- dovecot - dovecot.org

[Dovecot] imapc - different settings for different namespaces
by Timo Sirainen 20 Mar '15

20 Mar '15

Originally I was planning on allowing all kinds of mail settings inside namespace {}, including imapc_* settings. But that's a bit difficult to implement (although I think it will happen some day). So for now I was thinking: imapc foo { host = imap.foo.com master_user = foomaster password = foopass } imapc bar { host = imap.bar.com ... } namespace { prefix = foo/ location = imapc:foo } namespace { prefix = bar/ location = imapc:bar } So basically if the path after imapc isn't absolute (/path or ~/path), then treat the path as the imapc section name and use its settings. Anyone have any improvement suggestions? I was planning on adding this to v2.2.3. I'm not sure if the section names should be "imapc" or something else (e.g. imap_remote {}).

2 2

core not dumped
by James 20 Mar '15

20 Mar '15

There is some underlying problem with imap-login but in order to debug it I'd like to see a core file. On error dovecot reports "core not dumped". If I put "abort()" in the code at the point it is reporting then a core file is written, so there is no OS reason why a core can not be written. It appears to be dovecot's choice to control the child. In an attempt to obtain a core file I have: service imap-login { chroot = drop_priv_before_exec = yes user = dovecot } How can I make imap-login to produce a core file? Syslog error report: Mar 18 09:22:28 MAILHOST dovecot: [ID 583609 mail.crit] imap-login: Fatal: master: service(imap-login): child 10812 killed with signal 11 (core not dumped) [last ip=111.222.333.444] Should anyone care at this point (before I've looked at a core file) the error is related to; imap-login: Disconnected (no auth attempts in 0 secs): user=<>, James.

3 4

Re: fast doveadm search results
by Joseph Tam 20 Mar '15

20 Mar '15

Vu Ngoc VU <vvu(a)mcra.fr> writes: > My goal is to be able to find mails quickly with "doveadm search". > We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. > These messages are "unwanted" ones: mistakenly sent, defamatory... > > So, that situations appear rarely, but when asked, they expected me to > deleted quickly these messages from few to thousands of users > mailboxes. > > Is that possible to change behaviour of Dovecot, some headers like > sender, message-id, date are stored in cache for at least 48h? (7 days > would be better). So is this a fair summary of what you are asking: you want to load dovecot's caches with searchable items (i.e. specified headers) *and* have them expire and removed from caches after a preset amount of time? Caches are persistent: once an item is cached, it stays in the cache. I can't think of a good way to purge them without a lot of bother, but maybe you don't really need this. If you want to preload the cache with searchable items, you can periodically run a search/fetch command, which will load the cache with headers you want. http://www.dovecot.org/list/dovecot/2010-October/053521.html Maybe you can even add these items into the cache upon delivery, but someone more knowlegable than I would have to help you with that. The FTS/Solr plugin might also help. You seem to be optimizing the wrong problem. Reading between the lines of your message, your management wants a technical solution to a human problem (someone did an oops). Joseph Tam <jtam.home(a)gmail.com>

1 0

Released Pigeonhole v0.4.7 for Dovecot v2.2.16
by Stephan Bosch 20 Mar '15

20 Mar '15

Hello Dovecot users, Here is the final 0.4.7 release. No changes were committed since the last release candidate. Changelog v0.4.7: * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.tar… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

check if anvil is working
by Leonardo Rodrigues 19 Mar '15

19 Mar '15

Hi, Is there any way of making sure the anvil service, used to penalty login fails, is working ? I dont see anything on the logs regarding it neither have it configured. It's not on my configuration files, but it can be seen on a 'dovecot -a' dump. Should it be logging something ? Should i have enabled it somehow ? Thanks for the answers. [root@correio log]# dovecot --version 2.2.13 (from dovecot -a dump) service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email gertrudes(a)solutti.com.br My SPAMTRAP, do not email it

