- dovecot - dovecot.org

[Dovecot] force ciphers order for clients
by Robert Schetterer 15 Aug '13

15 Aug '13

Hi Timo, reading this http://www.kuketz-blog.de/perfect-forward-secrecy-mit-apple-mail/ it looks like DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA can be forced in use with apple mail ( if no ECDHE is possible ,by missing openssl 1.x etc, seems that apple mail tries ECDHE first if fails its going to use RSA-AES128-SHA ) force soltution as tried ssl_cipher_list = DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!CBC:!PSK:!SRP:!DSS:!SSLv2:!RC4 so far so good , it worked nice with recent thunderbird too but it fails with outlook 2003 pop3s / win7 so i thought about using an order like this ssl_cipher_list = DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ALL:!LOW:!SSLv2:!EXP:!aNULL does that makes sense ? ( using dove 2.1.x / openssl 0.9x ) Best Regards MfG Robert Schetterer -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

3 7

Re: [Dovecot] force ciphers order for clients
by Reindl Harald 14 Aug '13

14 Aug '13

Am 14.08.2013 22:04, schrieb Robert Schetterer: > Am 14.08.2013 21:30, schrieb Reindl Harald: >> Am 14.08.2013 21:19, schrieb Robert Schetterer: >>>>> thx Harald, upgrading openssl to 1.x and using dove 2.2.5 is no option >>>>> at my setup lucid ubuntu yeter >>>> >>>> so you can practically forget it >>> >>> perhaps true forever, as long old clients are around, cause the server >>> can only workaround them >> >> not absolutely >> >> playing around with the setings below and https://www.ssllabs.com/ssltest/ >> turned out that the order is what counts, and that is really tricky >> >> i played around 5 hours with this absoluetly crap > > that sounds good, so you allready did many real world tests yeah and the bad is that it prove *currently* it is imposible to have perfect forward secrecy for most real world clients without open other vectors leading to fall back to a yellow B really sad is that playing around turned out how hard it is to force different clients at the same time to a good cipher and how one change in the order refelcts the overall result and facing this: "ssllabs" simulates negotiation of real clients (skipped in the screenshot) but we are missing the same for mailservers and thats why my conclusion is that we are hopeless as admins and can only offer things but not do much in case of clients using them __________________________ attached the current results for our webservers the only positive from the current resullt is that the sever supports ciphers for "Perfect Forward Secrecy" and the negative that it is only theory, so i stay at this config and say "dear browser vendors, i support it so use it with your damned client" because i can hardly use a config which get a yellow CVSS on security-audits to support FS for you" well, i could reven aise up "key exchange" to 90/95 but after that "FS" would not be listed at all the real sad thing is that the "FS" you see is not used by current clients which mostly use RC4 and if you add !MEDIUM the most start using FS-ciphers but are vulerable by BEAST-attack which let you fall down to grade B if i add !MEDIUM to dovecot Thunderbird does no longer connect at all

1 1

[Dovecot] weird situation with pop3/imap proxy and postfix authentication
by Leonardo Rodrigues 14 Aug '13

