- dovecot - dovecot.org

Non Existent User Login Attempts
by Bryan Simmons 07 Jan '26

07 Jan '26

Log contains several messages from dovecot that are not clear to me exactly what is occurring, single example below. These appear to be login attempts for the same group of non existent user ids from various rip addresses. Am I interpreting these correctly and, if so, is there any issue with just ignoring them? dovecot: pop3-login: Disconnected: Connection closed (auth failed, 1 attempts in 0 secs): user=<non-existent-user(a)example.net>, rip=0.0.0.0 Thank you, Bryan

6 6

How can I use /etc/passwd auth for linux users and a passwd-file for virtual mailbox users?
by Ethan Merrill 06 Jan '26

06 Jan '26

Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [This documentation page](https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html) describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: > ## Snippet from /etc/dovecot/dovecot.conf ## > passdb passwd-file { > # So example.net => /etc/dovecot/passwd/example.net > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to PAM for unix users > passdb pam { > } > > userdb passwd-file { > passwd_file_path = /etc/dovecot/passwd/%{user | domain} > } > # Fall thru to /etc/passwd for unix users > userdb passwd { > } > > ## Snippet from /etc/dovecot/passwd/example.net ## > support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [This thread](https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thre… is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: > # journalctl -xeu dovecot | tail > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:19 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown > Dec 29 11:38:28 example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot ruser=user(a)example.net rhost=10.0.0.1 > Dec 29 11:41:19 example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill Hello, I hope this is the right mailing list to send questions to. Please direct me where to go if it is not. Thanks. --- I am setting up a postfix/dovecot email server on a Debian 13 VPS. Dovecot is v2.4.1. I have thus far been able to successfully configure the server for smtp and imap support for my primary domain (we'll say `user(a)example.com` who is a linux user with a home folder). I have been even been able to configure postfix to have virtual mailboxes and aliases, and from ssh I can can even see that the mail gets delivered to the correct place. However, I am struggling to set up dovecot to authenticate a virtual mailbox user (we'll say `user(a)example.net` who only has a virtual mailbox). [1]This documentation page describes the process to configure multiple authentication databases. It describes being able to use multiple `passdb` and `userdb` sections in order to authenticate dovecot users. Based upon what it suggested, I tried this configuration: ## Snippet from /etc/dovecot/dovecot.conf ## passdb passwd-file { # So [2]example.net => /etc/dovecot/passwd/example.net passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to PAM for unix users passdb pam { } userdb passwd-file { passwd_file_path = /etc/dovecot/passwd/%{user | domain} } # Fall thru to /etc/passwd for unix users userdb passwd { } ## Snippet from /etc/dovecot/passwd/example.net ## [3]support@example.net:$y$j9...hash...:800:800::/var/postfix/virtual/example.net/support:: This is the configuration I landed on that hypothetically checks multiple databases for authentication that allows at least `user(a)example.com` to still login with Thunderbird and do email stuff. However it does not authenticate `user(a)example.net`. The biggest difference between my config and the example is that they use a `sql` database while I am trying the `passwd-file` database. In principle this seems like it should work, unless I am understanding the dovecot docs or have made my passwd file incorrectly. I even tried reversing the order of `userdb` and `passdb` sections to see if it would help to no avail. [4]This thread seems to address a similar issue, and more or less has the same configuration setup suggested as the one in the snippet above. It's also from 2006 so the API looks kinda different from the current docs. [5]This thread is from 2013 addressing a similar issue, but despite again different API it translates to more or less what the snippet above shows. Here is the journalctl output from when I tried to login as `user(a)example.net`: # journalctl -xeu dovecot | tail Dec 29 11:38:19 [6]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:19 [7]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [8]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:38:28 [9]example.com auth[4719]: pam_unix(dovecot:auth): check pass; user unknown Dec 29 11:38:28 [10]example.com auth[4719]: pam_unix(dovecot:auth): authentication failure; logname= uid=0 euid=0 tty=dovecot [11]ruser=user(a)example.net rhost=10.0.0.1 Dec 29 11:41:19 [12]example.com dovecot[4700]: imap-login: Login aborted: Inactivity (auth failed, 2 attempts in 180 secs) (auth_failed): user=<[13]user(a)example.net>, method=LOGIN, rip=10.0.0.1, lip=10.0.0.2, TLS, session=<z8Tj3hlHkLxJMmuL> The last message referring to "Inactivity" is because at that point fail2ban blocked my IP, but before that it was consistent with results I have been getting. I'm at an absolute loss. I feel like I've trawled every doc I could find, every config file involved in the setup process, all the Stack Exchange answers that seem to exist. Honestly it baffles me to see that even what looks like the same setup as official documentation, it just doesn't... work? Can anybody point to me what is going wrong? Thanks for reading, ~ Ethan Merrill References Visible links 1. This documentation page https://doc.dovecot.org/2.4.2/core/config/auth/mutltiple.html 2. http://example.net/ 3. mailto:support@example.net 4. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/VMXU2… 5. This thread https://dovecot.org/mailman3/archives/list/dovecot@dovecot.org/thread/YO3DF… 6. http://example.com/ 7. http://example.com/ 8. mailto:ruser=user@example.net 9. http://example.com/ 10. http://example.com/ 11. mailto:ruser=user@example.net 12. http://example.com/ 13. mailto:user@example.net

6 10

Putting a file in a shared namespace causes Panic in quota.c
by Christopher V. 06 Jan '26