1 0

fast doveadm search results
by Vu Ngoc VU 19 Mar '15

19 Mar '15

hello, I've posted same question here months ago. But obtaine no answer, even not a "you question is stupid". So I don't know what to think about that. My goal is to be able to find mails quickly with "doveadm search". We are using dovecot in a corporate. And some managers, sometimes ask to delete some messages. These messages are "unwanted" ones: mistakenly sent, defamatory... So, that situations appear rarely, but when asked, they expected me to deleted quickly these messages from few to thousands of users mailboxes. Is that possible to change behaviour of Dovecot, some headers like sender, message-id, date are stored in cache for at least 48h? (7 days would be better). I've read this page : http://wiki2.dovecot.org/Design/Indexes/Cache but cannot understand every parts. "A specific decision can be forced by ORing it with MAIL_CACHE_DECISION_FORCED." Is OR in this sentence like AND/OR comparators? Where to put "MAIL_CACHE_DECISION_FORCED"? "mail-cache-decisions.c file contains the rules how Dovecot changes the decisions." <-- is it in this file? My setup is 2.2.9 on Ubuntu 14.04 running on OpenVZ containers with 2 Director and 2 imap/pop3 backends. The storage is shared via NFS. Is this the performance problem? If dovecot has metadata I want in its cache, I cannot see how this is a problem. Can these settings be useful for my case? mail_always_cache_fields = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_never_cache_fields = imap.envelope Thanks.

2 2

Support for multiple passwords?
by Conrad Kostecki 18 Mar '15

18 Mar '15

Hi! Currently, the passwords are stored in plaintext for my dovecot, as I am still using cram-md5 AND digest-md5. I have still to offer that, as I have some deprecated clients, therefore, I am unable to hash at least those passwords for that accounts. I've found on the Wiki: > In future it's possible that Dovecot could support multiple passwords > in different schemes for a single user. Is there any news about this? Are there still any plans to support this maybe in future? For my understanding, that would solve my problem, that I could define a password in both schemes (cram and digest) and don't have to use plaintext password? Cheers Conrad

3 6

passwd file for quota
by Cliff Hayes 18 Mar '15

18 Mar '15

I need to implement quota. I read as much as I could including http://wiki2.dovecot.org/HowTo/SimpleVirtualInstall But my current /etc/passwd file does not have the password in it as shown in dovecot docs ... there is an x where the password should be. I created a program that creates a passwd file in the proper format with the proper extra quota fields for all users (except it has an x where the password should be). I plan to store it in /etc/dovecot How do I get dovecot to stop looking at /etc/passwd and start looking at /etc/dovecot/passwd? And hopefully that will not affect how it gets the password (pam) because when users change their password from webmail of course dovecot will need to be looking in the same place. # dovecot -n output # 2.0.9: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-431.29.2.el6.x86_64 x86_64 Scientific Linux release 6.5 (Carbon) auth_failure_delay = 5 secs auth_username_format = %Ln auth_verbose_passwords = plain first_valid_uid = 9 mail_access_groups = mail mail_location = maildir:~/Maildir managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mbox_write_locks = fcntl passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_after = /dovecotSieveAfter/ sieve_dir = ~/sieve } protocols = imap lmtp sieve service managesieve-login { inet_listener sieve { port = 4190 } } ssl_ca = </etc/pki/dovecot/certs/intermediate20150202.crt ssl_cert = </etc/pki/dovecot/certs/avalon20150202.crt ssl_key = </etc/pki/dovecot/private/avalon20150129.key ssl_verify_client_cert = yes userdb { driver = passwd } protocol lmtp { log_path = /var/log/dovecot-lmtp.log mail_plugins = " sieve" } protocol lda { log_path = /var/log/dovecot-lda.log mail_plugins = " sieve" }

2 4

Roundcubemail problem with Dovecot
by Robert Moskowitz 18 Mar '15

18 Mar '15

I am getting "Connection to storage server failed." in roundcubemail. On doing a google search If find: http://help.directadmin.com/item.php?id=473 Which puts the problem at dovecot. I did get a dovecot update back on 3-5 and that would match to my one roundcube mail user complaining and the delays I am seeing with thunderbird and outlook users. So with my setup, I am trying to figure what are the index files to delete. Say for myself, I am seeing: /home/vmail/htt-consult.com/rgm/dovecot.index /home/vmail/htt-consult.com/rgm/dovecot.index.cache /home/vmail/htt-consult.com/rgm/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Drafts/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Sent/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Spam/dovecot.index.log /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index.cache /home/vmail/htt-consult.com/rgm/.Trash/dovecot.index.log Do I delete all of these? The index.cache files are quite large.