14 Aug '13

Hello dovecot mailing list, I have a server running postfix and dovecot. I havea configuration on dovecot that allows me to provide imap4/pop3 messages for local hosted users as well as for proxied users on other servers. Basically, i have a simple MySQL table (imapproxy) with two fields, 'domain' and 'host'. My password_query isa 'UNION' query, exactly like: password_query=select endereco as user, password, '/var/spool/mail/%u' as userdb_home, 'maildir:/var/spool/mail/%u' as userdb_mail, 8 as userdb_uid, 12 as userdb_gid, concat('*:storage=', quota) as userdb_quota_rule, 'Trash:storage=+100M' as userdb_quota_rule2, 'Y' as proxy_maybe, '10.252.38.2' as host from emails where endereco = '%u' and ativa = '1' UNION select NULL as user, '%w' as password, NULL as userdb_home, NULL as userdb_mail, NULL as userdb_uid, NULL as userdb_gid, NULL as userdb_quota_rule, NULL as userdb_quota_rule2, 'Y' as proxy_maybe, imapproxy.host as host from imapproxy where imapproxy.dominio = '%d' the 10.252.38.2 address, on the query, is my local server when this query received a local user, from a domain that is NOT listed on the imapproxy table, results are like: *************************** 1. row *************************** user: localuser(a)domain.com.br password: (SSHA256 encrypted password) userdb_home: /var/spool/mail/localuser(a)domain.com.br userdb_mail: maildir:/var/spool/mail/localuser@domain.com.br userdb_uid: 8 userdb_gid: 12 userdb_quota_rule: *:storage=51200 userdb_quota_rule2: Trash:storage=+100M proxy_maybe: Y host: 10.252.38.2 when it receives a proxied domain, results are: *************************** 1. row *************************** user: NULL password: password userdb_home: NULL userdb_mail: NULL userdb_uid: NULL userdb_gid: NULL userdb_quota_rule: NULL userdb_quota_rule2: NULL proxy_maybe: Y host: 10.254.116.9 This is working just fine for IMAP4 and POP3 proxying. Local users (which domains are NOT listed on imapproxy table) can successfully login to their accountsas well as users from domains listed on imapproxy table can successfully login to their accounts. On SMTP authentication, tough, things are not so fine. SMTP authentication is provided by dovecot to postfix: [root@correio dovecot]# postconf mail_version mail_version = 2.7.1 [root@correio dovecot]# smtpd_sasl_auth_enable = yes smtpd_sasl_authenticated_header = yes smtpd_sasl_path = /var/spool/postfix/private/auth smtpd_sasl_security_options = noanonymous smtpd_sasl_type = dovecot service auth is defined on dovecot confs as: service auth { unix_listener auth-userdb { mode = 0600 user = mail group = mail } # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { mode = 0660 user = postfix group = postfix } } and it seems to be allowing ANYuser on any domain listed on the imapproxy table domains to login, even if the user does not exists or provides wrong password. In fact, it seems dovecot returns OK to postfix even without trying to contact the assigned server to that domain, as i cannot find any password-failed-specific log to that user on the specific server. Example: (a proxied domain) [root@correio dovecot]# telnet mail.proxieddomain.com.br 110 Trying 10.254.116.9... Connected to mail.proxieddomain.com.br (10.254.116.9). Escape character is '^]'. +OK Dovecot ready. user teste(a)proxieddomain.com.br +OK pass password -ERR Authentication failed. (i can successfully find this auth trial and fail on 10.254.116.9 logs) but on SMTP authentication, i have: [root@correio dovecot]# perl -MMIME::Base64 -e \ 'print encode_base64("teste\@proxieddomain.com.br\0teste\@proxieddomain.com.br\0password");' xxxxxxxxx(not the real encoded pass)xxxxxxxxxxxxxxxx= [root@correio dovecot]# [root@correio dovecot]# telnet localhost 587 Trying 127.0.0.1... Connected to localhost.localdomain (127.0.0.1). Escape character is '^]'. 220 mail.domain.com.br ESMTP EHLO test 250-mail.domain.com.br [ ... ] AUTH PLAIN (encoded string returned by perl encode_base64) 235 2.7.0 Authentication successful (and i cannot even find any authentication log, fail or success, on the specific server for proxieddomain.com.br) dovecot version is: [root@correio dovecot]# dovecot --version 2.2.2 [root@correio dovecot]# what am i doing wrong here ? How to have dovecot to really check users before giving OK to postfix on SMTP authentications ? Thanks for any hints ! -- Atenciosamente / Sincerily, Leonardo Rodrigues Solutti Tecnologia http://www.solutti.com.br Minha armadilha de SPAM, NÃO mandem email gertrudes(a)solutti.com.br My SPAMTRAP, do not email it

1 0

[Dovecot] Patch to log the cipher suite used for TLS
by Matthias Scheler 14 Aug '13

14 Aug '13

Hello, the attached patch for Dovecot 2.2.4 improves the logging to include information about the cipher suite used for a TLS connection. Here is an example log line: Aug 13 21:49:55 colwyn dovecot: imap-login: Login: user=<tron>, method=CRAM-MD5, rip=2001:8b0:114:1::2, lip=2001:8b0:114:1::2, mpid=10567, TLS=<TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)>, session=<ZkEhYtrjSgAgAQiwARQAAQAAAAAAAAAC> This will e.g. allow you to find out that mobile phones use rather week cipher suites (128bit keys, no PFS). There is also something else I noticed. If I switch "mutt" (which generated the above log line) from using IMAP on port 143 and "STARTTLS" to use IMAPS on port 993 I get TLS 1.2: Aug 14 07:44:59 colwyn dovecot: imap-login: Login: user=<tron>, method=CRAM-MD5, rip=2001:8b0:114:1::2, lip=2001:8b0:114:1::2, mpid=1156, TLS=<TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)>, session=<0js/suLj9gAgAQiwARQAAQAAAAAAAAAC> Not sure why TLS 1.2 is only used in this case. It might be "mutt" doing that. Kind regards -- Matthias Scheler http://zhadum.org.uk/

2 2

[Dovecot] SA54438
by Timo Sirainen 14 Aug '13

14 Aug '13

http://secunia.com/advisories/54438/ Since I already got 3 private mails about this, here's the same reply for everyone (actually updated, now that I looked at the code): This was a v2.2-only bug. And it isn't really a DoS.. It only caused the one pop3 process to crash in assert, which was handling only the connection that had already disconnected. (Unless you were running a non-recommended configuration with multiple clients per process.) So the only problem it caused was that Dovecot logged an assert error and maybe wrote a core dump.