06 Jan '26

Dear all, I guess I found a bug. I'm currently testing a migration of my Debian based dovecot bare metal installation from 2.3.19 --> 2.4.1 I'm using shared mailboxes. My understanding from the documentation is: "Quota plugin considers shared namespaces against owner's quota" and "The quota limits are also taken from the userdb." The following setup leads to a "Panic: file quota.c": * Quota is defined per-user and defined in a MySQL Database (and looked up as part of userdb) * User A shares directory "Inbox/teilemich" with user B. * User B has full access rights (details see below) * User A has a quota of 100MB - currently using 60% * User B has a quota of 4GB - currently using 550MB * User A puts mail xyz in the shared directory --> works * User B puts mail abc in the shared directory --> error message (see below) and mail is not stored. Defining the following not-overwritable global quota > 550 MB eliminates the error message. Defining a global quota < 550 MB still leads to the error message. quota "User quota" { storage_size = 560M storage_grace = 10M } Defining an overwritable global quota that is > 550 MB still leads to the error message. quota_storage_size = 560M quota "User quota" { storage_grace = 10M } Can you please check, if this is a bug? If you need some details I'm happy to provide it. Also - I would be very grateful for a workaround / fix. Thanks for all the effort & Best regards, Christopher ----------------------------------------------------- Detailed error message: ==================== Jan 04 17:27:25 <Servername> dovecot[135430]: imap(test@<Servername>.de)<135441><JJetaZJH7O1P12UP>: Panic: file quota.c: line 512 (quota_root_is_visible): assertion failed: (box->list->ns->type == MAIL_NAMESPACE_TYPE_SHARED) Jan 04 17:27:25 <Servername> dovecot[135430]: imap(test@<Servername>.de)<135441><JJetaZJH7O1P12UP>: Error: Raw backtrace: #1 [unw_get_proc_name() failed: -10] -> #2 [unw_get_proc_name() failed: -10] -> #3 i_panic[0x7fa1b4c655e6] -> #4 [unw_get_proc_name() failed: -10] -> #5 [unw_get_proc_name() failed: -10] -> #6 quota_test_alloc[0x7fa1b45a7850] -> #7 quota_try_alloc[0x7fa1b45aa4e0] -> #8 [unw_get_proc_name() failed: -10] -> #9 mailbox_save_finish[0x7fa1b508c7f0] -> #10 mail_storage_copy[0x7fa1b507e670] -> #11 [unw_get_proc_name() failed: -10] -> #12 [unw_get_proc_name() failed: -10] -> #13 [unw_get_proc_name() failed: -10] -> #14 [unw_get_proc_name() failed: -10] -> #15 [unw_get_proc_name() failed: -10] -> #16 mailbox_move[0x7fa1b508cc10] -> #17 [unw_get_proc_name() failed: -10] -> #18 command_exec[0x55da1ef57080] -> #19 [unw_get_proc_name() failed: -10] -> #20 [unw_get_proc_name() failed: -10] -> #21 [unw_get_proc_name() failed: -10] -> #22 client_handle_input[0x55da1ef5d990] -> #23 client_input[0x55da1ef5ded0] -> #24 io_loop_call_io[0x7fa1b4d51710] -> #25 io_loop_handler_run_internal[0x7fa1b4d534b0] -> #26 io_loop_handler_run[0x7fa1b4d53640] -> #27 io_loop_run[0x7fa1b4d53820] -> #28 master_service_run[0x7fa1b4ca6330] -> #29 main[0x55da1ef48880] -> #30 [unw_get_proc_name() failed: -10] -> #31 __libc_start_main[0x7fa1b4e52ce0] -> #32 _start[0x55da1ef48f30] Jan 04 17:27:25 <Servername> dovecot[135430]: imap(test@<Servername>.de)<135441><JJetaZJH7O1P12UP>: Fatal: master: service(imap): child 135441 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Output of "doveadm acl get -A inbox/teilemich": ======================================= Username ID Global Rights <user A> user=<user B> admin create delete expunge insert lookup post read write write-deleted write-seen Output of "doveconf -a": ==================== # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.12.57+deb13-cloud-amd64 x86_64 Debian 13.2 ext4 # Hostname: <Servername> # 4 default setting changes since version 2.4.0 dovecot_config_version = 2.4.0 # NOTE: Send doveconf -n output instead when asking for help. acl_cache_ttl = 30 secs acl_defaults_from_inbox = no acl_driver = vfile acl_global_path = acl_globals_only = no acl_groups = acl_id = acl_ignore = no acl_rights = acl_user = %{master_user} apparmor_hats = auth_allow_cleartext = no auth_allow_weak_schemes = no auth_anonymous_username = anonymous auth_cache_negative_ttl = 180 seconds auth_cache_size = 1024 auth_cache_ttl = 180 seconds auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_domain = <servername> auth_failure_delay = 2 secs auth_gssapi_hostname = auth_internal_failure_delay = 2 secs auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain login auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = auth_policy_server_api_header = auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %{user|lower} auth_verbose = no auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth charset_aliases = compress_bz2_block_size_100k = 9 compress_deflate_level = 6 compress_gz_level = 6 compress_zstd_level = 3 crypt_acl_require_secure_key_sharing = no crypt_global_public_key_file = crypt_private_key_file = crypt_private_key_name = crypt_private_key_password = crypt_user_key_curve = crypt_user_key_password = crypt_user_key_require_encrypted = no crypt_write_algorithm = aes-256-gcm-sha256 debug_log_path = default_client_limit = 1000 default_idle_kill_interval = 1 mins default_internal_group = dovecot default_internal_user = dovecot default_login_user = dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%{msgid}: %{message} dict_driver = dict_file_lock_method = dotlock dict_file_path = dict_map_expire_field = dict_map_key_field_name = dict_map_key_field_type = string dict_map_key_field_value = dict_map_ldap_filter = dict_map_pattern = dict_map_sql_table = dict_map_username_field = dict_map_value = dict_map_value_field_name = dict_map_value_field_type = string dict_name = dict_proxy_idle_timeout = 0 dict_proxy_name = dict_proxy_slow_warn = 5 secs dict_proxy_socket_path = dict dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dovecot_storage_version = 2.4.0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%{user} -U event_exporter_driver = log event_exporter_file_path = event_exporter_format = event_exporter_http_post_url = event_exporter_name = event_exporter_time_format = rfc3339 event_exporter_unix_connect_timeout = 250 ms event_exporter_unix_path = execute_args = execute_driver = unix execute_fork_path = execute_name = execute_tcp_host = execute_tcp_port = 0 execute_unix_socket_path = fifo_listener_group = fifo_listener_mode = 0600 fifo_listener_path = fifo_listener_type = fifo_listener_user = first_valid_gid = 1 first_valid_uid = 500 fs_compress_read_plain_fallback = no fs_compress_write_method = fs_crypt_read_plain_fallback = no fs_dict_value_encoding = raw fs_driver = fs_name = fs_posix_accurate_mtime = no fs_posix_fsync = yes fs_posix_lock_method = flock fs_posix_mode = 0600 fs_posix_prefix = fs_randomfail_ops = fs_sis_queue_path = fts_autoindex = yes fts_autoindex_max_recent_msgs = 999 fts_decoder_driver = fts_decoder_script_socket_path = fts_decoder_tika_url = fts_driver = fts_flatcurve_commit_limit = 500 fts_flatcurve_min_term_size = 2 fts_flatcurve_optimize_limit = 10 fts_flatcurve_rotate_count = 5000 fts_flatcurve_rotate_time = 5 secs fts_flatcurve_substring_search = no fts_header_excludes = fts_header_includes = fts_message_max_size = unlimited fts_search = yes fts_search_add_missing = yes fts_search_read_fallback = yes fts_search_timeout = 30 secs haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = http_client_connect_timeout = 0 http_client_delete_request_max_attempts = 0 http_client_delete_request_timeout = 0 http_client_max_connect_attempts = 0 http_client_max_idle_time = 0 http_client_max_parallel_connections = 1 http_client_max_pipelined_requests = 1 http_client_proxy_password = http_client_proxy_socket_path = http_client_proxy_ssl_tunnel = yes http_client_proxy_url = http_client_proxy_username = http_client_rawlog_dir = http_client_read_request_max_attempts = 0 http_client_read_request_timeout = 0 http_client_request_absolute_timeout = 0 http_client_request_max_attempts = 1 http_client_request_max_redirects = 0 http_client_request_timeout = 1 mins http_client_write_request_max_attempts = 0 http_client_write_request_timeout = 0 http_server_max_client_idle_time = 0 http_server_max_pipelined_requests = 1 http_server_rawlog_dir = imap_acl_allow_anyone = no imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 5s imap_id_retain = no imap_id_send = imap_literal_minus = no imap_logout_format = in=%{input} out=%{output} deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%{input} out=%{output} imap_urlauth_port = 143 imap_urlauth_stream_user = imap_urlauth_submit_user = imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_connection_timeout_interval = 30 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = unlimited imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_user = %{owner_user} imapsieve_expunge_discarded = no imapsieve_from_name = imapsieve_url = import_environment = inet_listener_haproxy = no inet_listener_name = inet_listener_port = 0 inet_listener_reuse_port = no inet_listener_ssl = no inet_listener_type = info_log_path = instance_name = dovecot language_default = no language_filter_normalizer_icu_id = Any-Lower; NFKD; [: Nonspacing Mark :] Remove; NFC; [\x20] Remove language_filter_stopwords_dir = /usr/share/dovecot/stopwords language_filters = normalizer-icu snowball stopwords language_name = language_tokenizer_address_token_maxlen = 250 language_tokenizer_generic_algorithm = simple language_tokenizer_generic_explicit_prefix = no language_tokenizer_generic_token_maxlen = 30 language_tokenizer_generic_wb5a = no language_tokenizers = generic email-address last_login_key = # hidden, use -P to show it last_login_precision = s last_valid_gid = 0 last_valid_uid = 0 lazy_expunge_mailbox = lazy_expunge_only_last_instance = no lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To ldap_auth_dn = ldap_auth_dn_password = ldap_auth_sasl_authz_id = ldap_auth_sasl_mechanisms = ldap_auth_sasl_realm = ldap_base = ldap_debug_level = 0 ldap_deref = never ldap_max_idle_time = 0 ldap_scope = subtree ldap_starttls = no ldap_timeout = 30 secs ldap_uris = ldap_version = 3 listen = lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_log_format = %{message}: %{elements} login_log_format_elements = user=<%{user}> method=%{mechanism} rip=%{remote_ip} lip=%{local_ip} mpid=%{mail_pid} %{secured} session=<%{session}> login_plugin_dir = /usr/lib/dovecot/modules/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_rawlog_dir = login_proxy_timeout = 30 secs login_socket_path = login_source_ips = login_trusted_networks = lua_file = lua_settings = mail_access_groups = mail_alt_path = mail_always_cache_fields = mail_attachment_detection_options = mail_cache_fields = mail_chroot = mail_compress_write_method = mail_control_path = mail_debug = no mail_driver = Maildir mail_ext_attachment_min_size = 128 k mail_ext_attachment_path = mail_fsync = optimized mail_full_filesystem_access = no mail_gid = vmail mail_home = /var/spool/dovecot/%{user|domain}/%{user|username}/home mail_inbox_path = mail_index_path = mail_index_private_path = mail_log_cached_only = no mail_log_events = mail_log_fields = mail_log_prefix = "%{service}(%{user})<%{process:pid}><%{session}>: " mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = mail_nfs_index = no mail_nfs_storage = no mail_path = /var/spool/dovecot/%{user|domain}/%{user|username}/mail mail_plugin_dir = /usr/lib/dovecot/modules mail_plugins { acl = yes quota = yes fts = yes fts_flatcurve = yes quota_clone = yes } mail_prefetch_count = 0 mail_privileged_group = mail mail_server_admin = mailto:admin@<servername> mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = vmail mail_utf8_extensions = no mail_volatile_path = mail_vsize_bg_after_count = 0 mailbox_auto = no mailbox_autoexpunge = 0 mailbox_autoexpunge_max_mails = 0 mailbox_comment = mailbox_directory_name_legacy = yes mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_prefix = dovecot.list.index mailbox_list_index_very_dirty_syncs = no mailbox_list_layout = fs mailbox_list_storage_escape_char = mailbox_list_visible_escape_char = mailbox_name = mailbox_notify_status = no mailbox_special_use = maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%{input}/%{output} managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = managesieve_sieve_capability = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_read_locks = mbox_very_dirty_syncs = no mbox_write_locks = mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M metric_description = metric_exporter = metric_exporter_include = metric_fields = metric_filter = metric_group_by_field = metric_group_by_method_discrete_modifier = metric_group_by_method_exponential_base = 10 metric_group_by_method_exponential_max_magnitude = 0 metric_group_by_method_exponential_min_magnitude = 0 metric_group_by_method_linear_max = 0 metric_group_by_method_linear_min = 0 metric_group_by_method_linear_step = 0 metric_group_by_method_method = discrete metric_name = mmap_disable = no mysql_client_flags = 0 mysql_connect_timeout = 5 secs mysql_connection_limit = 5 mysql_dbname = mysql_host = mysql_option_file = mysql_option_group = client mysql_password = mysql_port = 0 mysql_read_timeout = 30 secs mysql_ssl = no mysql_user = mysql_write_timeout = 30 secs namespace_alias_for = namespace_disabled = no namespace_hidden = no namespace_ignore_on_failure = no namespace_inbox = no namespace_list = yes namespace_name = namespace_order = 0 namespace_prefix = namespace_separator = namespace_subscriptions = yes namespace_type = private notify_status_value = {"messages":%{messages},"unseen":%{unseen}} oauth2_active_attribute = oauth2_active_value = oauth2_client_id = oauth2_client_secret = oauth2_fields = oauth2_force_introspection = no oauth2_grant_url = oauth2_introspection_mode = oauth2_introspection_url = oauth2_issuers = oauth2_openid_configuration_url = oauth2_scope = oauth2_send_auth_headers = no oauth2_tokeninfo_url = oauth2_use_worker_with_mech = no oauth2_username_attribute = email oauth2_username_validation_format = %{user} passdb_default_password_scheme = PLAIN passdb_deny = no passdb_driver = passdb_fields = passdb_fields_import_all = yes passdb_master = no passdb_mechanisms_filter = passdb_name = passdb_pam_failure_show_msg = no passdb_pam_max_requests = 100 passdb_pam_service_name = dovecot passdb_pam_session = no passdb_pam_setcred = no passdb_result_failure = continue passdb_result_internalfail = continue passdb_result_success = return-ok passdb_skip = never passdb_sql_query = passdb_sql_update_query = passdb_static_password = passdb_use_cache = yes passdb_use_worker = no passdb_username_filter = passwd_file_path = pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%{top_count}/%{top_bytes}, retr=%{retr_count}/%{retr_bytes}, del=%{deleted_count}/%{deleted_bytes}, size=%{message_bytes} pop3_migration_all_mailboxes = no pop3_migration_ignore_extra_uidls = no pop3_migration_ignore_missing_uidls = no pop3_migration_mailbox = pop3_migration_skip_size_check = no pop3_migration_skip_uidl_cache = no pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %{uid | hex(8)}%{uidvalidity | hex(8)} pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %{user} postmaster_address = postmaster@%{user|domain|default(hostname)} process_shutdown_filter = protocols { imap = yes lmtp = yes sieve = yes } push_notification_driver = push_notification_name = push_notification_ox_cache_ttl = 1 mins push_notification_ox_url = push_notification_ox_user_from_metadata = no quota_clone_unset = no quota_driver = count quota_enforce = yes quota_exceeded_message = Quota exceeded (mailbox for user is full) quota_fs_message_limit = no quota_fs_mount_path = quota_fs_type = any quota_full_tempfail = yes quota_hidden = no quota_ignore = no quota_ignore_unlimited = no quota_imapc_mailbox_name = INBOX quota_imapc_root_name = quota_mail_size = unlimited quota_mailbox_count = unlimited quota_mailbox_message_count = unlimited quota_message_count = unlimited quota_message_percentage = 100 quota_name = quota_over_status_current = quota_over_status_lazy_check = no quota_over_status_mask = quota_status_nouser = REJECT Unknown user quota_status_overquota = 554 5.2.2 %{error} quota_status_success = OK quota_status_toolarge = quota_storage_extra = 0 quota_storage_grace = 10 M quota_storage_percentage = 100 quota_storage_size = 50M quota_warning_name = quota_warning_resource = storage quota_warning_threshold = over rawlog_dir = recipient_delimiter = + redis_db_id = 0 redis_expire = 0 redis_host = 127.0.0.1 redis_key_prefix = redis_password = redis_port = 6379 redis_request_timeout = 30 secs redis_socket_path = rejection_reason = Your message to <%{to}> was automatically rejected:%{literal('\r\n')}%{reason} rejection_subject = Rejected: %{subject} sendmail_path = /usr/sbin/sendmail service_chroot = service_client_limit = 0 service_drop_priv_before_exec = no service_executable = service_extra_groups = service_group = service_idle_kill_interval = 0 service_name = service_privileged_group = service_process_limit = 0 service_process_min_avail = 0 service_protocol = service_restart_request_count = unlimited service_type = service_user = service_vsz_limit = 0 shutdown_clients = yes sieve_duplicate_default_period = 12 hours sieve_duplicate_max_period = 2 days sieve_editheader_header_forbid_add = no sieve_editheader_header_forbid_delete = no sieve_editheader_header_name = sieve_editheader_max_header_size = 2 k sieve_enabled = yes sieve_environment = sieve_execute_bin_dir = sieve_execute_exec_timeout = 10 secs sieve_execute_input_eol = crlf sieve_execute_socket_dir = sieve_extensions { fileinto = yes reject = yes envelope = yes encoded-character = yes vacation = yes subaddress = yes comparator-i;ascii-numeric = yes relational = yes regex = yes imap4flags = yes copy = yes include = yes body = yes variables = yes enotify = yes environment = yes mailbox = yes date = yes index = yes ihave = yes duplicate = yes mime = yes foreverypart = yes extracttext = yes editheader = no spamtest = yes mboxmetadata = yes virustest = yes } sieve_filter_bin_dir = sieve_filter_exec_timeout = 10 secs sieve_filter_input_eol = crlf sieve_filter_socket_dir = sieve_global_extensions = sieve_implicit_extensions = sieve_include_max_includes = 255 sieve_include_max_nesting_depth = 10 sieve_max_actions = 32 sieve_max_cpu_time = 0 sieve_max_redirects = 4 sieve_max_script_size = 1 M sieve_notify_mailto_envelope_from = sieve_pipe_bin_dir = sieve_pipe_exec_timeout = 10 secs sieve_pipe_input_eol = crlf sieve_pipe_socket_dir = sieve_plugin_dir = /usr/lib/dovecot/modules/sieve sieve_plugins = sieve_quota_script_count = 0 sieve_quota_storage_size = 0 sieve_redirect_duplicate_period = 43200 sieve_redirect_envelope_from = sieve_report_from = sieve_resource_usage_timeout = 1 hours sieve_script_active_path = sieve_script_bin_path = sieve_script_cause = sieve_script_driver = file sieve_script_ldap_filter = sieve_script_ldap_modified_attribute = sieve_script_ldap_script_attribute = sieve_script_name = sieve_script_path = sieve_script_precedence = unlimited sieve_script_storage = sieve_script_type = personal sieve_spamtest_score_max_header = sieve_spamtest_score_max_value = sieve_spamtest_status_header = sieve_spamtest_status_type = score sieve_spamtest_text_value = sieve_trace_addresses = no sieve_trace_debug = no sieve_trace_dir = sieve_trace_level = none sieve_user_email = sieve_user_log_path = sieve_vacation_check_recipient = yes sieve_vacation_default_period = 1 weeks sieve_vacation_default_subject = sieve_vacation_default_subject_template = sieve_vacation_max_period = 60 days sieve_vacation_min_period = 1 days sieve_vacation_send_from_recipient = no sieve_vacation_to_header_ignore_envelope = no sieve_vacation_use_original_recipient = no sieve_variables_max_scope_count = 255 sieve_variables_max_value_size = 4 k sieve_virustest_score_max_header = sieve_virustest_score_max_value = sieve_virustest_status_header = sieve_virustest_status_type = score sieve_virustest_text_value = sql_driver = mysql ssl = yes ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH:!AECDH:!RC4-SHA:!SHA1 ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert_file = ssl_client_key_file = ssl_client_key_password = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_min_protocol = TLSv1.2 ssl_options = ssl_server_alt_cert_file = ssl_server_alt_key_file = ssl_server_ca_file = ssl_server_cert_file = ssl_server_cert_username_field = commonName ssl_server_dh_file = ssl_server_key_file = ssl_server_key_password = ssl_server_prefer_ciphers = client ssl_server_request_client_cert = no ssl_server_require_crl = yes stats_writer_socket_path = stats-writer submission_add_received_header = yes submission_backend_capabilities = submission_client_workarounds = submission_host = submission_logout_format = in=%{input} out=%{output} submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail textcat_config_path = trash_priority = 0 unix_listener_group = unix_listener_mode = 0600 unix_listener_path = unix_listener_type = unix_listener_user = userdb_driver = userdb_fields = userdb_fields_import_all = yes userdb_name = userdb_result_failure = continue userdb_result_internalfail = continue userdb_result_success = return-ok userdb_skip = never userdb_sql_iterate_query = userdb_sql_query = userdb_static_allow_all_users = no userdb_use_cache = yes userdb_use_worker = no valid_chroot_dirs = verbose_proctitle = no version_ignore = no virtual_max_open_mailboxes = 64 welcome_wait = no mysql localhost { dbname = sys_mail password = # hidden, use -P to show it ssl = no user = sys_dovecot } userdb sql { iterate_query = SELECT username AS user FROM mailbox query = SELECT CONCAT('/var/spool/dovecot/',maildir,'mail') AS mail_path, CONCAT('/var/spool/dovecot/',maildir) AS home, 5000 AS uid, 5000 AS gid, CONCAT(quota,'B') AS quota_storage_size FROM mailbox WHERE username = '%{user|lower}' } passdb pam { default_password_scheme = CRYPT service_name = dovecot skip = authenticated } namespace inbox { inbox = yes separator = / type = private mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { auto = subscribe special_use = "\\Junk" } mailbox Trash { auto = subscribe special_use = "\\Trash" quota_storage_percentage = 110 } mailbox Sent { auto = subscribe special_use = "\\Sent" } mailbox "Sent Messages" { auto = no special_use = "\\Sent" } } namespace shared { mail_driver = maildir mail_index_path = /var/spool/dovecot/%{user|domain}/%{user|username}/sharedmailboxes/%{owner_user|domain}/%{owner_user|username} mail_path = /var/spool/dovecot/%{owner_user|domain}/%{owner_user|username}/mail list = children prefix = shared/$user/ separator = / type = shared } service imap-login { inet_listener imap { listen = 127.0.0.1 } inet_listener imaps { } } service lmtp { unix_listener lmtp { } } service auth { unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } unix_listener /var/spool/postfix/private/auth { group = mail mode = 0666 user = postfix } } service auth-worker { user = $SET:default_internal_user } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-hibernate { unix_listener imap-hibernate { group = vmail mode = 0660 user = dovecot } } service imap { unix_listener imap-master { user = dovecot } } ssl_server { cert_file = /etc/letsencrypt/live/<Servername>.de/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/<Servername>.de/privkey.pem prefer_ciphers = server } protocol lda { mail_plugins { sieve = yes } } protocol imap { mail_max_userip_connections = 30 mail_plugins { imap_sieve = yes imap_quota = yes imap_acl = yes imap_zlib = no } } protocol lmtp { auth_username_format = %{user | username | lower} mail_plugins { sieve = yes } } service managesieve-login { process_min_avail = 1 restart_request_count = 1 vsz_limit = 64M inet_listener sieve { port = 4190 listen = 127.0.0.1 } } service managesieve { process_limit = 1024 } protocol sieve { mail_max_userip_connections = 10 managesieve_max_line_length = 65536 } dict_server { dict mysql { driver = sql hostname = localhost sql_driver = mysql ssl = no dict_map priv/quota/storage { sql_table = quota2 username_field = username dict_map_value_field bytes { type = uint } } dict_map priv/quota/messages { sql_table = quota2 username_field = username dict_map_value_field messages { type = uint } } dict_map "shared/shared-boxes/user/$to/$from" { sql_table = user_shares dict_map_value_field dummy { } dict_map_key_field from_user { value = $from } dict_map_key_field to_user { value = $to } } dict_map "shared/shared-boxes/anyone/$from" { sql_table = anyone_shares dict_map_value_field dummy { } dict_map_key_field from_user { value = $from } } } } acl_sharing_map { dict proxy { name = mysql } } language en { filters = lowercase snowball english-possessive stopwords } language de { default = yes filters = snowball stopwords normalizer-icu } fts flatcurve { substring_search = yes } quota "User quota" { driver = count storage_grace = 10M quota_warning warn-100 { quota_storage_percentage = 100 execute quota-full { args = 100 %{user} } } quota_warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } quota_warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } } service quota-full { executable = script /usr/local/bin/quota-warning-full.sh unix_listener quota-full { user = vmail } } quota_clone { dict proxy { name = mysql } } sieve_script personal { active_path = /var/spool/dovecot/%{user|domain}/%{user|username}/sieve/.dovecot.sieve driver = file path = /var/spool/dovecot/%{user|domain}/%{user|username}/sieve } sieve_script default { driver = file name = default path = /var/spool/dovecot/sieve/default.sieve type = default } service indexer-worker { executable = /usr/bin/nice -n 10 /usr/lib/dovecot/indexer-worker process_limit = 1 user = vmail }

