- dovecot - dovecot.org

Re: Dovecot password policy
by Joseph Tam 05 Aug '16

05 Aug '16

Robert Blayzor <rblayzor.bulk(a)inoc.net> writes: > Is there a way to configure Dovecot to perhaps filter/enforce which > passwords are accepted before authenticating? Ie: Reject immediately > (without a database lookup) if password is not X characters in length? Yes, use the checkpassword hook. http://wiki.dovecot.org/AuthDatabase/CheckPassword I think there also some PAM module that you can stack into your system that will enforce password policies. Joseph Tam <jtam.home(a)gmail.com>

1 0

Dovecot and Solr 6
by KSB 05 Aug '16

05 Aug '16

Hi! Dovecot 2.2.24 Had set up solr and new schema collection. Copied dovecot provided schema. There was an error with booleans (while getting schema via http), which I "solved" by removing "add-unknown-fields-to-the-schema" from solrconfig.xml. It is correct way to solve this? Anyway, I run tcpdump to see network activity between dovecot and solr: #tcpdump -i lo port 8983 and see nothing while doing: #doveadm fts rescan -u username(a)domain.tld no output also from doveadm. Noticed that dovecot.index.log reapears in user mail root if deleted. plugin { fts = solr fts_solr = url=http://localhost:8983/solr/dovecot/ debug .. } -- KSB

3 4

Problem with sieve configuration on dovecot+debian_jessie+ISPC3
by Filip Loncar [WarpMax | FederationServers] 05 Aug '16

05 Aug '16

I'm new-ish to dovecot and sieve (haven't used it extensively till now) and I'm not sure that I configured everything propperly. The problem is that we're trying to get the following sieve code to run: require ["fileinto", "regex", "date", "relational", "vacation", "duplicate"]; require "duplicate"; if duplicate :header "message-id" { discard; } else { redirect "<somemail1>"; redirect "<somemail2>"; redirect "<somemail3>"; redirect "<somemail4>"; redirect "<somemail5>"; redirect "<somemail6>"; keep; } keep; But we're constantly getting the following error: sieve: info: started log at Aug 02 08:13:21. main script: line 5: error: require command: unknown Sieve capability `duplicate'. main script: line 6: error: unknown test 'duplicate' (only reported once at first occurence). main script: error: validation failed. Both me and my collegue can't find what's wrong with the system. I would appreciate any kind of help on this matter. Below's my configuration. # dovecot --version 2.2.13 # dovecot -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-45-pve x86_64 Debian 8.5 auth_mechanisms = plain login disable_plaintext_auth = no listen = *,[::] log_timestamp = "%Y-%m-%d %H:%M:%S " mail_privileged_group = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave vnd.dovecot.duplicate passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { quota = dict:user::file:/var/vmail/%d/%n/.quotausage sieve = /var/vmail/%d/%n/.sieve sieve_duplicate_default_period = 14d sieve_extensions = +vnd.dovecot.duplicate sieve_max_redirects = 6 sieve_plugins = sieve_extprograms } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service imap-login { client_limit = 1000 process_limit = 500 } ssl_cert = </etc/postfix/smtpd.cert ssl_key = </etc/postfix/smtpd.key ssl_protocols = !SSLv2 !SSLv3 userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { mail_plugins = quota imap_quota } protocol pop3 { mail_plugins = quota pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = sieve quota } # uname -a Linux fero 2.6.32-45-pve #1 SMP Wed Mar 30 12:22:08 CEST 2016 x86_64 GNU/Linux It's a Debain Jessie VM running ISPC3. -- Srdac(an pozdrav | Best regards Filip Lonc(ar ___________________________________________ WarpMax hosting *WarpMax hosting* *A* Tehnolos(ki park Varaz(din, Zagrebac(ka 89, Varaz(din, Croatia - Europe *T * +385 42 492 129, 490 090, +385 99 5896 123 ___________________________________ Ova elektronic(ka poruka, kao i svi eventualni privici, su povjerljivi i namijenjeni iskljuc(ivo naznac(enom primatelju(ima). Ukoliko niste naznac(eni primatelj(i) ove elektronic(ke poruke, molimo da odmah obavijestite pos(iljatelja, a sve kopije ove elektronic(ke poruke (ukljuc(ujuc'i i privitke) trajno obris(ete. Svaka neovlas(tena upotreba, distribucija, reprodukcija ili priopc'avanje ove poruke zabranjeno je. WarpMax hosting ne preuzima odgovornost za sadrz(aj ove poruke i eventualnu s(tetu nastalu primitkom ove poruke i priloga sadrz(anih u poruci. Ne jamc(imo da je ova elektronic(ka poruka slobodna od virusa. WarpMax hosting ne preuzima odgovornost za bilo kakav gubitak ili s(tetu koja nastane zbog prisutnosti virusa u elektronic(koj poruci. This e-mail, including all attached files, if any, is confidential and intended for the sole use by the person(s) mentioned as recipient(s). If you are not the named recipient(s) indicated in this message, please notify the sender immediately, and permanently delete all copies of this message (including any attachments). Any review, use, distribution, disclosure, printing or copying of this e-mail other than by the intended recipient(s) is prohibited. WarpMax hosting accepts no liability for content of this message and any potential damage caused by this message and files attached to it. No warranty is given that this email is free of viruses. WarpMax hosting accepts no liability for any loss or damage caused by presence of a virus.

4 3

New password hashing scheme as plugin
by Andreas Meyer 05 Aug '16

05 Aug '16

Hi, I want to add a new password hashing scheme as plugin and provide it for the dovecot project, so that it will be included as optional plugin in future releases. Yet the plugin compiles fine and the .so file gets created. My approach is to call the functions password_scheme_register() and password_scheme_unregister() (src/auth/password-scheme.c) inside the plugin's _init() and _deinit() functions. When a client tries to login via imap the log shows an error message: Error: Couldn't load required plugin /usr/local/lib/dovecot/lib20_newauth_plugin.so: dlopen() failed: /usr/local/lib/dovecot/lib20_newauth_plugin.so: undefined symbol: password_scheme_unregister That error obviously occurs, because the required lib is not linked into the plugin. Now my problem is to understand, whether this approach (via .so file) can be successful at all and if so, how? Do I need to link libs into it? Which would that be and how do I specify them in the Makefile.am? I assume, I don't need to link a lib, but need to use a hook to register the new hashing scheme, since the plugin is loaded into an already existing process, which needs to get extended. If this is true, which hook would that be and how do I register the new scheme? Or is there no way to accomplish this via a separated .so plugin? Should I extend the sources in /src/auth instead? (separat file for the hashing scheme with preprocessor instructions to include it only on demand) Thank you very much, Andreas

3 8

file/folder perms permissions
by Jim Pazarena 05 Aug '16

05 Aug '16

Forgive me if I am blind, but I cannot find default folder permissions. For the home directories, with the sub of mail: and deeper, I see some files with 660, some with 600, some folders with 770 some with 660 I am a bit confused. I manually messed with some files, and my MUA complained about permissions. So I got that mess fixed, and in doing so I noticed the seemingly contradictory permissions. Thanks!