3 2

[Dovecot] Dovecot security
by Jay Khashan 14 Aug '13

14 Aug '13

Hi, THIS IS URGENT I have Debian Linux machine which I installed as a mail server with postfix, and dovecot. my mail server is setup to use SMTP relay. I currently have ports 143, 995, 25 & SSMTP ports open. in the last few days I have been under attack where email is being sent to fake email address for example xxx(a)evg-mail.org which does not exist in the mysql db. I need to figure out and lock down dovecot, because I believe the attack is some kind of virus /spyware. I need to know what statement in dovecot.conf or main.cf (postfix) I can modify to lock it down. Also open to install software to combat this kind of attack. Let me know what configuration files, info do you need to help out Many Thanks ~Jay

4 3

[Dovecot] HG changes affecting received headers
by Thomas Leuxner 13 Aug '13

13 Aug '13

Let me say this is a rather cosmetic issue, but it appears with the latest commits (around 2.2.5 release) the scheme of 'Received' headers has changed for LMTP: 1) Inet socket: Return-Path: <dfn-adv-bounces(a)dfn-cert.de> Delivered-To: <tlx(a)leuxner.net> Received: from spectre.leuxner.net ([188.138.0.199]) by spectre.leuxner.net (Dovecot) with LMTP id 8AkXDF5cA1LvDgAAZ53dLw for <tlx(a)leuxner.net>; Thu, 08 Aug 2013 10:52:46 +0200 2) UNIX socket: Return-Path: <dfn-adv-bounces(a)dfn-cert.de> Delivered-To: <tlx(a)leuxner.net> Received: from spectre.leuxner.net ([]) by spectre.leuxner.net (Dovecot) with LMTP id q8WuGflcA1I3DwAAZ53dLw for <tlx(a)leuxner.net>; Thu, 08 Aug 2013 10:55:21 +0200 3) Old (Pre 2.2.5) build, UNIX socket: Return-Path: <dfn-adv-bounces(a)dfn-cert.de> Delivered-To: <tlx(a)leuxner.net> Received: from spectre.leuxner.net by spectre.leuxner.net (Dovecot) with LMTP id 8NiKKX0h+lFRIAAAZ53dLw for <tlx(a)leuxner.net>; Thu, 01 Aug 2013 10:51:09 +0200 While it probably should resolve the FQDN in 1) (Postfix does), not sure what it should do with a UNIX socket in 2). Previously as shown in 3) it had none of it... Thomas

2 5

[Dovecot] fail2ban
by Aldo Reset 13 Aug '13

13 Aug '13

hi dovecot filter for fail2ban do not match: dovecot: pop3-login: Aborted login (tried to use disallowed plaintext auth): user=<>, rip=67 dovecot filter: failregex = (?: pop3-login|imap-login): (?:Authentication failure|Aborted login \(auth failed|Aborted login \(tried to use disabled|Disconnected \(auth failed).*rip=(?P<host>\S*),.* bst regards.

2 2

[Dovecot] Can't take user info from an alternate file
by dave＠661.org 13 Aug '13

13 Aug '13

I'm positive I did everything right to get Dovecot to take usernames and passwords from /etc/dovecot/users, but it still goes for /etc/passwd and /etc/shadow. The format of /etc/dovecot/users is "alice:{PLAIN}plaintextpassword" Here's my "doveconf -n": # 2.0.19: /etc/dovecot/dovecot.conf # OS: Linux 3.2.0-51-virtual x86_64 Ubuntu 12.04.2 LTS auth_debug = yes auth_verbose = yes auth_verbose_passwords = plain hostname = papasmurf.foobar.com listen = * mbox_write_locks = fcntl passdb { args = scheme=PLAIN-MD5 username_format=%n /etc/dovecot/users driver = passwd-file } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0664 user = postfix } } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = </etc/ssl/private/dovecot.pem userdb { args = username_format=%n /etc/dovecot/users driver = passwd-file } I'm using Ubuntu Precise and version 2.0.19 of Dovecot. -- David Griffith dave(a)661.org

2 5

[Dovecot] Disconnected (no auth attempts)
by Eric Broch 12 Aug '13

12 Aug '13

Hello list, I have a user who is not able to 'get' email using the 'Get Mail' option in his Thunderbird Client. The error on the server is the following: [Dovecot] dovecot: imap-login: Disconnected (no auth attempts) : rip 192.168.7.7, lip 192.168.7.12, TLS This user is able to receive mail on his phone, however. What does this error mean? Eric <http://www.dovecot.org/list/dovecot/2012-January/062988.html>

