log https://gwarband.de/openldap/trace.dump The bugreportinglink from openldap: http://www.openldap.org/its/index.cgi/Incoming?id=8615 I hope you can help me. Regards. Tobias Warband

2 10

Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings)
by Ralf Hildebrandt 20 Mar '17

20 Mar '17

Hi! I upgraded the 2.2 packages today (from 2:2.2.28-1~auto+5 to 2:2.2.28-1~auto+8) I now I'm getting an error: Mar 20 13:25:58 mproxy dovecot: auth: Error: imapc(email.charite.de:993): Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) I checked, and alas, I had ssl_client_ca_dir = ssl_client_ca_file = So I set: ssl_client_ca_file = </etc/ssl/certs/ca-certificates.crt But I'm still getting the error above. I addition, dovecot is crashing with SIGSEGV: Mar 20 13:28:23 mproxy dovecot: auth: Error: imapc(email.charite.de:993): Couldn't initialize SSL context: Can't verify remote server certs without trusted CAs (ssl_client_ca_* settings) Mar 20 13:28:23 mproxy dovecot: auth: Error: imapc(email.charite.de:993): No SSL context Mar 20 13:28:23 mproxy dovecot: auth: Error: imap(la***sch,87.77.180.61): Disconnected from server Mar 20 13:28:23 mproxy postfix/submission/smtpd[32682]: warning: zb43d.pia.fu-berlin.de[87.77.180.61]: SASL PLAIN authentication failed: Connection lost to authentication server Mar 20 13:28:23 mproxy dovecot: auth: Fatal: master: service(auth): child 32685 killed with signal 11 (core dumped) -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

2 5

doveadm proxy password
by Angel L. Mateo 20 Mar '17

20 Mar '17

Hi, I'm configuring a proxy host to connect to backend servers. As proxy is done based on an LDAP attribute of the user, I'm not using director. In the proxy server I have configured: doveadm_port = 24245 doveadm_password = secret And in the backend: service doveadm { inet_listener { port = 24245 } } local <mynetwork> { doveadm_password = secret } But when I run a doveadm command in the proxy I get: amateo_adm@musio10:/etc/dovecot/conf.d$ sudo doveadm quota get -u amateo(a)um.es doveadm(amateo(a)um.es): Error: doveadm authentication failed () doveadm(amateo(a)um.es): Error: myotis50.um.es:24245: Command quota get failed for amateo(a)um.es: EOF Quota name Type Value Limit % And in the backed I get: Mar 20 15:52:01 myotis50 dovecot: doveadm: Error: doveadm client authenticated with wrong password I have checked with tcpdump and in the command is sending the base64 encoding of "doveadmsecret" Any help? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

1 0

Re: Dovecot 2.2.27 proxy - enforcing per client IP connection limits
by Joseph Tam 20 Mar '17

20 Mar '17

Adi Pircalabu writes: > For us it is, we're periodically getting hammered by iOS devices that > try to open 300+ simultaneous IMAP connections for a single user from > the same IP, while the average hovers usually below 50 for the busier > mailboxes with many folders. Oh yeah, I've seen this. I think this happens when someone does a global pattern search, which causes the client to launch IMAP SEARCH commands on each and every mailbox. I've wondered whether installing Solr would alleviate this: it wouldn't directly address the connection limit problem, but perhaps it can return results fast enough to keep the concurrent connections count down. Can anyone with Solr installed confirm/refute this: does installing Solr keep iOS clients from roofing the connection count? Joseph Tam <jtam.home(a)gmail.com>

2 1

Mail restore and single storage attachement
by Jean-Luc Oms 20 Mar '17

20 Mar '17

Bonjour, I'm finishing the upgrade of an old installation of Dovecot/postfix mail system for my lab. In the configuration i plan ( dovecot 2.2.27 ), i choose to use: - mdbox format - single storage for attachements - 2 zfs file systems, one for mdboxes, the other for attachments The last tests before production concern my hability to restore a lost mail (or mailbox) ... (lot of changes when you are used to mbox format). 1) I uses doveadm import to restore part of mail from one of the zfs snapshot with a cde like: doveadm -Dv import -U bof2 -s -u bof2 mdbox:/mailpool/lirmm/.zfs/snapshot/zfs-auto-snap_frequent-2017-03-15-1645/vmail/bof2/mdbox Recup-AAAA mailbox AAAA I get this error: doveadm(bof2): Error: open() failed with file /mailpool/lirmm/.zfs/snapshot/zfs-auto-snap_frequent-2017-03-15-1645/vmail/bof2/mdbox/mailboxes/AAAA/dbox-Mails/dovecot.index.log: Read-only file system Thats right, my snapshot is ro, but why the import has to write to the source ? I'm missing something ? 2) I don't find any way to specify a source for attachements with the import command, then I first restore all the atachements from one snapshot, then make import, then purge. Is there a way to use a source for attachement file tree, or a command to find the mssing files for the import command ? Thanks -- __________________________________________ Jean-Luc Oms STI-RéseauX - LIRMM - CNRS/UM2 161 rue Ada - BAT 4 - CC 477 34095 Montpellier cedex 5 Tel +33 4 67 41 85 93 Urg +33 6 32 01 04 17 __________________________________________

1 1

Deploying Diffie-Hellman for TLS
by Jerry 20 Mar '17

20 Mar '17

I have been reading up on TLS and Dovecot and came across this URL: https://www.weakdh.org/sysadmin.html which recommended these settings for Dovecot. I would like to know if they are correct? Some much documentation on the web is pure garbage. Dovecot These changes should be made in /etc/dovecot.conf Cipher Suites ssl_cipher_list=ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_prefer_server_ciphers = yes (Dovecot 2.2.6 or greater) DH parameters #regenerates every week ssl_dh_parameters_length = 2048 Contrary to what the site recommends, I would have thought that changes should be made in the "10-ssl.conf" file. I am running "Dovecot 2.2.28" on a FreeBSD-11 machine with OpenSSL 1.0.2k, if that makes any difference. Thanks -- Jerry

2 1