2 2

time diff miscalculation on 32-bit systems
by Andy Spiegl 06 Jan '26

06 Jan '26

Dear dovecot team, I believe I found a bug in dovecot on 32-bit systems. Dovecot version: 1:2.4.1+dfsg1-6 (Architecture: i386) Operating system: Linux lar 6.13.7-64+ #1 SMP PREEMPT Fri Mar 21 08:33:47 MEZ 2025 x86_64 GNU/Linux Distributor ID: Debian Description: Debian GNU/Linux 13 (trixie) Release: 13 Codename: trixie * What led up to the situation? Upgrade from 2.3.21.1 to 1:2.4.1 * What was the outcome of this action? Logs are flooded with messages "Warning: Time moved forward" * Problem Description: The function io_loop_get_wait_time in ioloop.c contains the line: ioloop->next_max_time.tv_sec = (1ULL << (TIME_T_MAX_BITS-1)) - 1; On 32-bit systems TIME_T_MAX_BITS is 31 such that the result of this calculation is 1073741823. Far from the intended "infinity" and even before "now". This leads to problems in the function io_loop_handle_timeouts_real: the calculation of the time difference between now and next_max_time is then something like -693628953 seconds which confuses dovecot and floods the logs with these warnings: Jan 02 17:43:43 lmtp(38364): Warning: Time moved forward 693630400.301863 seconds Jan 02 17:43:43 lmtp(38364): Warning: Time moved forward 693630400.304144 seconds Jan 02 17:45:43 lmtp(38364): Warning: Time moved forward 693630520.416053 seconds * Possible solution/workaround ? ioloop->next_max_time.tv_sec = INT_MAX; Thanks for your consideration, Andy

2 1

Missing dovecot-pigeonhole packages in official CE-2.4 repo for RHEL/Rocky Linux 10
by Mateusz Kiczela 06 Jan '26

06 Jan '26

Hello Dovecot Team, I am attempting to install Dovecot 2.4.2 on Rocky Linux 10 (RHEL 10 compatible) using the official repository found at: http://repo.dovecot.org/ce-2.4-latest/rhel/10/RPMS/x86_64/ The Issue: Although the core Dovecot packages (dovecot, dovecot-imapd, etc.) are present, the Pigeonhole (Sieve/ManageSieve) packages are completely missing from the repository index. I have verified this by browsing the directory listing directly. Missing Packages: - dovecot-pigeonhole - dovecot-sieve - dovecot-managesieved Could you please check the build pipeline for RHEL/CentOS/Rocky Linux 10? It appears the Pigeonhole artifacts are not being published, and the base dependencies might need a rebuild against current EL10 libraries. Thank you for your support! Best regards. Mateusz Kiczela Hello Dovecot Team, I am attempting to install Dovecot 2.4.2 on Rocky Linux 10 (RHEL 10 compatible) using the official repository found at: [1]http://repo.dovecot.org/ce-2.4-latest/rhel/10/RPMS/x86_64/ The Issue: Although the core Dovecot packages (dovecot, dovecot-imapd, etc.) are present, the Pigeonhole (Sieve/ManageSieve) packages are completely missing from the repository index. I have verified this by browsing the directory listing directly. Missing Packages: - dovecot-pigeonhole - dovecot-sieve - dovecot-managesieved Could you please check the build pipeline for RHEL/CentOS/Rocky Linux 10? It appears the Pigeonhole artifacts are not being published, and the base dependencies might need a rebuild against current EL10 libraries. Thank you for your support! Best regards. Mateusz Kiczela References Visible links 1. http://repo.dovecot.org/ce-2.4-latest/rhel/10/RPMS/x86_64/