1 1

Re: Dovecot current number of connections being used.
by Joseph Tam 18 Mar '15

18 Mar '15

Jaime Ventura writes: > Is there an easy way to get how many connections are being handled at a > moment? This works: doveadm who -1 2>/dev/null | wc -l If yopu only want to coutn IMAP connections (not POP3), doveadm who -1 2>/dev/null | grep -Fc imap Joseph Tam <jtam.home(a)gmail.com>

2 1

Proxying of non "plain" SASL mechnisms.
by Peter Mogensen 18 Mar '15

18 Mar '15

Hi, I understand from earlier discussions that the reason dovecot doesn't support proxying of other SASL mechanisms than those which supply the plaintext password is that in general it would be possible to proxy any SASL mechanism since it might protect against man-in-the-middle attacks (which would prevent proxying). However, that has led to choice between letting users use PLAIN (or equivalent), or to have the proxy access the target hosts by "master" password. Of course, having the plaintext password the proxy could in principle do other challenge/response SASL handshakes with the target backend, but right now only LOGIN and PLAIN is implemented. So I wondered about the rationale for not just forward the SASL handshake. - First, blindly forwardning will not do, since the mech data has to be decoded anyway to do any per/user passdb lookup (to, say, find the target host). But you don't need authentication to actually succeed to do that. You only need AuthZ-id or AuthN-id. - Secondly, the design of the interaction between imap-login processes and the auth-service in general prevent in general to forward multi-handshake SASL mechanisms, since the authentication must be done before the proxying can be started. But it doesn't prevent forwarding of single handshake SASL mechanisms which use SASL-IR. - Thirdly, while it's correct that some SASL mechanisms protect against man-in-the-middle attacks, that doesn't apply for most single-handshake SASL-IR mechanisms unless they do some kind of channel-binding. (like SASL EXTERNAL) For example, the GS2-KRB5 SASL mech would be perfectly forwarded if just the Kerberos ticket doesn't put restrictions on the client IP-address. So, why not just extend the support for proxy authentication forwarding to any single-handskake SASL-IR mechanism, which doesn't use channel-binding? (which includes PLAIN, but also GS2-KRB5, and possibly others). /Peter

2 2

Dovecot 2.2.15 issues with global ACL
by Ovidiu Moldovan 18 Mar '15

18 Mar '15

Hello, We have upgraded from Dovecot 2.2.13 to 2.2.15 and we are using global ACL file. The content of the ACL file is as following: * owner r INBOX owner lrwstipekxa INBOX/* owner lrwstipekxa user owner rwstipekxa user/* owner rwstipekxa This worked fine but after update any user cannot see any folders from under the INBOX, also they cannot create any new folders. Error into the logs are like this: Debug: acl: Mailbox not in dovecot-acl-list: INBOX Debug: acl: Mailbox not in dovecot-acl-list: INBOX/Chats Debug: acl: Mailbox not in dovecot-acl-list: INBOX/Draft Debug: acl: Mailbox not in dovecot-acl-list: INBOX/INBOX .... I can only see one acl change log at version 2.2.14: http://www.dovecot.org/list/dovecot-news/2014-October/000276.html acl: Global ACL file now supports "quotes" around patterns. But I could not find the reason why the global acl file does not work anymore? Br, Ova

2 2

http://xi.rename-it.nl 2.2.16-1~auto+10/11/12/13: segfault /var/lib/dovecot/auth OR (db_ldap_connect_delayed):
by Denny Fuchs 17 Mar '15