2 1

Re: [Dovecot] Please HELP: how to delete all messages older than X days
by Răzvan Sandu 12 Aug '13

12 Aug '13

Pe 7 Aug 2013 11:35, Timo Sirainen a scris: >> Thank you, but doveadm expunge will ask for the mailbox name: >> >> [root@mail1 ~]# doveadm expunge -u john.doe(a)example.com ON >> 2013-08-07 doveadm(root): Fatal: expunge: To avoid accidents, >> search query must contain MAILBOX in all search branches > > Add: mailbox '*' Thank you, it works! May I use the same wildcard syntax ('*') when configuring the expire plugin? Something like: mail_plugins = $mail_plugins expire plugin { expire = * } or plugin { expire = '*' } ? Best regards, Răzvan

3 2

[Dovecot] Unlock non existent locks
by Thomas Hummel 12 Aug '13

12 Aug '13

Hello Timo, I'm running a single instance of dovecot-2.1.15 on a single host running 8.3-RELEASE-p3 FreeBSD amd64 mailboxes (Maildir), control files and indexes are on NFS (v3,tcp) mail_nfs_storage = yes lock_method = fcntl [didn't touch the following] # Mail index files also exist in NFS. Setting this to yes requires # mmap_disable=yes and fsync_disable=no. mail_nfs_index = yes served by an Isilon s200 node (OneFS 6.5.5.22) procmail delivers in the same location through postfix-2.8.7 The filer shows *a lot* of such messages : 2013-08-02T14:12:29+02:00 <0.5> XXXX-10(id10) /boot/kernel.amd64/kernel: [lkf_delegate.c:2752](pid 46390="kt: dwt3")(tid=101282) dev_local_lkf_unlock(): no lock entry present to unlock for resource: 1:19d5:fdbe ;client: 0xa51cc3f444107 Corresponding file may be a message, a maildir, an index, ... I can experience the same message with a simple fcntl C program which tries to unlock an NFS file without prior locking of it. However, the problem occurs only on a FreeBSD client (I tried the old nfs client and the new (mount_newnfs), not on a 2.6.32-358.11.1.el6.x86_64 CentOS release 6.4 (Final) Linux release. So my guess is that dovecot has some safety mechanism which tries to unlock locked files, maybe after some timeout and that, in the case of a an already unlocked file, the FreeBSD client sends the unlock RPC request to the server anyway whereas the linux client does not, noticing there isn't anything to unlock. Can you help me explaining such a behavior ? Are those "unlock a file with no prior lock" made on purpose or is it a bug ? Would it be an application or a RPC bug ? Can you think of another reason ? Thanks -- Thomas Hummel | Institut Pasteur <hummel(a)pasteur.fr> | Groupe Exploitation et Infrastructure

2 5

[Dovecot] Error: Threading lost Message ID?
by Ralf Hildebrandt 12 Aug '13

12 Aug '13

QUERY: THREAD REFERENCES ISO-8859-1 ALL RESPONSE: [SERVERBUG] Internal error occurred. Refer to server log for more information. [2013-08-09 15:42:34] Aug 9 15:41:48 postamt dovecot: imap(username) tTbs7oPjfACNKs4m: Error: Threading lost Message ID Aug 9 15:42:34 postamt dovecot: imap(username) tTbs7oPjfACNKs4m: Error: Threading lost Message ID What does that mean? WHY has the Message-Id been lost? How can I find out WHICH MAIL caused this? This is the most recent dovecot 2.2.x -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | http://www.charite.de

3 6

[Dovecot] GUID Mismatch Issue
by Jeff Geiger 12 Aug '13

12 Aug '13

Dovecot 2.1.7 While migrating mail from one server (Maildir) to another (mdbox), a config issue caused my dsync to fail on a few accounts. Those accounts received mail on the new server over night and it autocreated new inboxes with new GUIDs. Now dsync wants nothing to do with mirroring between the two (diff GUIDs). Is there a way to fix this? dsync(jeff(a)foo.bar): Error: Mailbox INBOX changed its GUID (0eee4b021dcadd5158550000eed085a1 -> 43f87412a8f00352ac340000be821591) dsync(jeff(a)foo.bar): Error: msg iteration failed: Couldn't open mailbox 0eee4b021dcadd5158550000eed085a1 dsync(jeff(a)foo.bar): Error: Mailbox INBOX changed its GUID (0eee4b021dcadd5158550000eed085a1 -> 43f87412a8f00352ac340000be821591) dsync(jeff(a)foo.bar): Error: Mailbox Trash changed its GUID (0fee4b021dcadd5158550000eed085a1 -> 6300df050ef10352e9350000be821591) dsync(jeff(a)foo.bar): Error: Mailbox Sent changed its GUID (832d1e3663cadd515f5d0000eed085a1 -> 855ef505c0f00352fc340000be821591) I need a way to merge the mailboxes, in either direction, so I can clear out one side and successfully migrate the mail accounts. Any tips or pointers are greatly appreciated.