2 3

Getting Dovecot to coredump
by Washington Odhiambo 05 Jan '26

05 Jan '26

Can someone please give simple steps to make dovecot to coredump on Debian 12? After reading this: https://doc.dovecot.org/2.4.2/developers/debugging.html#coredumps - I am still not able to get it to work. I have been running dovecot from git (yes, I know I shouldn't!) until I updated today and then it would be killed by signal 11. I have so far installed the release versions and all is fine, but I'd like to ensure that in the future, I have the coredump working. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' ¯\_(ツ)_/¯ :-) [How to ask smart questions: http://www.catb.org/~esr/faqs/smart-questions.html] Can someone please give simple steps to make dovecot to coredump on Debian 12? After reading this: [1]https://doc.dovecot.org/2.4.2/developers/debugging.html#coredumps - I am still not able to get it to work. I have been running dovecot from git (yes, I know I shouldn't!) until I updated today and then it would be killed by signal 11. I have so far installed the release versions and all is fine, but I'd like to ensure that in the future, I have the coredump working. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 In an Internet failure case, the #1 suspect is a constant: DNS. "Oh, the cruft.", egrep -v '^$|^.*#' -\_(Tu)_/- :-) [How to ask smart questions: [2]http://www.catb.org/~esr/faqs/smart-questions.html] References Visible links 1. https://doc.dovecot.org/2.4.2/developers/debugging.html#coredumps 2. http://www.catb.org/~esr/faqs/smart-questions.html

2 3

dovecot-2.3.21.1 for Fedora 43
by John Fawcett 04 Jan '26

04 Jan '26

Hi I realize this may seem overly nostalgic, but I was wondering if anyone has successfully got dovecot-2.3.21.1 running on Fedora 43? I'm about to do an upgrade to Fedora 43 and I wanted to avoid doing a simultaneous upgrade to Dovecot 2.4 which is now the distro packaged version, since I have not yet converted my configuration. I managed to compile from source (after taking care of adding -licuuc to the linker flags when linking test-fts-filter). However running test-lib then fails on two tests. test-buffer-istream.c:54: Assert failed: buffer_append_full_file(result, TEST_FILENAME, SIZE_MAX, &error) == BUFFER_APPEND_READ_ERROR test-buffer-istream.c:56: Assert failed: error != NULL && *error != '\0' buffer_append_full_file .............................................. : FAILED and test-data-stack.c:191: Assert failed: a == b data-stack buffer interruption ....................................... : FAILED If instead I use a src rpm like the one from here: https://koji.fedoraproject.org/koji/buildinfo?buildID=2651758 that includes fedora specific patches and try to rebuild it, it builds without the libicuuc issue, but then fails on one (different) test: Error: error:078C0102:common libcrypto routines::passed a null parameter test-hmac.c:275: Assert(#3) failed: memcmp(res->data, vec->okm, vec->okm_len) == 0 hkdf sha256 rfc5869 vectors .......................................... : FAILED My assumption as yet unverified is that the fedora specific patches are avoiding the two test errors iwhen using the unpatched source, but contribute to the error produced when using the patched source, though my test did not rule out environment differences between these two tests. John

2 2

Failed tests in core & pigeonhole git HEAD
by Patrick 02 Jan '26

02 Jan '26

Hi, Happy New Year! During make check of core git rev 6d6724bd529493c448d5aa02e70aee9aaff4f2c3 (from github) with mock a test fails with: <mock-chroot> sh-5.3# more test-suite.log ============================================ Dovecot 2.4.3: src/imap/test-suite.log ============================================ # TOTAL: 2 # PASS: 1 # SKIP: 0 # XFAIL: 0 # FAIL: 1 # XPASS: 0 # ERROR: 0 System information (uname -a): Linux 6.17.12-300.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Dec 13 05:06:24 UTC 2025 x8 6_64 Distribution information (/etc/os-release): NAME="Fedora Linux" VERSION="43 (Forty Three)" RELEASE_TYPE=stable ID=fedora VERSION_ID=43 VERSION_CODENAME="" PRETTY_NAME="Fedora Linux 43 (Forty Three)" ANSI_COLOR="0;38;2;60;110;180" .. contents:: :depth: 2 FAIL: test-imap-client-hibernate ================================ imap client hibernate: non-IDLE ...................................... : ok test-common.c:300: Assert failed: suppress == TRUE test-imap-client-hibernate: Error: Couldn't hibernate imap client: net_connect_unix(/builddir/build/BUILD/dovecot-2 .4.3-build/dovecot/.test/imap-client-hibernate-130478.fdf4a74f3b5b21f2/imap-hibernate) failed: File name too long imap client hibernate: socket not found .............................. : FAILED test-imap-client-hibernate: Fatal: net_listen_unix(/builddir/build/BUILD/dovecot-2.4.3-build/dovecot/.test/imap-cli ent-hibernate-130478.fdf4a74f3b5b21f2/imap-hibernate) failed: File name too long FAIL test-imap-client-hibernate (exit status: 89) Pigeonhole git rev 7229ac65540889fc3e9658c4623eafc5a9952006 make check shows: make check-local make[1]: Entering directory '/builddir/build/BUILD/dovecot-2.4.3-build/dovecot/dovecot-pigeonhole' rm -rf ./.test make[1]: Leaving directory '/builddir/build/BUILD/dovecot-2.4.3-build/dovecot/dovecot-pigeonhole' testsuite: Fatal: execv(/usr/bin/doveconf) failed: No such file or directory make: *** [Makefile:1280: tests/testsuite.svtest] Error 84 Best, Patrick

1 0

Hello, i came here for Your help cant do a proper configuration of dovecot from 2.3.X to 2.4.1
by revolt2＠wp.pl 31 Dec '25

31 Dec '25

I would like to ask if someone could correct the configuration file for Dovecot dovecot.conf for version 2.4.1? Its the old file from 2.3.X but I'm sorry to say it doesn't work ;( https://pastebin.com/BjXuPEvv , and here is an dovecot-sql.conf file : https://pastebin.com/C4dFG2Zi If any further changes are needed, please let me know, I will adapt, I tried to understand the AI documentation but I couldn't, so we have to meet here,, Thank you in advance for your help

3 2

2.4 use a dictionary when receiving authentification requests
by info＠opdepc.nl 31 Dec '25

31 Dec '25

In conf.d/10-auth.conf I do: dict lookuptable { dict_name = lookuptable dict_driver = file dict_file_path = /etc/dovecot/mailtouserid.dict } auth_username_format = %{user | lower | dict:lookuptable/shared/ } But it seems the dictionary doesn't work here... it is skipped. Is this a bug, is it something that will be added lateron or do I do something wrong? My goal is to allow users to logon with their email address as username. Best wishes for 2026 to all! -Huibert.

2 4

quota_mailbox_message_count
by James 31 Dec '25

31 Dec '25

New for 2.4 is quota_mailbox_message_count. I have set limits for: quota_storage_size quota_message_count quota_mailbox_message_count Defaults in dovecot.conf and per user value from userdb sql. These are working proved by the rejection of test messages. 1. To monitor users' quotas one can run: doveadm quota get -A This lists values for Types STORAGE and MESSAGE. Is there a way to list mailbox_message_count values? It is per mailbox so might need a mailbox option on doveadm. doveadm-quota(1) shows -A and -u. 2. How does one send quota warning messages when quota_mailbox_message_count crosses thresholds? The documentation [1] has examples for quota_storage_size and quota_message_count but not quota_mailbox_message_count. I am missing quota_mailbox_message_percentage. Thank you. 1. Quota example: https://doc.dovecot.org/2.4.2/core/plugins/quota.html#example-configuration

2 2

Minor note about what seems like a behavior change with the 'user' field in passdb/userdb overrides
by Andy Baugh 30 Dec '25