17 Mar '15

hi, I testing around with Kolab with LDAP and have some strange problems, with the auto generated packages for Wheezy. On my first test VM, I have 2:2.2.16~rc1-1~auto+4 installed, and everything works as expected. On a new VM I have 2.2.16-1~auto+13_amd64.deb packages and if I include LDAP backend, I get a segmentation fault on /usr/lib/dovecot/auth: root@kolab:/etc/dovecot/conf.d# /usr/lib/dovecot/auth Segmentation fault with auto+12 and auto+13 If I downgrade to auto+11 or auto+10 I get: Mar 17 14:42:59 kolab dovecot: auth: Panic: file db-ldap.c: line 1228 (db_ldap_connect_delayed): assertion failed: (conn->to == NULL) Mar 17 14:42:59 kolab dovecot: auth: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0x7b5ef) [0x7f57d815c5ef] -> /usr/lib/dovecot/libdovecot.so.0(+0x7b64e) [0x7f57d815c64e] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f57d810b0d5] -> /usr/lib/dovecot/modules/auth/libauthdb_ldap.so(+0x5455) [0x7f57d70e2455] -> dovecot/auth(userdb_init+0x1a) [0x42765a] -> dovecot/auth(auths_init+0xc9) [0x40d979] -> dovecot/auth(main+0x2b5) [0x40cc85] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xfd) [0x7f57d7523ead] -> dovecot/auth() [0x40cee9] Mar 17 14:42:59 kolab dovecot: auth: Fatal: master: service(auth): child 1161 killed with signal 6 (core dumps disabled) Mar 17 14:42:59 kolab dovecot: master: Error: service(auth): command startup failed, throttling for 2 secs Mar 17 14:42:59 kolab dovecot: pop3-login: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=::1, lip=::1, secured, session=<1QMUJXwRTQAAAAAAAAAAAAAAAAAAAAAB> ii dovecot-sieve 2:2.2.16~rc1-1~auto+4 amd64 secure POP3/IMAP server - Sieve filters support root@kolab:/# ldd /usr/lib/dovecot/modules/auth/libauthdb_ldap.so linux-vdso.so.1 => (0x00007ffc4a1c6000) libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007effe2d1a000) librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007effe2b12000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007effe2786000) liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007effe2577000) libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007effe2361000) libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007effe2145000) libgnutls.so.26 => /usr/lib/x86_64-linux-gnu/libgnutls.so.26 (0x00007effe1e85000) libgcrypt.so.11 => /lib/x86_64-linux-gnu/libgcrypt.so.11 (0x00007effe1c06000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007effe19e9000) /lib64/ld-linux-x86-64.so.2 (0x00007effe3180000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007effe17e5000) libtasn1.so.3 => /usr/lib/x86_64-linux-gnu/libtasn1.so.3 (0x00007effe15d3000) libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007effe13bc000) libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007effe11aa000) libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007effe0fa6000) Then I copied from my first VM the libauthdb_ldap.so file on the new test VM to /usr/lib/dovecot/modules/auth/libauthdb_ldap.so (remember: ~rc1-1~auto+4) and the result: root@kolab:/etc/dovecot/conf.d# /usr/lib/dovecot/auth Error: LDAP: binding failed (dn cn=Directory Manager): Invalid credentials and, it works again ... linux-vdso.so.1 => (0x00007fffa00c6000) libldap_r-2.4.so.2 => /usr/lib/x86_64-linux-gnu/libldap_r-2.4.so.2 (0x00007f94b7ec3000) librt.so.1 => /lib/x86_64-linux-gnu/librt.so.1 (0x00007f94b7cbb000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f94b792f000) liblber-2.4.so.2 => /usr/lib/x86_64-linux-gnu/liblber-2.4.so.2 (0x00007f94b7720000) libresolv.so.2 => /lib/x86_64-linux-gnu/libresolv.so.2 (0x00007f94b750a000) libsasl2.so.2 => /usr/lib/x86_64-linux-gnu/libsasl2.so.2 (0x00007f94b72ee000) libgnutls.so.26 => /usr/lib/x86_64-linux-gnu/libgnutls.so.26 (0x00007f94b702e000) libgcrypt.so.11 => /lib/x86_64-linux-gnu/libgcrypt.so.11 (0x00007f94b6daf000) libpthread.so.0 => /lib/x86_64-linux-gnu/libpthread.so.0 (0x00007f94b6b92000) /lib64/ld-linux-x86-64.so.2 (0x00007f94b8328000) libdl.so.2 => /lib/x86_64-linux-gnu/libdl.so.2 (0x00007f94b698e000) libtasn1.so.3 => /usr/lib/x86_64-linux-gnu/libtasn1.so.3 (0x00007f94b677c000) libz.so.1 => /lib/x86_64-linux-gnu/libz.so.1 (0x00007f94b6565000) libp11-kit.so.0 => /usr/lib/x86_64-linux-gnu/libp11-kit.so.0 (0x00007f94b6353000) libgpg-error.so.0 => /lib/x86_64-linux-gnu/libgpg-error.so.0 (0x00007f94b614f000) So, it seems, that there is something broken with the autogenerated packages, or with my fresh installed Wheey VM (KVM AMD64) in combination with LDAP. any suggestions? cu denny