2 1

[Dovecot] multiple passdbs and auth sockets
by md＠Linux.IT 12 Aug '13

12 Aug '13

I have a few systems which run dovecot 1.x as the authentication backend for Postfix, with multiple auth { } sections like this one, each one with a different passdb and its own socket: auth ldap-10 { passdb ldap { args = /etc/dovecot/dovecot-ldap-10.conf } socket listen { client { path = /var/spool/postfix/private/auth-10 mode = 0666 } } } I need multiple sockets tied to multiple dbs because there are duplicated accounts, but after switching to dovecot 2.1.7 apparently *all* passdbs are checked and dovecot reports this message: Warning: Obsolete setting in /etc/dovecot/conf.d/auth-local.conf.ext:91: add auth_ prefix to all settings inside auth {} and remove the auth {} section completely doveconf shows that all my custom sockets are now part of a single "service auth { }" section, while all the passdbs appear at the top level. How can I update my configuration for dovecot 2.x? -- ciao, Marco

2 1

[Dovecot] Errors in SASL authentication ("attempted master login")
by Grzegorz Staniak 12 Aug '13

12 Aug '13

Hi, I'm using dovecot 2.2.4 (with Postfix 2.8.4) as both the SASL authentication backend and the delivery agent, and I keep getting lines like the following in the dovecot.log from the authentication subsystem: auth: passdb(toshiba1(a)domain,8.8.8.8,master): Attempted master login with no master passdbs (trying to log in as user: plain) The connections come from an old (embedded) mail client in a printer-fax machine. I googled for this specific error, but I only found info about old clients using "user\0user\0pass" string incorrectly during authentication, which caused a problem for earlier, development versions of dovecot. Actually, I recently migrated from 1.2 to 2.2.4 exactly to alleviate this situation, but the errors persist. Is there a way to remove the problem or work around it? Regards, GS -- Grzegorz Staniak <gstaniak [at] gmail _dot_ com>

2 1

[Dovecot] The docs a re a bit weird on "Directory hashing"
by Eliezer Croitoru 12 Aug '13

12 Aug '13

In squid we use a double layer of hashed directories on the FS to allow storage of millions of files. I was reading the "Directory hashing" section but never understood it.. since it's written.. in a way I could not understand. I am using this line: mail_location = maildir:/home/vmail/%d/%n/Maildir/ and I want to migrate to a hash based directory scheme. While trying to understand how that hash will work I stumbled a old thread at: http://www.dovecot.org/list/dovecot/2010-June/049695.html there they used: mail_location=maildir:/buzones/us.es/%1Hu/%2.1u/%n so I assume it should be used like that: mail_location=maildir:/home/vmail/%H/%2.256Hn/%d_%n/Maildir/ or: mail_location=maildir:/home/vmail/%1Mu/%2.1Mu/%d_%n/Maildir/ It's a bit hard to think alone so I hope you can assist me. let say I want to follow the model of squid cache_dir which has: cache_dir aufs /usr/local/squid/var/cache/squid 40000 16 256 And means a two layers cache of max 16 directories on the first layer and 256 directories on the second layer. The above allows millions of files storage and can benefit from all ext4 lower kernel levels of compatibly rather then do stuff on the user-land.. Since I am not 100% sure that the scheme I understood is indeed what I think I assume the above will need a small correction. Eliezer

3 4

[Dovecot] prevent dovecot from modifying maildirs
by Felix Rubio Dalmau 11 Aug '13

11 Aug '13

Hi all, Is there any possibility to ask dovecot to write nothing to disk, something like a "read only" state, without shutting it down? I have set up a ZFS+postfix+dovecot mail server, and I need both postfix (postsuper -h ALL) and dovecot (¿?) to stop modifying the disk to create the snapshot to be saved. Does anybody has any idea on how to achieve this? Regards! Felix