3 2

SSL connection reset by peer
by Vince42 04 Aug '16

04 Aug '16

Hi, I am running a dovecot server and have set up an external monitoring, where every five minutes a login with SSL on port 993 is done. I usually get once a day an error "connection reset by peer - SSL connect", which goes away until the next monitor is executed. Initially I thought that raising the mail_max_userip_connections in protocol imap in 20-imap.conf to 256 should do the trick - but the error stays. What could be the reason for this error and which configuration values could be changed in order to avoid this error? I read a lot of different suggestions - but did not find a plausible explanation and recommendation. Thanks in advance! -- Cheers, \\|// Vince (o o) ----------------------------ooO-(_)-Ooo------------------------- ''' (o)_(o) [ ][0][ ] ô¿ô (=°o°=) World Domination by Copy and Paste [ ][ ][0] - (")_(") [0][0][0] () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments Ooo. ---------------------------.ooO----( )------------------------- ( ) (_/ \_)

5 11

Dovecot 2.2.25 test failure
by Michael A. Peters 04 Aug '16

04 Aug '16

Operating system - 64 bit CentOS 7 gcc-4.8.5-4.el7.x86_64 Building against LibreSSL which has been fine for other releases, but it is a crypto test that is fails. Tried with LibreSSL 2.4.2 and 2.3.6 - both the build completes but fails the make check Dovecot 2.2.24 passes make check on both. This is where it fails: Making check in lib-dcrypt make[2]: Entering directory `/home/alice/rpmbuild/BUILD/dovecot-2.2.25/src/lib-dcrypt' for bin in test-crypto test-stream; do \ if ! /bin/sh ../../run-test.sh ../.. ./$bin; then exit 1; fi; \ done ../../run-test.sh: line 21: 22369 Segmentation fault (core dumped) valgrind -q --trace-children=yes --leak-check=full --suppressions="$supp_path" --log-file=test.out.$$ $* ==22369== Invalid read of size 8 ==22369== at 0x113A47: dcrypt_ctx_sym_create (dcrypt.c:61) ==22369== by 0x119194: test_cipher_test_vectors (test-crypto.c:60) ==22369== by 0x1196F0: test_run_funcs (test-common.c:354) ==22369== by 0x119FC0: test_run (test-common.c:404) ==22369== by 0x113461: main (test-crypto.c:554) ==22369== Address 0x8 is not stack'd, malloc'd or (recently) free'd ==22369== ==22369== ==22369== Process terminating with default action of signal 11 (SIGSEGV) ==22369== Access not within mapped region at address 0x8 ==22369== at 0x113A47: dcrypt_ctx_sym_create (dcrypt.c:61) ==22369== by 0x119194: test_cipher_test_vectors (test-crypto.c:60) ==22369== by 0x1196F0: test_run_funcs (test-common.c:354) ==22369== by 0x119FC0: test_run (test-common.c:404) ==22369== by 0x113461: main (test-crypto.c:554) ==22369== If you believe this happened as a result of a stack ==22369== overflow in your program's main thread (unlikely but ==22369== possible), you can try to increase the size of the ==22369== main thread stack using the --main-stacksize= flag. ==22369== The main thread stack size used in this run was 8388608. Failed to run: ./test-crypto make[2]: *** [check-test] Error 1 make[2]: Leaving directory `/home/alice/rpmbuild/BUILD/dovecot-2.2.25/src/lib-dcrypt' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/home/alice/rpmbuild/BUILD/dovecot-2.2.25/src' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.Il5fdU (%check) Thanks for suggestions.

3 7

Attachment Storage problems
by Daniel van Ham Colchete 04 Aug '16

04 Aug '16

Guys, I started using single instance attachment storage a while ago but I had too many problems with it. My logs are filled with errors like: Aug 03 18:41:38 imap(user@domain): Error: read(attachments-connector(zlib(/srv/dovecot/mdbox/domain/user/storage/m.2))) failed: read(/srv/dovecot/attach/domain/5f/03/5f03f1d7da846fe9268473cae5219ae31019fd540dc67f58596d8390be4a0f2256158b1e9ba327841c513a6d927dbe9b767b7ad94f8ae5772674cccb3124b69d-7be2ef0e97036457c52000009331bd36[base64:19 b/l]) failed: open(/srv/dovecot/attach/domain/5f/03/5f03f1d7da846fe9268473cae5219ae31019fd540dc67f58596d8390be4a0f2256158b1e9ba327841c513a6d927dbe9b767b7ad94f8ae5772674cccb3124b69d-7be2ef0e97036457c52000009331bd36) failed: No such file or directory (uid=23484, box=INBOX) The funny thing is that the directory /srv/dovecot/attach/domain/5f/03/ doesn't even exist! So, I would like to stop using it and my question is: how? First we would need to stop writting things there while still reading it. How can I tell dovecot to stop using it on new e-mail? Second would be a dsync-like migration reinserting the attachments on the messages back. How can I do that? Most importantly, what do I do with the messages that lost attachments? Thank you very much. Best, Daniel Colchete