2 1

Dovecot current number of connections being used.
by Jaime Ventura 17 Mar '15

17 Mar '15

Hey, Is there an easy way to get how many connections are being handled at a moment? I wanted to have that number over the time and see: - Trends on usage during the day - how close is it from reaching the maximum number of connections. - ... I'm searching for a solution without recurring to something like netstat | grep imap | wc -l. Thanks, Jaime

2 1

Patch SERVICE_FIRST_STATUS_TIMEOUT
by Andre Helwig 17 Mar '15

17 Mar '15

Hi list, we had a lot of trouble with our Dovecot Replicating-Cluster installation authenticating against LDAP Service. We ran in a timeout and what happened was that we got more and more search requests running against on our ldap server. And on the dovecot site the process got killed after a couple of seconds. So we ran into a race condition and our LDAP Server was under heavy load. We got a log entry like this: "Initial status notification not received in 30 seconds, killing the process" So we had to apply the attached patch to our Source based Dovecot Cluster. Could you please make a configurable Parameter for our Patched value? That would be great to get this parameter Configurable. Thanks Andre Helwig -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-0 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

2 3

Dovecot 2.1.7 still accepting SSLv3 though disabled?
by Thomas Preissler 17 Mar '15

17 Mar '15

Hello, I came across a strange problem with my Dovecot 2.1.7 installation (updated Debian Wheezy) in regards to SSL/TLS connections. My configuration is as follows: $ dovecot -n | grep ssl service imap-login { ssl = yes ... } ssl_cert = <...... ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA ssl_key = <...... ssl_protocols = !SSLv3 !SSLv2 This cipherstring has been taken from https://bettercrypto.org/static/applied-crypto-hardening.pdf. But this is not the problem, when I comment it out, Dovecot still behaves the same way. When I enable verbose_ssl I get this: 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=-1: unknown state [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client hello A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server hello A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server done A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read finished A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write finished A [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x20, ret=1: SSL negotiation finished successfully [$CLIENTIP] 2015-03-15 08:27:39 imap-login: Warning: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [$CLIENTIP] Is this right? Is SSLv3 used on this connection? But when I explicitely test for SSLv3 support I get $ openssl s_client -connect $SERVERIP:993 -ssl3 CONNECTED(00000003) 140683835029160:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1260:SSL alert number 40 140683835029160:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 0 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE SSL-Session: Protocol : SSLv3 Cipher : 0000 Session-ID: Session-ID-ctx: Master-Key: Key-Arg : None PSK identity: None PSK identity hint: None SRP username: None Start Time: 1426411304 Timeout : 7200 (sec) Verify return code: 0 (ok) --- Where I got this from says "if you you get a handshake failure, then you don't support SSLv3". But in my case the following output kinda says, that I do support it - with a ciphers of (NONE)? In regards to libraries $ ldd /usr/lib/dovecot/imap-login | grep ssl libssl.so.1.0.0 => /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0 (0x00007f1f55025000) $ dpkg -l | grep ssl ii libcrypt-openssl-bignum-perl 0.04-3 amd64 Access OpenSSL multiprecision integer arithmetic libraries ii libcrypt-openssl-dsa-perl 0.13-6 amd64 module which implements the DSA signature verification system ii libcrypt-openssl-rsa-perl 0.28-1 amd64 module for RSA encryption using OpenSSL ii libcrypt-ssleay-perl 0.58-1 amd64 OpenSSL support for LWP ii libio-socket-ssl-perl 1.76-2 all Perl module implementing object oriented interface to SSL sockets ii libnet-ssleay-perl 1.48-1+b1 amd64 Perl module for Secure Sockets Layer (SSL) rc libssl0.9.8 0.9.8o-4squeeze14 amd64 SSL shared libraries ii libssl1.0.0:amd64 1.0.1e-2+deb7u14 amd64 SSL shared libraries ii openssl 1.0.1e-2+deb7u14 amd64 Secure Socket Layer (SSL) binary and related cryptographic tools ii openssl-blacklist 0.5-3 all Blacklists for OpenSSL RSA keys and tools ii python-openssl 0.13-2+deb7u1 amd64 Python 2 wrapper around the OpenSSL library ii ssl-cert 1.0.32 all simple debconf wrapper for OpenSSL ii ssl-cert-check 3.22-1 all proactively handling X.509 certificate expiration ii sslmate 0.6.2-1 all Buy and manage SSL certificates from the command line My NginX is using the same library, and this does indeed support TLSv2, so what I am doing wrong in my Dovecot configuration? Any clues? Regards Thomas -- www.preissler.co.uk | Twitter: @module0x90 | PGP-Key: 75889415 GPG Fingerprint: CCBD 153A D257 CA7E A217 FDF7 5928 03D1 7588 9415