5 10

[Dovecot] constant Log synchronization error's
by Kim Bisgaard 10 Aug '13

10 Aug '13

Hi, I am seeing constant "Log synchronization error"s in my logs. See later for an example. This is dovecot 2.2.4, pigeonhole 0.4.1, and postfix 2.10.1 (with mailbox_command = /usr/libexec/dovecot/deliver) on a Fedora 19 system. I am using packages from Atrpms so there are some patches applied - ask for details. The mailboxes have resently been moved from a i386 system. I have tried to manually do "doveadm force-resync" for all users, but the problem persists :-( Here are an example from a user which does not use sieve: 11:45:48 Y dovecot: imap-login: Login: user=<X>, method=PLAIN, rip=62.199.61.123, lip=192.168.0.5, mpid=21531, TLS, session=<XxDNm3XhdAA+xz17> 11:45:52 Y dovecot: imap-login: Login: user=<X>, method=PLAIN, rip=62.199.61.123, lip=192.168.0.5, mpid=21541, TLS, session=<UewQnHXhAwA+xz17> 11:45:54 Y dovecot: imap(X): Error: mdbox /var/mail/X/mdbox/mailboxes/INBOX/Streams/dbox-Mails: map uidvalidity mismatch (0 vs 1283330954) 11:45:54 Y dovecot: imap(X): Disconnected: Internal error occurred. Refer to server log for more information. [2013-07-14 11:45:54] in=353 out=115680 11:45:54 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/storage/dovecot.map.index 11:45:54 Y dovecot: imap(X): Warning: mdbox /var/mail/X/mdbox/storage: rebuilding indexes 11:45:54 Y dovecot: imap(X): Disconnected: Disconnected in IDLE in=707 out=437806 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=4,offset=156 for /var/mail/X/mdbox/mailboxes/INBOX/Kvitteringer/dbox-Mails/dovecot.index: Ex tension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/INBOX/Kvitteringer/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=9,offset=156 for /var/mail/X/mdbox/mailboxes/INBOX/Streams/dbox-Mails/dovecot.index: Extensi on header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/INBOX/Streams/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=13,offset=156 for /var/mail/X/mdbox/mailboxes/Facebook/dbox-Mails/dovecot.index: Extension h eader update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Facebook/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/Junk/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Junk/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/Sent/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Sent/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=4,offset=156 for /var/mail/X/mdbox/mailboxes/Drafts/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Drafts/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=4,offset=156 for /var/mail/X/mdbox/mailboxes/Archives/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Archives/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=62.199.61.123, lip=192.168.0.5, TLS, session=<dz05nHXh9wA+xz17> 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=4,offset=156 for /var/mail/X/mdbox/mailboxes/Archives/2012/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Archives/2012/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap-login: Login: user=<X>, method=PLAIN, rip=62.199.61.123, lip=192.168.0.5, mpid=21548, TLS, session=<bAs5nHXhfgA+xz17> 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/Trash/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Trash/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap(X): Error: Log synchronization error at seq=4,offset=156 for /var/mail/X/mdbox/mailboxes/Trash/Spam/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:55 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Trash/Spam/dbox-Mails/dovecot.index 11:45:55 Y dovecot: imap-login: Login: user=<X>, method=PLAIN, rip=62.199.61.123, lip=192.168.0.5, mpid=21552, TLS, session=<zCw7nHXh2AA+xz17> 11:45:55 Y dovecot: imap(X): Connection closed: Connection reset by peer in=118 out=111246 11:45:56 Y dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=62.199.61.123, lip=192.168.0.5, TLS, session=<Ov9MnHXhgwA+xz17> 11:45:56 Y dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=62.199.61.123, lip=192.168.0.5, TLS, session=<OK5RnHXhiAA+xz17> 11:45:56 Y dovecot: imap(X): Error: mdbox /var/mail/X/mdbox/mailboxes/INBOX/Streams/dbox-Mails: map uidvalidity mismatch (0 vs 1283330954) 11:45:56 Y dovecot: imap(X): Disconnected: Internal error occurred. Refer to server log for more information. [2013-07-14 11:45:56] in=353 out=115647 11:45:56 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/storage/dovecot.map.index 11:45:56 Y dovecot: imap(X): Warning: mdbox /var/mail/X/mdbox/storage: rebuilding indexes 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/INBOX/Kvitteringer/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/INBOX/Kvitteringer/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=10,offset=156 for /var/mail/X/mdbox/mailboxes/INBOX/Streams/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/INBOX/Streams/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=14,offset=156 for /var/mail/X/mdbox/mailboxes/Facebook/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Facebook/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=6,offset=156 for /var/mail/X/mdbox/mailboxes/Junk/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Junk/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=6,offset=156 for /var/mail/X/mdbox/mailboxes/Sent/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Sent/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/Drafts/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Drafts/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/Archives/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Archives/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/Archives/2012/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Archives/2012/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=6,offset=156 for /var/mail/X/mdbox/mailboxes/Trash/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Trash/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap(X): Error: Log synchronization error at seq=5,offset=156 for /var/mail/X/mdbox/mailboxes/Trash/Spam/dbox-Mails/dovecot.index: Extension header update points outside header size 11:45:57 Y dovecot: imap(X): Warning: fscking index file /var/mail/X/mdbox/mailboxes/Trash/Spam/dbox-Mails/dovecot.index 11:45:57 Y dovecot: imap-login: Login: user=<X>, method=PLAIN, rip=62.199.61.123, lip=192.168.0.5, mpid=21563, TLS, session=<gs9WnHXhcwA+xz17> 11:45:57 Y dovecot: imap(X): Connection closed: Connection reset by peer in=150 out=111316 11:45:57 Y dovecot: imap-login: Login: user=<X>, method=PLAIN, rip=62.199.61.123, lip=192.168.0.5, mpid=21568, TLS, session=<4y1hnHXhkQA+xz17> 11:46:05 Y dovecot: imap-login: Login: user=<X>, method=PLAIN, rip=62.199.61.123, lip=192.168.0.5, mpid=21574, TLS, session=<+zbNnHXhBAA+xz17> My config is: # dovecot -n # 2.2.4: /etc/dovecot/dovecot.conf # OS: Linux 3.9.9-301.fc19.x86_64 x86_64 Fedora release 19 (Schrödinger’s Cat) ext4 mail_location = mdbox:/var/mail/%u/mdbox mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { driver = pam } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +imapflags sieve_subaddress_sep = - } postmaster_address = postmaster(a)alleroedderne.adsl.dk protocols = imap recipient_delimiter = - ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { driver = passwd } protocol lda { mail_plugins = " sieve" } Regards, Kim