1 0

service-specific userdb affecting lmtp, quota-service
by Michael Fox 03 Aug '16

03 Aug '16

The service specific passwd-file userdb is causing quota-status and lmtp to fail. Using: userdb { args = ... /etc/dovecot/auth.d/%d/userdb.%s } I'm getting the following in /var/log/mail.err when I try to send/receive mail: Aug 1 15:46:57 n6mef-gw dovecot: auth: Error: passwd-file(mefpop(a)email.n6mef.org): stat(/etc/dovecot/auth.d/email.n6mef.org/userdb.quota-status) failed: Address family not supported by protocol Aug 1 15:47:08 n6mef-gw dovecot: auth: Error: passwd-file(mefpop(a)email.n6mef.org): stat(/etc/dovecot/auth.d/email.n6mef.org/userdb.lmtp) failed: Address family not supported by protocol I don't have a userdb.quota-status or userdb.lmtp. Is there something else that needs to be in the configuration to prevent these services from needing their own userdb? Thanks, Michael $ doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-76-generic x86_64 Ubuntu 14.04.4 LTS auth_mechanisms = cram-md5 auth_verbose = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota" mail_uid = vmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = scheme=cram-md5 username_format=%n /etc/dovecot/auth.d/%d/passdb driver = passwd-file } plugin { quota = maildir:User quota quota_grace = 10%% quota_rule = *:storage=50MB quota_rule2 = Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_status_toolarge = 552 5.2.3 Message is too large quota_warning = storage=90%% quota-warning 90 %n %d quota_warning2 = storage=75%% quota-warning 75 %n %d } pop3_lock_session = yes protocols = pop3 imap lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { executable = pop3 postlogin process_limit = 25 } service postlogin { executable = script-login /etc/dovecot/postlogin.sh group = vmail user = vmail } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = /etc/dovecot/quota-warning.sh user = vmail } ssl = required ssl_cert = </opt/xsc/ssl/certs/n6mef-gw.crt ssl_key = </opt/xsc/ssl/private/n6mef-gw.key ssl_protocols = !SSLv2 !SSLv3 userdb { args = username_format=%n /etc/dovecot/auth.d/%d/userdb.%s default_fields = home=/var/vmail/%d/%n driver = passwd-file } verbose_ssl = yes protocol lmtp { postmaster_address = xxxxxxxxxxxxxxxxx } protocol imap { mail_max_userip_connections = 10 } protocol pop3 { mail_max_userip_connections = 1 } remote 192.168.7.0/24/24 { ssl = yes } remote 192.168.7.0/27/27 { ssl = no } $

2 4

"Plaintext authentication disallowed on non-secure (SSL/TLS) connections" despite correct configuration to allow this
by Christian Balzer 03 Aug '16

03 Aug '16

Hello, this is basically a repeat of this query from last year, which unfortunately got a deafening silence for replies: --- http://dovecot.org/pipermail/dovecot/2015-August/101720.html --- I have mostly 2.1.7 (Debian Wheezy) mailbox servers and the current proxies are also of that vintage. So with "ssl=yes" and "disable_plaintext_auth=no" plaintext logins work, as per the documentation (http://wiki2.dovecot.org/SSL/DovecotConfiguration) and historically expected. Trying to use a 2.2.24 (Debian Jessie backports) dovecot proy with the same parameters fails like this: --- Aug 2 15:45:57 smtp12 dovecot: pop3-login: proxy(chibixxx(a)gol.com): Login failed to mbxx.xxx.gol.com:110: Plaintext authentication disallowed on non-secure (SSL/TLS) connections.: user=<chibixxx(a)gol.com>, method=PLAIN, rip=x.x.x.x, lip=x.x.x.x, pid=16066 --- Changing things to "ssl=no" doesn't help and setting trusted networks only changes the last bit to have "secured" appended but still fails the same otherwise. I really need 2.2.x to behave the same way as before and documented. Any ideas and feedback would be most welcome. Regards, Christian -- Christian Balzer Network/Systems Engineer chibi(a)gol.com Global OnLine Japan/Rakuten Communications http://www.gol.com/

1 1

Error: Timeout (180s) while waiting for lock for transaction log file dovecot.index.log
by Götz Reinicke - IT Koordinator 02 Aug '16

02 Aug '16

Hi, our maildir store is on a NFS share which was working fine for some time with the recommended setting from the dovecot wiki; suddenly today i got informed that one user has login problems to his mails and I have some messages in the logs: Error: Timeout (180s) while waiting for lock for transaction log file ....../Maildir/dovecot.index.log My current guess is a hick up in the network during a router configuration this weekend. My question: How to solve the problem? I can restart the nfs service/server later this day, as well as the mailserver ... as there is a kernel update too. Do I have to initiate some resync or deletion of index or whatsoever files? Thanks for any feedback and regards . Götz

1 0

auth_bind with "()" in username not working
by Matthias Lay 02 Aug '16

02 Aug '16

Hi all, I have an AD testsetup with auth_bind setting auth_bind_userdn = "spdev\\%Ln" I created a testuser "claasc (test)" which works fine in all ldapfilters but not for the auth_bind. the log shows everything correct just "invalid credentials" mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: auth client connected (pid=12202) mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=T6knVtc0wQB/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39873 mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: client passdb out: CONT 1 mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: client in: CONT<hidden> mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: passwd-file(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): cache miss mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: passwd-file(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): lookup: user=claasc (test) file=/etc/dovecot/passwd.postmaster mail.info: Jun 9 14:12:31 dovecot: auth: passwd-file(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): unknown user (given password: HubertHans99) mail.debug: Jun 9 14:12:31 dovecot: auth: Debug: ldap(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): cache miss mail.info: Jun 9 14:12:31 dovecot: auth: ldap(claasc (test),127.0.0.1,<T6knVtc0wQB/AAAB>): invalid credentials mail.debug: Jun 9 14:12:33 dovecot: auth: Debug: client passdb out: FAIL 1 user=claasc (test) mail.info: Jun 9 14:12:33 dovecot: imap-login: Aborted login (auth failed, 1 attempts in 2 secs): user=<claasc (test)>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<T6knVtc0wQB/AAAB> So I guess its just a bind problem. strace output from auth process of imap login: write(26, "0-\2\1\4`(\2\1\3\4\25spdev\\claasc \$test\$\200\fHubertHans99", 47) = 47 the additional \\ in front of the brackets look strange to me and might be the reason. tested Version is 2.2.18 Greetz Matze