3 2

Released Pigeonhole v0.4.7.rc3 for Dovecot v2.2.16
by Stephan Bosch 17 Mar '15

17 Mar '15

Hello Dovecot users, The rc2 release had a couple of new, rather small, but very annoying bugs. First of all, the path for a file storage wasn't actually normalized, due to a stupid last-minute change before the release. This caused the personal script to be skipped with a warning when there were e.g. duplicate slashes in the path. Second, due to recent changes, the file storage would complain with a temporary error if the directory where the active script symlink would be located was missing. Changelog v0.4.7 (unchanged): * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc3… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc3… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

1 0

Released Pigeonhole v0.4.7.rc2 for Dovecot v2.2.16
by Stephan Bosch 16 Mar '15

16 Mar '15

Hello Dovecot users, The rc1 release showed a few problems with the up-to-date checking of on-disk binary files. The binary files contain some metadata about the script these were compiled from. If this doesn't match the current script anymore, the script is recompiled. One of these metadata items is the script location. However, this location wasn't normalized, so when the binary would be compiled with sievec it depended on the path provided at the command line. When dumping a script binary, the metadata is now printed as well. Also, I added more debug log lines about up-to-date checking. I improved backwards compatibility for the file script storage a bit relative to the last version. It now properly recognizes a regular file at the symlink path, even when the storage path itself doesn't exist. Changelog v0.4.7 (updated): * editheader extension: Made protection against addition and deletion of headers configurable separately. Also, the `Received' and `Auto-Submitted' headers are no longer protected against addition by default. * Turned message envelope address parse errors into warnings. * The interpreter now accepts non-standard domain names, e.g. containing '_'. + Implemented the Sieve index extension (RFC 5260). + Implemented support for the mboxmetadata and servermetadata extensions (RFC 5490). + Implemented new sieve commands for the doveadm command line utility. These commands are currently limited to ManageSieve operations, but the other current sieve tools will be migrated to doveadm in the near future as well. + Added more debug output about binary up-to-date checking. + Added script metadata to binary dump output. - Fixed Sieve script binary up-to-date checking by normalizing the script location. - The Sieve interpreter now flushes the duplicate database during start phase of result execution rather than commit phase. This makes sure locks on the duplicate database are released as soon as possible, preventing contention. - Performed a few optimizations in the lexical scanner of the language. - Fixed bug in `:matches' match-type that made a pattern without wildcards match as if there were a '*' at the beginning. - Fixed crash in validation of the string parameter of the comparator tag. - extprograms extension: Made sure supplemental group privileges are also dropped. This was a problem reported by Debian lintian. - Fixed bug in handling of binary errors for action side-effects and message overrides. - file script storage: Restructured storage initialization to address backwards compatibility issues. - dict script storage: Fixed small memory allocation bug. The release is available as follows: http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc2… http://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.7.rc2… Refer to http://pigeonhole.dovecot.org and the Dovecot v2.x wiki for more information. Have fun testing this new release and don't hesitate to notify me when there are any problems. Regards, -- Stephan Bosch stephan(a)rename-it.nl

2 2

Warning: sieve: file storage: Active sieve script symlink is broken: Invalid/unknown path to storage
by Василий Севостьянов 16 Mar '15