3 3

[Dovecot] Mailbox Format
by Vijay Rajah 10 Aug '13

10 Aug '13

Hello List, I'm in the process of implementing a new mail server environment from scratch. I was wondering, what mailbox format is recommended? I have been using maildir format for my other projects. I would like to use some format that provides Single Instance Storage. I'm using postfix 2.11 and will use lmtp. I will be using dovecot 2.2.5 (Latest) version. I'm not planning on using NFS (if that matters) and will use dsync to backup mails to another server. Thanks in Advance Vijay Rajah

1 0

Re: [Dovecot] prevent dovecot from modifying maildirs
by Joseph Tam 10 Aug '13

10 Aug '13

> In order to save space I prefer no to have such half-files (mails) , > and it is for this reason that I am asking if there is any way to > prevent this. > > I'm not an expert in field of file systems, so I can be asking very > naive questions... but I appreciate your comments on this topic. Filesystem consistency is different than, for lack of a better term, dovecot consistency. The latter places additional constraints on the content of files, rather than treating them as sequences of disk blocks. I don't think you can ensure the latter without stopping all dovecot processes (and maybe the MTA/LDA as well), which will be much more difficult and disruptive than just taking a snapshot. (I think some snapshot aware application like databases and hypervisors allows the operator to put the application in a state of acquiesence, long enough to take a snapshot, then unblock all processes after the snapshot.) I'd take the suggestion of the previous poster: take snapshots, don't worry, be happy. The small amount of inconsistencies is trivial compared with quickly recovering a mail store after disaster. Joseph Tam <jtam.home(a)gmail.com>

1 0

Re: [Dovecot] How to troubleshoot LDA or LMTP?
by Joseph Tam 10 Aug '13

10 Aug '13

John Williams writes: > *What doesn't work* I thought the next step would be to execute > dovecot-lda manually (as is suggested on the wiki and in numerous > newsgroup posts), but I can't figure out how to do this. When I execute > it as root and provide my non-root username via the -u option, it > hangs. I can see that it spawns a child process that executes as the > non-root user (specified with the -u option). So, could someone tell > how to execute dovecot-lda manually please? Maybe use "-d"? I had no trouble invoking dovecot-lda -c config-file -d user < mailfile If it doesn't work for you, I suggest process tracing it. > Also, when does LMTP process messages? When sending mail via SMTP, or > when reading mail via IMAP? I would prefer to use LMTP rather than > LDA. The former. Joseph Tam <jtam.home(a)gmail.com>

4 6

[Dovecot] execvp /usr/local/libexec/dovecot/dovecot-lda: Permission denied
by Edward Carraro 09 Aug '13