1 4

passwd-file extra-fields: inbox=yes
by Michael Fox 02 Aug '16

02 Aug '16

I'd like to implement the virtual plugin so that POP3 users can see emails in their own inbox and a public namespace. As I understand it, I need to set "inbox=yes" separately, depending on which service the user is using. With passwd-file flat files, this means: userdb { args = ... /path/userdb.%s } userdb.imap: set the extra fields for each user = userdb_namespace/inbox/inbox=yes userdb.pop3: set the extra fields for each user = userdb_namespace/virtual/inbox=yes But without even getting to the virtual namespace part, I'm having difficulty getting the extra fields setting to work for a regular IMAP user. Specifically: If I use the Dovecot default settings of namespace inbox, which includes inbox=yes, and do NOT include the extra_fields value shown above, then IMAP users can log in OK. But if I comment out inbox=yes within namespace inbox, and then add the extra fields to userdb.imap (as shown above), (and reload doveadm), then the IMAP user is no longer able to login. Thunderbird displays "Login to server ... failed." and I get the following in syslog (mail.err): Aug 1 13:56:13 n6mef-gw dovecot: imap(mefimp(a)email.n6mef.org): Error: user mefimp(a)email.n6mef.org: Initialization failed: namespace configuration error: Duplicate namespace prefix: "" Aug 1 13:56:13 n6mef-gw dovecot: imap(mefimp(a)email.n6mef.org): Error: Invalid user settings. Refer to server log for more information. I'm at a loss for what's wrong. Can someone help? Userdb.imap test entry and doveconf -n below. Thanks, Michael Userdb.imap: mefimp::::Michael E Fox - mefimp:::userdb_namespace=/namespace/inbox/inbox=yes $ doveconf -n # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-76-generic x86_64 Ubuntu 14.04.4 LTS auth_mechanisms = cram-md5 auth_verbose = yes mail_gid = vmail mail_location = maildir:~/Maildir mail_plugins = " quota" mail_uid = vmail namespace inbox { location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/deny-users deny = yes driver = passwd-file } passdb { args = scheme=cram-md5 username_format=%n /etc/dovecot/auth.d/%d/passdb driver = passwd-file } plugin { quota = maildir:User quota quota_grace = 10%% quota_rule = *:storage=50MB quota_rule2 = Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO quota_status_toolarge = 552 5.2.3 Message is too large quota_warning = storage=90%% quota-warning 90 %n %d quota_warning2 = storage=75%% quota-warning 75 %n %d } pop3_lock_session = yes protocols = pop3 imap lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { executable = pop3 postlogin process_limit = 25 } service postlogin { executable = script-login /etc/dovecot/postlogin.sh group = vmail user = vmail } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = /etc/dovecot/quota-warning.sh user = vmail } ssl = required ssl_cert = </opt/xsc/ssl/certs/n6mef-gw.crt ssl_key = </opt/xsc/ssl/private/n6mef-gw.key ssl_protocols = !SSLv2 !SSLv3 userdb { args = username_format=%n /etc/dovecot/auth.d/%d/userdb.%s default_fields = home=/var/vmail/%d/%n driver = passwd-file } verbose_ssl = yes protocol lmtp { postmaster_address = xxxxxxxxxx } protocol imap { mail_max_userip_connections = 1 } protocol pop3 { mail_max_userip_connections = 1 } remote 192.168.7.0/24/24 { ssl = yes } remote 192.168.7.0/27/27 { ssl = no } $

1 0

IMAP flags and dovecot-keywords not working as expected
by Mark Foley 01 Aug '16

01 Aug '16

I've converted most of our users from Outlook to Thunderbird. One important feature of Thunderbird is that it pays attention to the IMAP non-standard message flags via the 'tags' feature (see http://wiki2.dovecot.org/MailboxFormat/Maildir) This is important because 2 users make extensive use of Outlook categories (Tags, in Thunderbird). I found that when I set a message to the 1st Tbird tag 0 (Important), the corresponding IMAP file got an 'a' suffix. Likewise, if I manually added an 'a' suffix to an IMAP file the corresponding tag was set displayed in Thunderbird. This made it easy for me to exports Outlook Categories and set IMAP messages flags accordingly. This worked perfectly on the user I was experimenting with (me). Recently, I converted one of these Outlook 'categories' users to Thunderbird. I added the appropriate flag letters to their IMAP messages, changed their tag names in Thunderbird, and created the following dovecot-keywords file as: 0 Board_and_Committee 1 Completed 2 Health_Care_meetings 3 Notifications 4 OSHP-DAS 5 personal_or_To_Do 6 Retirement_exits 7 $label5 8 Junk 9 $Forwarded 10 $MDNSent 11 $label2 However, none of the tags show up correctly in Thunderbird. If I manually set a message to have a tag of 0, the corresponding IMAP file gets a flag of 'm', not 'a' and the following is added to the dovecot-keywords files: 12 $label1 How can I fix this? Where is "$label1" text defined? Why did Thunderbird not snag the text for '0' from the dovecot-keywords file and give the IMAP file a tag of 'a'? My current theory is that the "Default" Thunderbird Tags corresponding to IMAP flags are not changeable and if new tags are create in Tbird, they get new flag letters. That would, of course, mean that if a user changes Thunderbird tag name, they would lose all tag settings on existing message. That doesn't seem right and I hope my theory is wrong. Any insight would be appreciated. --Mark

2 3

POP3 & IMAP inbox setting for virtual
by Michael Fox 01 Aug '16

01 Aug '16

Posted Monday 7/25. Haven't seen a response. Trying again: --- This is a noobie question, so bear with me if it's not worded correctly: Primary Requirements: 1) I'd like to have two namespaces - one private/per-user, and one public (visible by all logged-in users). The public mailbox(s) would be used to distribute information to all users. 2) I'd like both POP3 and IMAP users to see both namespaces. As I understand it, this requires the use of the virtual plugin for POP3, in order to create a virtual namespace which would mix together the private and public namespaces into one mailbox. I have read: http://wiki.dovecot.org/Plugins/Virtual https://sys4.de/de/blog/2013/02/11/dovecot-virtual-setup-mit-globaler-sieve- spamfilter-regel-fur-pop3-nutzer/ (via Google translation) The example uses a CASE statement in the MySQL userdb query. As I understand it, this is done to set which namespace contains the inbox: the private namespace or the virtual namespace -- depending on if the user is connected via the imap or pop3 service, respectively. Question: how do I accomplish the same goal (setting the proper namespace for the inbox) when using a passwd-file style flat file userdb? Thanks, Michael

2 4

self signed certs and dovecot imaps : howto? tlsv1 alert unknown ca
by hanasaki＠gmail.com 01 Aug '16

01 Aug '16

How do you setup dovecot to use a self signed cert? One server will be connected to the internet. One will be totally internal and have no runtime access to the internet. Getting the below error msg. Also, I think I have a TLS 1.0 and need a 1.2 cert?... Thank you. Jul 28 20:09:27 host dovecot: imap-login:: user=<>, rip=10...., lip=10...., TLS: SSL_read() failed: error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca: SSL alert number 48, session=<kK2aELspLpkKAQF5>

2 1

any news Enterprise Repository Access?
by Götz Reinicke - IT Koordinator 31 Jul '16

31 Jul '16

Hi, we had access to the repository and it was working fine. But as we cant get the 2.2.25 update I was looking into the repofolders and there are RPMs "just" for RHEL 6// but not 5 any more. My be I missed the latest discussions or announcements? Could you give me an update on information and may be the RHEL 5 RPMs too? Thanks a lot and regards . Götz

6 8

dovecot runs on a pbl listed ip ?
by Benny Pedersen 31 Jul '16

31 Jul '16

X-Spam-Report: * 3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL * [52.178.156.48 listed in zen.spamhaus.org] * 3.6 FS_REPLICA Subject says "replica" * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% * [score: 0.0000] * -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's * domain * 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily * valid * -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature * 0.8 RDNS_NONE Delivered to internal network by a host with no rDNS Received: from talvi.dovecot.org (unknown [52.178.156.48]) by wursti.dovecot.fi (Postfix) with ESMTP; Sun, 31 Jul 2016 04:27:22 +0200 (CEST) sorry if its not just me :( make sure all wan ips is in trusted-networks / internal-networks atleast in spamassassin who will make a bug for replica ? :=)