16 Mar '15

dovecot version: 2.2.16 (3d8a054a93a9) sieve configuration: plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } For each of the users, ~/.dovecot.sieve is a symlink to ~/sieve/roundcube.sieve Until yesterday, everything was working find. But starting from yesterday's update, the log is filling up with messages like: Mar 16 19:12:32 cs12986 dovecot: lda(postmaster(a)contoso.com <postmaster(a)euro-contact.ru>): Warning: sieve: file storage: Active sieve script symlink /home/virtualmail/contoso.com/it/.dovecot.sieve <http://euct.ru/it/.dovecot.sieve> is broken: Invalid/unknown path to storage (points to /home/virtualmail/contoso.com/it/sieve <http://euct.ru/it/sieve>). Nothing was changed in the config files. What might have gone wrong?

3 4

Configuring Shared Mailbox Dictionaries
by james＠lottspot.com 16 Mar '15

16 Mar '15

Hello, list! I am in the midst of configuring a new Dovecot IMAP server, and I'm preparing to setup shard mailboxes as part of the ocnfiguration. In order to get these setup the way I want, I've figured out that I'm going to have to setup an acl_shared_dict. This is where things start to get confusing for me, as I have had difficulty finding thorough explanations of dictionary configuration. My primary concern is that all my user details are stored in a sqlite database in which the '%n' and '%d' components of username/email addresses are stored in separate columns. The SQL dictionary example in the Shared Mailboxes document [http://wiki2.dovecot.org/SharedMailboxes/Shared] assumes that the username is stored as a singular '%n@%d' key. In my authdb lookups, I use sqlite syntax to concatenate the '%n' and '%d' columns around a '@' character to find the user. Is it possible to implement an acl_shared_dict in some similar fashion? My second question, which is completely unrelated and more out of morbid curiosity than anything (although it could affect my configuration decisions) is that I noticed every dictionary which shows up in the documentation has a "pattern" field. In the case of the acl_shared_dict example, the pattern is 'shared/shared-boxes/user/$to/$from'. I couldn't figure out by studying the example where this value was derived from, or indeed where it is derived from in any example dictionaries which are documented. Can anyone explain the meaning of the "pattern" field and what exactly its value means? Thanks in advance for all your helpful answers! :)

1 1

Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Casey Stone 16 Mar '15

16 Mar '15

Switching to official dovecot-ee version solved my sync/backup issues, also on Ubuntu. The 12.04 package works on 14.04. It's free and should update fine. Backup your config files first (dovecot and postfix if you use that)! http://shop.dovecot.fi/home/8-dovecot-ee-repository-access.html