30 Dec '25

Just finished fixing a bug with our setup where the "archive" pseudo-user we setup wasn't listing the correct dirs in IMAP yet would show their other mailboxes, folders, etc. just fine via `doveadm mailbox list`. Turns out the issue was that the 'user' field is more important on dovecot 2.4's IMAP implementation than on 2.3, but in ways that the documentation didn't really suggest to me. In both cases it says that it overrides the user, but what that means is different. On 2.3, it's mostly saying "act as if you are this user but with these other params we set in the user/passdb return" On 2.4.x, it is a straight up alias to another userdb/passdb return in IMAP's context, so any other params you override do not in fact get used. You can pretty quickly verify this with `doveadm user`/`doveadm auth lookup` calls; when your "override" user matches another user which has an entry reported back from your userdb/passdb, it just returns their data instead even if your auth source provided other data. What's odd to me is more that `doveadm mailbox list` worked "as expected" here, as everything else was consistent with 'user' being an aliasing trigger. I wound up fixing my bug by just no longer setting the 'user' variable for this archival psuedo-user, and instead relying on the (already set even on 2.3) uid/gid fields to make sure they didn't have permissions errors. Then things worked precisely how they did on 2.3. I only figured this out by accidentally making a new IMAP dir for the original user and then noticing that show up for the pseudo-user (I then scrutinized the userdb/passdb returns more carefully, then noticing the difference). Hopefully my tale helps others avoid the many hours of fruitless debugging I was doing before making that crucial mistake lol. Cheers, -- Thomas "Andy" Baugh | Software Development Engineer IV andy.baugh(a)webpros.com www.webpros.com

1 0

Error I can't fix
by John Hill 27 Dec '25

27 Dec '25

Hello, I’m encountering a reproducible parsing issue in Dovecot 2.4 on Debian 13 (Trixie). Even when /etc/dovecot/conf.d/auth-sql.conf.ext contains a valid passdb block, Dovecot reports that the block is empty. Environment: - Debian 13 (Trixie) - Dovecot 2.4 (from Debian repository) - Clean install, no custom patches Error: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/auth-sql.conf.ext line 1: passdb { } is missing section name Steps to reproduce: 1. Remove the file: rm -f /etc/dovecot/conf.d/auth-sql.conf.ext 2. Recreate it cleanly: cat > /etc/dovecot/conf.d/auth-sql.conf.ext <<'EOF' passdb { driver = sql args = /etc/dovecot/sql.conf.ext } userdb { driver = sql args = /etc/dovecot/sql.conf.ext } EOF 3. Verify the file contents: sed -n '1,20p' /etc/dovecot/conf.d/auth-sql.conf.ext | cat -A Output: passdb {$ driver = sql$ args = /etc/dovecot/sql.conf.ext$ }$ $ userdb {$ driver = sql$ args = /etc/dovecot/sql.conf.ext$ }$ 4. Run: doveconf Actual result: Dovecot still reports that the passdb block is empty, even though the file is valid. Expected result: Dovecot should accept the passdb block and load SQL authentication normally. Additional notes: - No BOM (ef bb bf) present. - No CRLF (^M) present. - No stray characters. - File is not a symlink. - No duplicate auth-sql.conf.ext files exist. - The include line in 10-auth.conf is correct. - The error persists even after full deletion and recreation of the file. This appears to be a parser or include-path issue in Dovecot 2.4. Any guidance or confirmation would be appreciated.

4 7

dovecot-optimize FTS Xapian Failed to open glass revision file for reading
by Torge Riedel 27 Dec '25

27 Dec '25

Dears, from time to time (no regular frequency) I get the following error: /etc/cron.daily/dovecot-optimize: doveadm(account(a)domain.de): Error: FTS Xapian: Optimize (6) /var/vmail/mailboxes/domain.de/account/index/xapian-indexes/db_<longhex>/iamglass: Failed to open glass revision file for reading The reason is the file "iamglass" is owned by "root", when I change this back to "vmail" the error disappears for a while. I do not find the cause why this sometimes changes. And it is only this file, where the ownership changes. The content of /etc/cron.daily/dovecot-optimize is: #!/bin/sh doveadm fts optimize -A I welcome any help / hint, thanks and kind regards Torge

1 0

mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings)
by Klaus Tachtler 26 Dec '25

26 Dec '25

Hello everyone, Problem info: An error occurs, while trying to establish a TLS/SSL secured connection to a database (mariadb), which has the ability to accept TLS/SSL connections. Analysis from Archlinux Gitlab Issue, which could be found under following link by - Toolybird: https://gitlab.archlinux.org/archlinux/packaging/packages/dovecot/-/issues/… > Thanks for reporting. It would appear to be some kind of (upstream?) > bug in the autofoo. The error message can be traced back to > HAVE_MYSQL_SSL being undefined when it should be defined. This is > reflected in log: https://reproducible.archlinux.org/api/v0/builds/946041/log > It took quite some debugging, but adding the following hack before the > autoreconf call appears to make it work: > checking for mysql_ssl_set in -llibmariadb... no > sed -i 's/mysql_driver="libmariadb"/mysql_driver="mariadb"/' m4/ > want_mysql.m4 > After that it now shows: > checking for mysql_ssl_set in -lmariadb... yes Steps to reproduce: 1. Configure dovecot 2.4.2-4 as described below 2. Restart dovecot 2.4.2-4 3. Try send an email (echo "Test-E-Mail" | /usr/sbin/sendmail root) 4. Determine error messages inside dovecot 2.4.2-4-Log 01 Dec 22 04:57:38 server dovecot[842]: auth: Error: mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings) 02 Dec 22 04:57:38 server dovecot[842]: auth-worker: Error: mysql(db.idmz.tachtler.net): mysql: SSL support not compiled in (remove ssl_client_ca_file and ssl_client_ca_dir settings) Additional info: OS version: Archlinux package version(s): dovecot 2.4.2-4 necessary config file part: 45 sql_driver = mysql 46 47 mysql db.idmz.tachtler.net { 48 host = db.idmz.tachtler.net 49 port = 3306 50 user = postfixuser 51 password = geheim 52 dbname = postfix 53 ssl = yes 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem 55 ssl_client_cert_file = /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem 56 ssl_client_key_file = /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem 57 ssl_cipher_list = DHE-RSA-AES256-SHA 58 } WITHOUT the following line, a database connections is possible and works as expected: 53 ssl = yes 54 ssl_client_ca_file = /etc/dovecot/ssl/certs/CAcert.pem 55 ssl_client_cert_file = /etc/dovecot/ssl/certs/client.idmz.tachtler.net.pem 56 ssl_client_key_file = /etc/dovecot/ssl/private/client.idmz.tachtler.net.key.pem 57 ssl_cipher_list = DHE-RSA-AES256-SHA Thanky you in advance for your help! Klaus Tachtler. -- --------------------------------------- e-Mail : klaus(a)tachtler.net Homepage: https://www.tachtler.net DokuWiki: https://dokuwiki.tachtler.net ---------------------------------------

1 0

Rootless docker image missing /usr/bin/sleep causing health check to not work
by saturos+dove＠gmail.com 23 Dec '25

23 Dec '25

Hello! I was attempting to set up health checking as in the Health Checking document [1]. But it seems that the rootless image is missing the sleep command, which prints the error: dovecot[16633]: Dec 22 22:05:04 health-check: Error: /dovecot/libexec/dovecot/health-check.sh: 31: sed: not found Reproduction: $ podman run --rm -it index.docker.io/dovecot/dovecot:latest-dev which sleep /usr/bin/sleep $ podman run --rm -it index.docker.io/dovecot/dovecot:latest-root which sleep /usr/bin/sleep $ podman run --rm -it index.docker.io/dovecot/dovecot:latest which sleep $ Set up healthchecking on 5001. With latest: $ echo -e "PING\n" | nc -v localhost 5001 Connection to localhost (::1) 5001 port [tcp/*] succeeded! $ With latest-dev: $ echo -e "PING\n" | nc -v localhost 5001 Connection to localhost (::1) 5001 port [tcp/*] succeeded! PONG and the error log above is generated. Version: $ podman run --rm -it index.docker.io/dovecot/dovecot:latest dovecot --version 2.4.2 (0962ed2104) [1] https://doc.dovecot.org/2.4.2/core/config/health_check.html