2 1

migration from cyrus; seg fault at mail_namespaces_get_root_sep
by vstargben＠gmail.com 31 Jul '16

31 Jul '16

Hi all, I am currently trying to migrate from cyrus to dovecot on a new system. Though only few accounts, I decided to use the mdbox format. To convert I use cyrus2dovecot first, then I use dsync to import the mailboxes. For compatibility I set the namespace of inbox to prefix = INBOX. and separator = . (as described here: http://wiki2.dovecot.org/Migration/Cyrus http://wiki.dovecot.org/Namespaces) This works except that the clients (mutt and Thunderbird) show an additional folder/mailbox "INBOX" below the inbox. How can I fix that? Should I add a prefix during conversion and not change the namespace config? On disk, the subfolders are next to INBOX. Well, I then tried to set list = children instead of "yes" for namespace inbox. On login a segfault occurs with this setting. See the information and backtrace below. Regards, Vincent ########################################################### linux-server2:~ # dovecot --version 2.2.25 (7be1766) linux-server2:~ # dovecot -n # 2.2.25 (7be1766): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.15 (97b3da0) # OS: Linux 4.1.21-14-default x86_64 openSUSE 42.1 (x86_64) btrfs base_dir = /data/mail/dovecot/ disable_plaintext_auth = no mail_debug = yes mail_gid = dovecot mail_location = mdbox:/data/mail/dovecot/maildat/%u mail_privileged_group = dovecot mail_uid = dovecot managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes list = children location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = INBOX. separator = . } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap lmtp ssl = no ssl_dh_parameters_length = 2048 ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd } ################################################################ GNU gdb (GDB; openSUSE Leap 42.1) 7.9.1 Copyright (C) 2015 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-suse-linux". Type "show configuration" for configuration details. For bug reporting instructions, please see: <http://bugs.opensuse.org/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/lib/dovecot/imap...Reading symbols from /usr/lib/debug/usr/lib/dovecot/imap.debug...done. done. [New LWP 8366] Core was generated by `dovecot/imap'. Program terminated with signal SIGSEGV, Segmentation fault. #0 mail_namespaces_get_root_sep (namespaces=0x0) at mail-namespace.c:601 601 mail-namespace.c: Datei oder Verzeichnis nicht gefunden. Missing separate debuginfos, use: zypper install glibc-debuginfo-2.19-19.1.x86_64 (gdb) bt full #0 mail_namespaces_get_root_sep (namespaces=0x0) at mail-namespace.c:601 No locals. #1 0x0000559bfb1792a5 in cmd_list_ref_root (ref=0x559bfd155d78 "", client=0x559bfd155020) at cmd-list.c:324 ns = 0x0 ns_prefix = 0x559bfb1963ea "" ns_sep = <optimized out> str = <optimized out> #2 cmd_list_full (cmd=0x559bfd155c00, lsub=<optimized out>) at cmd-list.c:461 client = 0x559bfd155020 args = 0x559bfd1289b8 list_args = 0x7f02a7ab0093 <t_malloc0+35> arg_count = 21915 patterns = {arr = {buffer = 0x559bfd155d88, element_size = 8}, v = 0x559bfd155d88, v_modifiable = 0x559bfd155d88} ref = 0x559bfd155d78 "" pattern = 0x559bfd155d80 "" str = <optimized out> #3 0x0000559bfb1818ed in command_exec (cmd=cmd@entry=0x559bfd155c00) at imap-commands.c:180 hook = 0x559bfd125110 finished = <optimized out> cmd_start_timeval = {tv_sec = 1469732468, tv_usec = 662738} cmd_start_bytes_in = 29 cmd_start_bytes_out = 746 __FUNCTION__ = "command_exec" #4 0x0000559bfb17fe4f in client_command_input (cmd=cmd@entry=0x559bfd155c00) at imap-client.c:969 client = 0x559bfd155020 command = <optimized out> __FUNCTION__ = "client_command_input" #5 0x0000559bfb17fedf in client_command_input (cmd=0x559bfd155c00) at imap-client.c:1029 client = 0x559bfd155020 command = <optimized out> __FUNCTION__ = "client_command_input" #6 0x0000559bfb180285 in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x559bfd155020) at imap-client.c:1069 No locals. #7 client_handle_input (client=client@entry=0x559bfd155020) at imap-client.c:1081 _data_stack_cur_id = 3 remove_io = false handled_commands = true __FUNCTION__ = "client_handle_input" #8 0x0000559bfb180785 in client_input (client=0x559bfd155020) at imap-client.c:1128 cmd = 0x559bfd136130 output = 0x559bfd155a40 bytes = 36 ---Type <return> to continue, or q <return> to quit--- __FUNCTION__ = "client_input" #9 0x00007f02a7ac49dc in io_loop_call_io (io=0x559bfd155b10) at ioloop.c:564 ioloop = 0x559bfd124740 t_id = 2 __FUNCTION__ = "io_loop_call_io" #10 0x00007f02a7ac5ce7 in io_loop_handler_run_internal (ioloop=ioloop@entry=0x559bfd124740) at ioloop-epoll.c:220 ctx = 0x559bfd126260 list = 0x559bfd127c90 io = <optimized out> tv = {tv_sec = 1799, tv_usec = 999471} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #11 0x00007f02a7ac4a65 in io_loop_handler_run (ioloop=ioloop@entry=0x559bfd124740) at ioloop.c:612 No locals. #12 0x00007f02a7ac4c18 in io_loop_run (ioloop=0x559bfd124740) at ioloop.c:588 __FUNCTION__ = "io_loop_run" #13 0x00007f02a7a5a1e3 in master_service_run (service=0x559bfd1245e0, callback=<optimized out>) at master-service.c:640 No locals. #14 0x0000559bfb173eb2 in main (argc=1, argv=0x559bfd124390) at main.c:460 set_roots = {0x559bfb39c520 <imap_setting_parser_info>, 0x7f02a8274b20 <lda_setting_parser_info>, 0x0} login_set = {auth_socket_path = 0x559bfd11c050 "\210\300\021\375\233U", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x559bfb18cbd0 <login_client_connected>, failure_callback = 0x559bfb18c560 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = 0x559bfb19530e "auth-master" c = <optimized out> (gdb)

1 0

Occasional lock timeouts on Linode VM with Dovecot Replication
by Reuben Farrelly 31 Jul '16