1 0

Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Vanja 16 Mar '15

16 Mar '15

I have been fighting, for 2 days, with a Dovecot setup and I now officially need help :) Basically, I am trying to setup replication between 2 identical Dovecot servers, on different physical servers (different hostnames/etc, of course), and although I've managed to solve many problems I can't overcome the final hurdle. When a mail comes in to one of the servers, replication over TCP should kick in and mail should be replicated, but instead I get this in the mail log: ------------------------------------------------------------------------------------------------- dovecot2 dovecot: doveadm(user1(a)test1.int): Fatal: -N parameter requires syncing with remote host ------------------------------------------------------------------------------------------------- Mail is delivered to dovecot2 server, Postfix delivers it via LMTP, and everything seems to work ok. However, I can't figure out the cause for the error that I am seeing. I have looked into source code and found where this error is triggered (line 834 in doveadm/dsync/doveadm-dsync.c, inside Dovecot 2.2.9 source code), but I am afraid that I don't understand the context (ctx->run_type == DSYNC_RUN_TYPE_LOCAL) and it would take me a lot of time to debug the whole thing from the scratch. I've never looked into Dovecot internals before, so it's all a mystery to me at this point. I've tried stracing the process but the flow does not make sense to me, I can't understand what exactly happens before error is displayed. Also, there is no traffic to port 12345 on other node, so execution fails before syncing even starts (and error message is not related with remote node config/setup/etc). Triggering replication manually, from command line, works as expected: # doveadm sync -A tcp:192.168.1.100 (at this point user1's mail folder is properly updated on remote server) I've tried searching around, but it appears that noone else has this problem(or isn't complaining about it :). I am not sure if I am doing something wrong (apart from replication). I will need to support multiple virtual domains and I am basically using passwd-file for authentication, so I am using a single passwd file for all virtual domain users which allows user lookup (doveadm user '*') to work, which is required by replication. This is configuration file from dovecot2 server (which I use for testing and delivering mails): --- config start --- # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-30-generic x86_64 Ubuntu 14.04.2 LTS ext4 debug_log_path = /var/log/dovecot_debug.log doveadm_password = 67890 doveadm_port = 12345 mail_debug = yes mail_location = maildir:/vmail/mail/%d/%n/Maildir mail_plugins = " notify replication" namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%u /vmail/auth/passwd driver = passwd-file } plugin { mail_replica = 192.168.1.100 } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth-worker { unix_listener auth-worker { user = dovecot-auth } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = dovecot-auth } service doveadm { inet_listener { port = 12345 } } service imap-login { inet_listener imap { port = 0 } } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 10024 } process_min_avail = 3 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/dovecot.pem ssl_key = </etc/dovecot/private/dovecot.pem userdb { args = username_format=%u /vmail/auth/passwd default_fields = uid=vmail gid=vmail home=/vmail/mail/%d/%n driver = passwd-file } protocol lmtp { postmaster_address = root@localhost } --- config end --- Configuration file on other node is exactly the same, except different IP address in mail_replica statement. Any help is much appreciated. Thank you.

1 1

Re: Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Vanja 16 Mar '15

16 Mar '15

Sorry to post to the list again, but just to confirm that I am seeing same problem with 2.2.16 that I compiled from sources. Same error message appears in the log, can't figure out what in the setup makes replication break. Philipp, can you tell me which auth backend are you using? passwd-file, SQL database or something else? Would you consider posting your 'sanitized' config file here, or emailing it to me privately? Thanks. Vanja On 03/16/2015 03:23 PM, Philipp wrote: > Am 16.03.2015 09:12 schrieb Vanja: >> doveadm_port = 12345 > >> plugin { >> mail_replica = 192.168.1.100 >> } > > would you try: > mail_replica = tcp:192.168.1.100:12345 > which works for me. > > check for firewall settings (both ways) anyway - and I can only advise > to go for 2.2.16; there have been > numerous fixes after 2.2.9 to the whole dsync/replica parts.

1 0

Re: Problem with replication ("Fatal: -N parameter requires syncing with remote host")
by Vanja 16 Mar '15

16 Mar '15

Philipp, I already tried explicitly specifying port, it does not make any difference. I tried quite many 'obvious' (to put it this way) configuration changes and tried changing many things in setup, but it would be too much to list all of them in a post. Basically, I was hoping that someone would know what exactly triggers this behavior, so I could fix it. At this point in time, I would like to see whether I can make this work with 2.2.9 that comes with Ubuntu 14.04, to avoid having to compile anything from sources (for easier maintenance, later on, since I probably won't be the one maintaining this). I am also not sure whether there is a reliable (semi-official?) PPA with latest Dovecot. I saw this one ( https://launchpad.net/~mamarley/+archive/ubuntu/updates ) but I am not sure whether I can rely on it not breaking anything at some point. Thanks. On 03/16/2015 03:23 PM, Philipp wrote: > Am 16.03.2015 09:12 schrieb Vanja: >> doveadm_port = 12345 > >> plugin { >> mail_replica = 192.168.1.100 >> } > > would you try: > mail_replica = tcp:192.168.1.100:12345 > which works for me. > > check for firewall settings (both ways) anyway - and I can only advise > to go for 2.2.16; there have been > numerous fixes after 2.2.9 to the whole dsync/replica parts.

1 0

Overriding dovecot.conf from Userdb Extras
by E.B. 16 Mar '15

16 Mar '15

Hi, I thought I read that anything from dovecot.conf can be overridden in a userdb lookup. Or a passdb lookup with "userdb_" prefix. But I tried for fun change log_path but it never worked. Is that because logging is special, already started logging before it comes to the passdb/userdb lookups? So are there some dovecot.conf settings that cannot be overridden? Thanks!

3 4