2 1

quota_mail_size question
by Marcel Menzel 22 Dec '25

22 Dec '25

Hello List, I've enabled the quota_mail_size parameter to match what I've set in Postfix, but it seems to me that this parameter has no effect. Currently set to quota_mail_size = 104857600B (with or without the suffix does not matter in my case as both won't work), but connecting to the LMTP socket does not seem to advertise SIZE: # socat /run/dovecot/lmtp readline 220 mail-fra01 Hello there LHLO test 250-mail-fra01 250-8BITMIME 250-CHUNKING 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-SMTPUTF8 250 STARTTLS quit 221 2.0.0 Bye Also looking at IMAP logs on clients, APPENDLIMIT also does not seem to get advertised there. Quota itself seems to work fine via userdb, also via the IMAP quota extension as my clients report the usage. Thanks, Marcel doveconf -n: # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2 (767418c3) # OS: Linux 6.17.11-hardened1-1-hardened x86_64 # Hostname: mail-fra01 dovecot_config_version = 2.4.2 auth_verbose = yes dovecot_storage_version = 2.4.2 first_valid_uid = 8 fts_autoindex = yes hostname = mail-fra01 imap4rev2_enable = yes last_valid_uid = 8 lmtp_rcpt_check_quota = yes login_greeting = Hello there mail_driver = maildir mail_gid = mail mail_home = /var/vmail/%{user | domain}/%{user | username} mail_path = ~/ mail_plugins { quota = yes quota_clone = yes notify = yes virtual = yes fts = yes fts_xapian = yes } mail_server_admin = mailto:marcel@menzel.de mail_server_comment = hi mail_uid = mail mail_utf8_extensions = yes mailbox_list_storage_escape_char = \ mailbox_list_utf8 = yes passdb_default_password_scheme = SHA256-CRYPT protocols { imap = yes pop3 = yes sieve = yes lmtp = yes } quota_mail_size = 104857600B quota_status_nouser = DUNNO sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.environment = yes } sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sieve_redirect_envelope_from = recipient sql_driver = pgsql ssl = required ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 ssl_curve_list = X448:X25519:P-256 ssl_options = no_ticket submission_host = 127.0.0.1:25 verbose_proctitle = yes protocol imap { imap_hibernate_timeout = 10 secs imap_idle_notify_interval = 29 mins imap_metadata = yes mail_max_userip_connections = 50 mail_plugins { imap_quota = yes imap_sieve = yes last_login = yes } } protocol pop3 { mail_plugins { last_login = yes } } protocol sieve { mail_plugins { last_login = yes } } protocol lmtp { mail_plugins { sieve = yes push_notification = yes } postmaster_address = postmaster@%{user | domain} } service lmtp { user = mail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service auth-worker { user = $SET:default_internal_user } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = dovecot mode = 0660 user = mail } } service quota-status { client_limit = 1 executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { group = postfix mode = 0660 user = postfix } } service indexer-worker { vsz_limit = 8 G } maildir { very_dirty_syncs = yes } mail_attribute { dict file { path = %{home}/dovecot-attributes } } fts xapian { } language en { default = yes } language de { } namespace inbox { inbox = yes separator = / mailbox Archive { auto = subscribe special_use = "\\Archive" } mailbox Drafts { auto = subscribe special_use = "\\Drafts" } mailbox Junk { fts_autoindex = no auto = subscribe autoexpunge = 30 days special_use = "\\Junk" } mailbox Sent { special_use = "\\Sent" } mailbox Trash { fts_autoindex = no auto = subscribe autoexpunge = 120 days special_use = "\\Trash" quota_storage_extra = 100M } } pgsql mcl { parameters { dbname = mail host = 10.10.3.2 password = <redacted> port = 6432 sslmode = disable user = mail } } userdb sql { iterate_query = SELECT username AS user FROM mailbox; query = SELECT CONCAT(quota, 'B') AS quota_storage_size FROM mailbox WHERE username = '%{user | lower}' LIMIT 1; } passdb sql { query = SELECT username AS user, password, allow_nets FROM mailbox WHERE username = '%{user | lower}' AND active = true LIMIT 1; } ssl_server { cert_file = /etc/ssl/private/dovecot.crt.pem key_file = /etc/ssl/private/dovecot.pk.pem prefer_ciphers = server } ssl_client { ca_dir = /etc/ssl/certs } sieve_script default { name = default path = /var/vmail/global.sieve type = default } sieve_script personal { active_path = /var/vmail/%{user | domain}/%{user | username}/dovecot.sieve path = /var/vmail/%{user | domain}/%{user | username}/sieve type = personal } mailbox Spam { sieve_script spam { cause = copy append path = /usr/lib/dovecot/sieve-pipe/report-spam.sieve type = before } } imapsieve_from Spam { sieve_script ham { cause = copy append path = /usr/lib/dovecot/sieve-pipe/report-ham.sieve type = before } } quota "User quota" { } quota_clone { dict proxy { name = quota_clone_sql } } dict_server { dict quota_clone_sql { driver = sql sql_driver = pgsql dict_map priv/quota/messages { sql_table = quota2 username_field = username dict_map_value_field messages { } } dict_map priv/quota/storage { sql_table = quota2 username_field = username dict_map_value_field bytes { } } } }

2 1

2.4.2 post login core dump when trash plugin is enabled
by Aragon Gouveia 22 Dec '25

22 Dec '25

Hi, docker run --rm --name dovecot -e USER_PASSWORD=test123 -v dovecot_mail:/srv/vmail -v ~aragon/dovetest/local.conf:/etc/dovecot/conf.d/local.conf -p 110:31110 -p 143:31143 --ulimit core=-1 dovecot/dovecot:latest-dev Dec 16 00:49:57 master: Info: Dovecot v2.4.2 (0962ed2104) starting up for imap, pop3, lmtp, sieve Dec 16 00:50:08 pop3-login: Info: Logged in: user=<test>, method=PLAIN, rip=172.17.0.1, lip=172.17.0.2, mpid=16, secured, session=<m5/SGwdGHNKsEQAB> Dec 16 00:50:08 pop3(test)<16><m5/SGwdGHNKsEQAB>: Fatal: master: service(pop3): child 16 killed with signal 11 (core dumped) Contents of ~aragon/dovetest/local.conf: mail_plugins { quota = yes trash = yes } protocols = imap pop3 lmtp sieve login_trusted_networks = 172.16.0.0/15 # telnet localhost 110 Trying ::1... Connected to localhost. Escape character is '^]'. +OK [XCLIENT] Dovecot ready. user test +OK pass test123 +OK Logged in. Connection closed by foreign host. dovecot-sysreport uploaded to https://limewire.com/d/PLgit#mrIN2Wx73J Is this sufficient info? Regrettably no debug symbols in the Docker builds, unless I missed something. Thank you in advance. Regards, Aragon

2 2

Sieve regex behavior
by Luca Weiss 22 Dec '25

22 Dec '25

Hi, I'm having troubles lately with a Sieve script of mine: require "fileinto"; require "mailbox"; require "regex"; if header :regex "Subject" "\\[.*PATCH.*\\]" { fileinto :create "Inbox.Patches"; } This should move all patches with "[PATCH]" or "[RFC PATCH v3]" into this Inbox subfolder, I'm pretty sure this version worked flawlessly in the past but since a couple of weeks ago it's not working with some emails. Debugging this, with manually editing mail files, I came to this discovery. That one mail matches and it's getting moved to the correct folder: Subject: Re: [PATCH v2 3/6] arm64: dts: qcom: qcm6490-shift-otter: A Adding one more character leads to it not getting moved: Subject: Re: [PATCH v2 3/6] arm64: dts: qcom: qcm6490-shift-otter: Ad Does anybody have an explanation for this why this broke, and how to fix either Dovecot/Pigeonhole or my Sieve script? I've already lost hours trying to figure this out and I'm not getting any wiser... Regards Luca

4 3

Error after power failure
by Doug Hardie 22 Dec '25

22 Dec '25

My mail server lost power and now I am having issues with dsync for one user. Here is the command and output: mail# doveadm backup -u doug remote:sermons dsync-local(doug)<EauXLsjZRWkgLgAAZU03Dg>: Error: /var/mail/home_mail/doug/Maildir/dovecot.index: Couldn't set transaction log view (seq 295..297): Missing middle file seq=296 (between 295..297, we have seqs 295,297): Not found from .log.2: File is already open dsync-local(doug)<EauXLsjZRWkgLgAAZU03Dg>: Error: Failed to read transaction log for mailbox INBOX dsync-local(doug)<EauXLsjZRWkgLgAAZU03Dg>: Error: Remote command returned error 75: ssh sermons doveadm dsync-server -udoug -U How do I fix this issue? Thanks, -- Doug

2 1

Pigeonhole managesieve-login panic
by revsuine 19 Dec '25

19 Dec '25

Hi folks, I'm getting a ``` Dec 19 16:18:07 managesieve-login: Panic: file client.c: line 350 (managesieve_client_input_next_cmd): assertion failed: (args != NULL) Dec 19 16:18:07 auth: Debug: conn unix:login (pid=7390,uid=91) [2]: Disconnected: Connection closed (fd=20) Dec 19 16:18:07 managesieve-login: Fatal: master: service(managesieve-login): child 7390 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) ``` When trying to connect to MANAGESIEVE using [sieve-connect][1]. The command I'm using is ``` sieve-connect -s revsuine.xyz -u pid1 --passwordfd=5 5<<<"$(command to get pass here)" ``` This command was working previously (within the past year), though I don't remember which versions of Dovecot/Pigeonhole I tried it on. sieve-connect has not been updated recently, so there aren't any changes in sieve-connect that would've caused this. I'm attaching the files generated by `dovecot-sysreport` which includes my `dovecot -n`. Server OS is Alpine Linux 3.23.2. ~revsuine [1]: https://github.com/philpennock/sieve-connect