31 Jul '16

I've been seeing periodic entries in my dovecot logs like this: dovecot[3464]: dsync-server(kaylene): Error: Couldn't lock /home/kaylene/.dovecot-sync.lock: Timed out after 30 seconds: 3 Time(s) dovecot[3464]: dsync-server(reuben): Error: Couldn't lock /home/reuben/.dovecot-sync.lock: Timed out after 30 seconds: 1 Time(s) They occur several times per day, but don't appear to have any obvious cause and I am not aware of any problems this is causing. [They could be the cause of some reappearing UID type messages that also periodically are logged, but I can't be sure] They occur on a lightly loaded Linode VM, KVM Paravirtualised and with only local SSD disk storage. The VM is a Gentoo Linux VM running the latest kernels that Linode provide. I also saw this problem under Xen. The dovecot setup is a dsync replication between two hosts, there is about 150ms of latency between them. The host where I am seeing these messages on (lightning) is a dovecot replica of another system (thunderstorm). I am using Maildir storage. Thunderstorm sees the vast majority of the client side reads and writes and lightning just functions as a not-so-active replica. Thunderstorm is also a VM but on VMware (also on SSDs). This system has never had this problem. I've had this across many dovecot versions going back many months now so it's impossible to pinpoint when this started. I am currently running dovecot -git master-2.2 branch at the moment. I've never seen disk latency in excess of 30s on any system either so I doubt that raw IO is the cause. I don't have any settings specified in 10-mail.conf in the Mail processes section relating to locking or mmap. Has anyone else experienced this and/or any ideas about where to look next to determine the root cause? Is this a common warning to see in cloud hosted/shared environments? Reuben

2 2

Master-Master replication question
by Remko Lodder 29 Jul '16

29 Jul '16

Dear list, I have setup a master-master replication setup. My primairy MX's send email over on a DNS loadbalanced way, so DNS is doing some kind of round-robin way of sending mail to both master servers. I found out, that on one of the two machines, the email synchronisation is heavily delayed. Lets assume server A receives a mail from the MX; it synchronises almost instantly with the other server. Whenever server B receives the email, it could take up to several hours to synchronise the email, it seems that it is not detected prior. It is also interesting to see, that the mailboxes on server A (Where users login to retrieve their email via webmail/clients) are significantly smaller then the mailboxes on server B. When investigating, it seems that "older" mailboxes (or storage rather since we use mdbox) are still there on server B, which already had been removed on server A. My personal mailbox was 170MB on server A, while it was still 2.5GB on server B. (which was around that size before cleaning up the mailsboxes). I enabled debugging on the servers, and I see rather quick : "Replication requests" on server A, but when getting an email on server B, I do not see the request at all. My servers are both running the same version, same configuration (utilizing puppet), both running on ZFS and FreeBSD. Where server B is more loaded in it's memory because of some bhyve VM's and the server A does not run any VM. Does someone have any pointers on where to look? Thanks in advance ;-) Remko Included below the configurations from server A and B: Server A: # 2.2.25 (7be1766): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.14 (099a97c) # OS: FreeBSD 10.3-RELEASE-p2 amd64 auth_mechanisms = plain login disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it haproxy_trusted_networks = YYYY lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_debug = yes mail_fsync = always mail_location = mdbox:~/mdbox mail_plugins = " quota notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { antispam_backend = mailtrain antispam_mail_notspam = --ham antispam_mail_sendmail = /usr/local/bin/sa-learn.sh antispam_mail_spam = --spam antispam_spam_pattern_ignorecase = spam;junk antispam_trash_pattern_ignorecase = trash;deleted items;deleted messages antispam_verbose_debug = 1 mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcps:the other server:12346 sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /usr/local/etc/dovecot/sieve/global/ sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve } postmaster_address = postmaster@xxx protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 60 -U replication_max_conns = 100 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service doveadm { inet_listener { port = 12346 ssl = yes } } service imap-login { inet_listener imap_haproxy { haproxy = yes port = 10143 } inet_listener imaps_haproxy { haproxy = yes port = 10144 ssl = yes } service_count = 1 } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_ca = </usr/local/etc/letsencrypt/live/XXX ssl_cert = </usr/local/etc/letsencrypt/live/XXX ssl_client_ca_file = /usr/local/certificates/letsencrypt-ca.pem ssl_key = </usr/local/etc/letsencrypt/live/XXX ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_plugins = quota sieve postmaster_address = postmaster@xxxx } protocol lda { mail_plugins = " quota notify replication sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " quota notify replication imap_quota antispam" } Server B: # 2.2.25 (7be1766): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.4.14 (099a97c) # OS: FreeBSD 10.3-RELEASE amd64 auth_mechanisms = plain login disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it haproxy_trusted_networks = YYYY lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_debug = yes mail_fsync = always mail_location = mdbox:~/mdbox mail_plugins = " quota notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { antispam_backend = mailtrain antispam_mail_notspam = --ham antispam_mail_sendmail = /usr/local/bin/sa-learn.sh antispam_mail_spam = --spam antispam_spam_pattern_ignorecase = spam;junk antispam_trash_pattern_ignorecase = trash;deleted items;deleted messages antispam_verbose_debug = 1 mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size mail_replica = tcps:the other host:12346 sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /usr/local/etc/dovecot/sieve/global/ sieve_global_path = /usr/local/etc/dovecot/sieve/default.sieve } postmaster_address = postmaster@xxx protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 60 -U replication_max_conns = 100 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service doveadm { inet_listener { port = 12346 ssl = yes } } service imap-login { inet_listener imap_haproxy { haproxy = yes port = 10143 } inet_listener imaps_haproxy { haproxy = yes port = 10144 ssl = yes } service_count = 1 } service imap { process_limit = 1024 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3 { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_ca = </usr/local/etc/letsencrypt/live/xxx ssl_cert = </usr/local/etc/letsencrypt/live/xxx ssl_client_ca_file = /usr/local/certificates/letsencrypt-ca.pem ssl_key = </usr/local/etc/letsencrypt/live/xxx ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } verbose_proctitle = yes protocol lmtp { auth_username_format = %n mail_plugins = quota sieve postmaster_address = postmaster@XXXXX } protocol lda { mail_plugins = " quota notify replication sieve" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " quota notify replication imap_quota antispam" }