09 Aug '13

I'm trying to follow the instructions for configuring Dovecot LMTP with postfix for virtual domains but whenever mail arrives, in /var/log/maillog, I see Sep 23 16:01:20 mybox postfix/pipe[572]: 999C83206C6: to=< user(a)mytest.domain.com>, relay=dovecot, delay=0.08, delays=0.04/0.01/0/0.03, dsn=4.3.0, status=deferred (temporary failure. Command output: pipe: fatal: pipe_command: execvp /usr/local/libexec/dovecot/dovecot-lda: Permission denied ) ls -lh for /usr/local/libexec/dovecot/dovecot-lda -rwxr-xr-x 1 root staff 62K Sep 20 15:15 dovecot-lda It will deliver mail when I do the sudo invocation of dovecot-lda, but I thought LMTP was suppose to be an alternative to that postfix/main.cf: virtual_transport = dovecot virtual_mailbox_domains = mytest.domain.com dovecot_destination_recipient_limit = 1 /etc/postfix/master.cf: dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} /usr/local/etc/dovecot/conf.d/10-master.conf: service auth { unix_listener auth-userdb { mode = 0600 user = vmail #group = vmail } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } inet_listener lmtp { port = 24 } user = vmail } Did I miss something in my config?

7 9

[Dovecot] Getting default uid/gid of users via socket for virtual user support for sendmail
by Steffen Kaiser 09 Aug '13

09 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm trying to make my life easier with sendmail and virtual users. For that I'd like to pass sendmail the home directory and uid/gid for each user. The user data is storred in a LDAP,& I retrieve it from the auth-userdb socket fine. If I add uid / gid to each user, I get them via that socket as well, but is there a way I get the default uid/gid? I mean, without calling an external program, such as doveadm. There is an "initialize" phase, so the default information is retrieved just once per lifetime of the demon, but each time the sendmail binary is invoked. Kind regards, - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iQEVAwUBUfp2JF3r2wJMiz2NAQL61Af+MuF1BTwaX+Tm+rOWe+smcVUzRmMYZdtL J08wDGNB2EyQ9a0zXwZleO/X3Jvaqr8HSHaC6oTzliS25yqPT4AYG0VVswZoyDTg hggyS9kVse2R1koLZKPAM1EatTmpTsKfUKDjsB3cxbYsBU5NYMJY+u4YATPTl7ui 46K4YmeL4xkKirRXc7j0fIMxdXttuD9zPq20qJ0p41HK2W0ECVHeQpUahozWY45h DREbwdZBZe9PeZNbfOYTLWnxPi1/FK/AX20QH3y3uxEhgMDfYAUHNwAleSCpack5 JEuVYwTPchxsH6uibk62qIsK/uWO3vZM0Zj18S0BBWDNvPhg0Nz92w== =abqh -----END PGP SIGNATURE-----

2 3

[Dovecot] Override master service settigs with spaces
by Ulrich Zehl 08 Aug '13

08 Aug '13

I'd like to override one setting for a master service in conf.d/10-master.conf. Unfortunately, said setting contains spaces, and I do not know how to escape them properly. Here's what I've tried so far. (Note: This is just the easiest/silliest test case I could come up with; not the actual setting or service I want to overwrite.) conf.d/10-master.conf: service quota-status { executable = quota-status -p postfix -o plugin/quota_status_success=Testing 1 2 3 inet_listener { port = 12340 } } Reaction: $ printf "recipient=test(a)example.org\nsize=0\n\n" | nc 127.0.0.1 12340 action=Testing conf.d/10-master.conf: service quota-status { executable = quota-status -p postfix -o "plugin/quota_status_success=Testing 1 2 3" inet_listener { port = 12340 } } Reaction: $ printf "recipient=test(a)example.org\nsize=0\n\n" | nc 127.0.0.1 12340 action=DUNNO [<-- This is the default setting] conf.d/10-master.conf: service quota-status { executable = quota-status -p postfix -o 'plugin/quota_status_success=Testing 1 2 3' inet_listener { port = 12340 } } Reaction: $ printf "recipient=test(a)example.org\nsize=0\n\n" | nc 127.0.0.1 12340 action=DUNNO [<-- This is the default setting] conf.d/10-master.conf: service quota-status { executable = quota-status -p postfix -o plugin/quota_status_success="Testing 1 2 3" inet_listener { port = 12340 } } Reaction: $ printf "recipient=test(a)example.org\nsize=0\n\n" | nc 127.0.0.1 12340 action="Testing [<-- Note the " after = ] conf.d/10-master.conf: service quota-status { executable = quota-status -p postfix -o plugin/quota_status_success=Testing\ 1\ 2\ 3 inet_listener { port = 12340 } } Reaction: $ printf "recipient=test(a)example.org\nsize=0\n\n" | nc 127.0.0.1 12340 action=Testing\ [<-- Note the \ ] I'm out of ideas now. What's the correct way to quote / escape these options?

3 4