4 12

Re: Client app says my chained Comodo cert is invalid
by Joseph Tam 28 Jul '16

28 Jul '16

> The trouble appears when I attempt to configure a client account in > Mail.app on my Mac. For the POP server name, I enter my VPS? > ?45.56.81.181", because public DNS is still pointing to my existing > host. I set the account to use the Apple TLS certificate, and then > click to save this new account info. Before saving, Mail.app checks my > entries by attempting to log in. The result is: ?The identify of > server 45.56.81.181 cannot be verified. The certificate for this > server is invalid.? Well, yes, that's what you would expect. You've told your mail client to connect to "45.56.81.181", the client starts the SSL negotiation and finds the certificate is made out for "sheepsystems.com", and your mail client complains about the mismatch (a possible MITM attack). This is what you want SSL enabled system to do. Since 45.56.81.181 does not map to "sheepsystems.com" yet, you can short-circuit DNS and add a direct mapping to your Mac by adding this to /etc/hosts: 45.56.81.181 sheepsystems.com then reconfiguring your mail client to use the server "sheepsystems.com". This will appease the SSL constraint. > appear in /var/log/mail.log [2]. Don't know what this is about -- probably your Mac bailing out on authentication. Joseph Tam <jtam.home(a)gmail.com>

3 2

Client app says my chained Comodo cert is invalid
by Jerry Krinock 28 Jul '16

28 Jul '16

I’ve configured Dovecot and Postfix on a new VPS running Ubuntu 16.04, using Linode’s tutorial [1], to require authentication and SSL encryption for both POP3 and SMTP. All looks OK to me except, when my email client app (macOS Mail.app) tries to log in, it says that my cert is invalid. The trouble appears when I attempt to configure a client account in Mail.app on my Mac. For the POP server name, I enter my VPS’ “45.56.81.181", because public DNS is still pointing to my existing host. I set the account to use the Apple TLS certificate, and then click to save this new account info. Before saving, Mail.app checks my entries by attempting to log in. The result is: “The identify of server 45.56.81.181 cannot be verified. The certificate for this server is invalid.” At the same time, on my new server, some entries appear in /var/log/mail.log [2]. The certificate in question is a new PositiveSSL/Comodo cert I bought the other day. It works OK for serving web pages - I mean, on this same Mac, when I visit my under-construction site at https://45.56.81.181 in Safari or Firefox, I get the padlock icon and no warnings. Comodo gave me two two files, a “.crt” which contains my cert, and a “.ca-bundle.crt” which contains their certs. Per Dovecot documentation, I concatenated these into a “chained” file containing all 3 certs, starting with mine. In /etc/dovecot/conf.d/10-ssl.conf, I set ssl_cert = this “chained” file. I tried adding the two original cert files to macOS Keychain.app with “Always trust” but that did not help. Being new at this, I would appreciate any suggestions. My `dovecot -n` output is below [3]. Thank you very much! Jerry Krinock [1] https://www.linode.com/docs/email/postfix/email-with-postfix-dovecot-and-my… ************************************************** [2] /var/log/mail.log entries when client attempts login Jul 27 12:22:19 bird dovecot: pop3-login: Debug: SSL: where=0x10, ret=1: before/accept initialization [24.4.251.228] Jul 27 12:22:19 bird dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: before/accept initialization [24.4.251.228] Jul 27 12:22:19 bird dovecot: pop3-login: Debug: SSL: where=0x2001, ret=1: unknown state [24.4.251.228] Jul 27 12:22:19 bird dovecot: message repeated 6 times: [ pop3-login: Debug: SSL: where=0x2001, ret=1: unknown state [24.4.251.228]] Jul 27 12:22:19 bird dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: unknown state [24.4.251.228] Jul 27 12:22:19 bird dovecot: pop3-login: Debug: SSL: where=0x2002, ret=-1: unknown state [24.4.251.228] Jul 27 12:22:19 bird dovecot: pop3-login: Warning: SSL failed: where=0x2002: unknown state [24.4.251.228] Jul 27 12:22:19 bird dovecot: pop3-login: Debug: SSL error: Disconnected Jul 27 12:22:19 bird dovecot: pop3-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=24.4.251.228, lip=45.56.81.181, TLS handshaking: Disconnected, session=<8HuX76I4p8gYBPvk> Yes, 24.4.251.228 is the IP address of my Mac. ************************************************** [3] Output from `dovecot -n` # 2.2.22 (fe789d2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.13 (7b14904) # OS: Linux 4.5.5-x86_64-linode69 x86_64 Ubuntu 16.04 LTS ext4 auth_mechanisms = plain login mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 lmtp service auth-worker { user = vmail } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 995 } } ssl = required ssl_cert = </etc/ssl/localcerts/sheepsystems_com_chained.crt ssl_key = </etc/ssl/localcerts/linode.sheepsystems.com.key userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } verbose_ssl = yes

1 0

Sieve vacation address problem
by Harald Leithner 27 Jul '16

27 Jul '16

Hi, it seams I have a problem with the vacation script. The problem is that the vacation answers to a address that is not listed in the sieve script. I checked the postfix master.conf which delivers to lda correct parameter. In the logfile you can see that that office(a)example.com received a message that get delivered to user(a)example.com (with the sievescipt) and to office(a)example.com (another user without script). The sieve script has the :addresses parameter only set to user(a)example.com Is something wrong with my setup? We use roundcube + sievemanage to create sieve scripts. Sievescript: ## Generated by Roundcube Webmail SieveRules Plugin ## require ["date","relational","vacation"]; # rule:[Urlaub] if allof (currentdate :zone "+0200" :value "gt" "date" "2016-07-22", currentdate :zone "+0200" :value "lt" "date" "2016-08-08") { vacation :days 1 :addresses ["user(a)example.com"] :subject "Abwesenheitsnotiz" text: Thx i'm not here . ; } -------------- postfix master.conf dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/lib/dovecot/dovecot-lda -f ${sender} -a ${original_recipient} -d ${user}@${nexthop} -e -------------- Logfile: Postfix: 2016-07-27T11:44:30+02:00 mailstore1 postfix/smtpd[5037]: connect from unknown[172.20.20.229]:15677 2016-07-27T11:44:30+02:00 mailstore1 postfix/smtpd[5037]: 3rzqp64klWzF: client=unknown[172.20.20.229]:15677 2016-07-27T11:44:30+02:00 mailstore1 postfix/cleanup[5040]: 3rzqp64klWzF: message-id=<019301d1e7eb$76b26a70$64173f50$(a)example.org> 2016-07-27T11:44:30+02:00 mailstore1 postfix/qmgr[704]: 3rzqp64klWzF: from=<user(a)example.org>, size=7337, nrcpt=2 (queue active) 2016-07-27T11:44:30+02:00 mailstore1 postfix/smtpd[5037]: disconnect from unknown[172.20.20.229]:15677 2016-07-27T11:44:30+02:00 mailstore1 postfix/pipe[5157]: 3rzqp64klWzF: to=<office(a)example.com>, relay=dovecot, delay=0.12, delays=0.02/0.03/0/0.06, dsn=2.0.0, status=sent (delivered via dovecot service) 2016-07-27T11:44:30+02:00 mailstore1 postfix/pipe[5042]: 3rzqp64klWzF: to=<user(a)example.com>, orig_to=<office(a)example.com>, relay=dovecot, delay=0.12, delays=0.02/0.03/0/0.07, dsn=2.0.0, status=sent (delivered via dovecot service) 2016-07-27T11:44:30+02:00 mailstore1 postfix/qmgr[704]: 3rzqp64klWzF: removed dovecot lda 2016-07-27T11:44:30+02:00 mailstore1 dovecot: lda(user(a)example.com): sieve: msgid=<019301d1e7eb$76b26a70$64173f50$(a)example.org>: sent vacation response to <user(a)example.org> 2016-07-27T11:44:30+02:00 mailstore1 dovecot: lda(office(a)example.com): msgid=<019301d1e7eb$76b26a70$64173f50$(a)example.org>: saved mail to INBOX 2016-07-27T11:44:30+02:00 mailstore1 dovecot: lda(user(a)example.com): sieve: msgid=<019301d1e7eb$76b26a70$64173f50$(a)example.org>: stored mail into mailbox 'INBOX' ----------- doveocot conf # 2.2.devel (d81a83b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.devel (3f51b82) # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.5 auth_cache_negative_ttl = 1 secs auth_cache_size = 10 M auth_cache_ttl = 1 secs auth_mechanisms = PLAIN LOGIN DIGEST-MD5 SCRAM-SHA-1 CRAM-MD5 APOP auth_verbose = yes default_client_limit = 600 default_vsz_limit = 512 M dict { lastlogin = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sqlacl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no first_valid_gid = 1001 first_valid_uid = 1001 hostname = mailstore1(a)itronic.at imap_hibernate_timeout = 1 mins imap_id_log = * imap_id_send = * imap_idle_notify_interval = 10 mins instance_name = mailstore1 last_valid_gid = 1001 last_valid_uid = 1001 lda_original_recipient_header = X-LDA-Original-To lmtp_rcpt_check_quota = yes login_greeting = ITronic Mail Store login_trusted_networks = 172.22.14.0/24 mail_attachment_dir = /srv/storage1/vmail_sis mail_attachment_hash = %{sha512} mail_attachment_min_size = 64 k mail_cache_min_mail_count = 5 mail_gid = vmail mail_location = mdbox:~/mdbox mail_plugins = zlib lazy_expunge stats acl quota mail_prefetch_count = 100 mail_server_admin = mailto:postmaster@itronic.at mail_server_comment = ITronic Mail System mail_shared_explicit_inbox = yes mail_uid = vmail mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mdbox_preallocate_space = yes namespace { hidden = yes list = no location = mdbox:~/mdbox:MAILBOXDIR=expunged prefix = "#EXPUNGED/" subscriptions = no type = private } namespace { list = children location = mdbox:%%h/mdbox prefix = "#Users/%%u/" separator = / subscriptions = yes type = shared } namespace inbox { hidden = no inbox = yes location = mailbox Archvie { special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Sent { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile acl_shared_dict = proxy::sqlacl last_login_dict = proxy::lastlogin last_login_key = last-login/%u lazy_expunge = "#EXPUNGED/" lazy_expunge_only_last_instance = no quota = dict:User quota::proxy::sqlquota quota_grace = 10%% quota_rule = *:storage=1024M quota_rule2 = "#EXPUNGED:storage=+100M" quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=80%% quota-warning 80 %u recipient_delimiter = + sieve = file:~/sieve;active=~/.dovecot.sieve sieve_global = /etc/dovecot/sieve sieve_max_actions = 64 sieve_max_redirects = 8 sieve_max_script_size = 2M sieve_quota_max_scripts = 0 sieve_quota_max_storage = 64M stats_refresh = 30 secs stats_track_cmds = yes zlib_save = gz zlib_save_level = 6 } pop3_uidl_duplicates = rename protocols = imap lmtp sieve pop3 sieve service auth-worker { user = $default_internal_user } service auth { inet_listener { port = 4180 } unix_listener auth-userdb { mode = 0666 } } service dict { unix_listener dict { group = vmail mode = 0666 } } service imap-hibernate { unix_listener imap-hibernate { group = vmail mode = 0666 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 service_count = 0 } service imap { process_limit = 1024 unix_listener imap-master { user = dovecot } unix_listener imap { group = vmail mode = 0666 } vsz_limit = 512 M } service lmtp { inet_listener lmtp { address = 172.22.14.135 port = 24000 } unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 50 } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } process_min_avail = 20 service_count = 1 vsz_limit = 64 M } service pop3 { process_limit = 1024 } service quota-warning { executable = script /opt/scripts/quota-warning.sh unix_listener quota-warning { user = vmail } user = dovecot } service stats { fifo_listener stats-mail { mode = 0600 user = vmail } } shutdown_clients = no ssl_cert = </etc/dovecot/private/STAR.itronic.at.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA:AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-CAMELLIA256-SHA:CAMELLIA128-SHA:CAMELLIA256-SHA:ECDHE-RSA-DES-CBC3-SHA:DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_key = </etc/dovecot/private/STAR.itronic.at.pem ssl_options = no_compression ssl_prefer_server_ciphers = yes ssl_protocols = !SSLv2 !SSLv3 submission_host = 172.22.14.198 syslog_facility = local0 userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } valid_chroot_dirs = /srv/storage1/vmail verbose_proctitle = yes protocol imap { mail_max_userip_connections = 20 mail_plugins = zlib lazy_expunge stats imap_stats quota imap_quota acl imap_acl last_login } protocol lda { mail_plugins = zlib lazy_expunge stats acl sieve quota } protocol lmtp { mail_plugins = zlib lazy_expunge stats acl sieve quota } protocol sieve { mail_max_userip_connections = 10 managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 } protocol pop3 { mail_max_userip_connections = 10 mail_plugins = zlib lazy_expunge stats acl last_login } -- Harald Leithner ITronic Wiedner Hauptstraße 120/5.1, 1050 Wien, Austria Tel: +43-1-545 0 604 Mobil: +43-699-123 78 4 78 Mail: leithner(a)itronic.at | itronic.at

2 2

Opportunistic quota recalc
by Tom Sommer 27 Jul '16

27 Jul '16

I'm switching quota backend to redis (from maildir++), so all my current usages are reset. I get that I can do "doveadm quota recalc -A", but it takes forever (and auth processes time out/crash). It would make much more sense to recalc the usage on login if the current usage is unset. Is there no way to do a recalc-quota-on-first-login? Thanks. -- Tom Sommer

2 7