1 0

Attachments corrupted by sieve "redirect" action
by Michael Orlitzky 18 Dec '25

18 Dec '25

We got a report today from one of our customers that they are unable to "redirect" mail with attachments off-site. At first I was skeptical, because sieve does not mess with the message body... but sure enough, it's easy to reproduce: 1. Create a new address (mailbox) 2. Create a single sieve "redirect" filter for that address, pointing to my own mailbox 3. Send it a message with an attachment 4. An attachment is visible on the message that arrives, but it is corrupt For example: $ cat hello.original.txt Hello, world! but $ cat hello.attached.txt (it's empty). Sending a JPEG image is a bit more enlightening: $ /bin/ls -l *jpg -rw------- 1 mjo mjo 337119 Dec 18 11:15 image.attached.jpg -rw-r--r-- 1 mjo mjo 337173 Dec 18 11:13 image.original.jpg So something _is_ sent, but the start of the file is corrupt. Looking at it in a hex editor, it's only the first few lines that are messed up. This is with dovecot 2.4.2, but notably, we are using zlib compression: mail_plugins = mail_compress mail_compress_write_method = gz I'm curious if anyone else can reproduce this? Redirecting via sieve is not common, so this isn't an emergency, but obviously it is preferable to have it working.

2 1

Imap-login bind errors after upgrading dovecot from 2.3 to 2.4
by onyeibo 18 Dec '25

18 Dec '25

Greetings I updated the OS in a VPS blindly and broke the mail service. I had set up this service over four years ago and never had issues with upgrades until recently. I realized the gravity of my mistake after dovecot refused to start. Version 2.4.1 had arrived and I am in so much trouble. So far, I have adapted the configuraton files to 2.4 standards. "doveadm auth test user" tells me that the authentication is working fine. I am able to view old mails via doveadm. However, I get nothing new from mail clients. The maillog tells me that mails are getting queued (why?). I see status=sent (250.2.0.0) in some transactions, but that is the extent of success. However, I still get a nagging error message (see the end of this mail). dovecot -n # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.17.11-300.fc43.x86_64 x86_64 Fedora release 43 (Forty Three) dovecot_config_version = 2.4.1 auth_debug = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 first_valid_uid = xxxx mail_driver = maildir mail_home = /home/mails/%{user | domain}/%{user | username} mail_path = %{home}/Maildir mail_privileged_group = mail passdb_default_password_scheme = BLF-CRYPT protocols { imap = yes lmtp = yes sieve = yes } sql_driver = pgsql ssl = required ssl_cipher_list = PROFILE=SYSTEM pgsql localhost { parameters { dbname = postfix password = xxxxxxx user = postfix } } passdb sql {n query = SELECT username AS user, password FROM mailbox WHERE username = '%{user}' AND active='1' } userdb sql { query = SELECT '/home/mails/' || maildir AS home, xxxx as uid, xxxx as gid FROM mailbox WHERE username = '%{user}' AND active = '1' } namespace inbox { inbox = yes mailbox Drafts { auto = create special_use = "\\Drafts" } mailbox Junk { auto = create special_use = "\\Junk" } mailbox Trash { auto = create special_use = "\\Trash" } mailbox Sent { auto = create special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service lmtp { executable = lmtp -L process_min_avail = 5 user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_server { cert_file = /etc/letsencrypt/live/xxxxxxx.com/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/xxxxxxx.com/privkey.pem prefer_ciphers = server } protocol lmtp { info_log_path = /var/log/lmtp/dovecot-lmtp.log mail_plugins { sieve = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve} I did adjust an entry in postfix (master.cf). I switched from dovecot-lda to dovecot-lmtp. LDA was throwing permission errors when accessing the cert file. Most reference materials recommended LMTP because its processes already have the required privileges. So ... master.cf (postfix)dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -a ${original_recipient} -d ${user}@${nexthop}# maillog errors Dec 16 22:16:29 xxxxxxx.com dovecot[139456]: master: Error: bind(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 xxxxxxx.com dovecot[139456]: master: Fatal: Failed to create per-PID unix_listener %{pid}: net_listen_unix(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 xxxxxxx.com dovecot[809]: master: Error: service(imap-login): command startup failed, throttling for 2.000 secsDec 16 22:16:29 xxxxxxx.com dovecot[139216]: imap-login: Fatal: master: service(imap-login): child 139456 returned error 89 (Fatal failure) What am I missing? Regards Onyeibo Greetings I updated the OS in a VPS blindly and broke the mail service. I had set up this service over four years ago and never had issues with upgrades until recently. I realized the gravity of my mistake after dovecot refused to start. Version 2.4.1 had arrived and I am in so much trouble. So far, I have adapted the configuraton files to 2.4 standards. "doveadm auth test user" tells me that the authentication is working fine. I am able to view old mails via doveadm. However, I get nothing new from mail clients. The maillog tells me that mails are getting queued (why?). I see status=sent (250.2.0.0) in some transactions, but that is the extent of success. However, I still get a nagging error message (see the end of this mail). dovecot -n # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 6.17.11-300.fc43.x86_64 x86_64 Fedora release 43 (Forty Three) dovecot_config_version = 2.4.1 auth_debug = yes auth_mechanisms = plain login dovecot_storage_version = 2.4.1 first_valid_uid = xxxx mail_driver = maildir mail_home = /home/mails/%{user | domain}/%{user | username} mail_path = %{home}/Maildir mail_privileged_group = mail passdb_default_password_scheme = BLF-CRYPT protocols { imap = yes lmtp = yes sieve = yes } sql_driver = pgsql ssl = required ssl_cipher_list = PROFILE=SYSTEM pgsql localhost { parameters { dbname = postfix password = xxxxxxx user = postfix } } passdb sql {n query = SELECT username AS user, password FROM mailbox WHERE username = '%{user}' AND active='1' } userdb sql { query = SELECT '/home/mails/' || maildir AS home, xxxx as uid, xxxx as gid FROM mailbox WHERE username = '%{user}' AND active = '1' } namespace inbox { inbox = yes mailbox Drafts { auto = create special_use = "\\Drafts" } mailbox Junk { auto = create special_use = "\\Junk" } mailbox Trash { auto = create special_use = "\\Trash" } mailbox Sent { auto = create special_use = "\\Sent" } mailbox "Sent Messages" { special_use = "\\Sent" } } service lmtp { executable = lmtp -L process_min_avail = 5 user = vmail unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0600 user = postfix } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_server { cert_file = /etc/letsencrypt/live/xxxxxxx.com/fullchain.pem dh_file = /etc/dovecot/dh.pem key_file = /etc/letsencrypt/live/xxxxxxx.com/privkey.pem prefer_ciphers = server } protocol lmtp { info_log_path = /var/log/lmtp/dovecot-lmtp.log mail_plugins { sieve = yes } } service managesieve-login { inet_listener sieve { port = 4190 } } service managesieve { } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole } sieve_script personal { active_path = ~/.dovecot.sieve path = ~/sieve } I did adjust an entry in postfix (master.cf). I switched from dovecot-lda to dovecot-lmtp. LDA was throwing permission errors when accessing the cert file. Most reference materials recommended LMTP because its processes already have the required privileges. So ... master.cf (postfix) dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/libexec/dovecot/deliver -f ${sender} -a ${original_recipient} -d ${user}@${nexthop}# maillog errors Dec 16 22:16:29 [1]xxxxxxx.com dovecot[139456]: master: Error: bind(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 [2]xxxxxxx.com dovecot[139456]: master: Fatal: Failed to create per-PID unix_listener %{pid}: net_listen_unix(/run/dovecot/srv.imap-login/139456) failed: No such file or directory Dec 16 22:16:29 [3]xxxxxxx.com dovecot[809]: master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Dec 16 22:16:29 [4]xxxxxxx.com dovecot[139216]: imap-login: Fatal: master: service(imap-login): child 139456 returned error 89 (Fatal failure) What am I missing? Regards Onyeibo References Visible links 1. http://xxxxxxx.com/ 2. http://xxxxxxx.com/ 3. http://xxxxxxx.com/ 4. http://xxxxxxx.com/

4 9

Bug Report: authCacheFlush HTTP API crashes with assertion failure
by Yurii Krainiuk 17 Dec '25

17 Dec '25

*## Title* authCacheFlush HTTP API crashes with assertion failure - type mismatch between API schema and implementation *## Dovecot Version* 2.4.2 *## Component* doveadm HTTP API *## Description* The authCacheFlush command via doveadm HTTP API causes a server crash with an assertion failure. The HTTP API schema declares the user parameter as array type, but the internal implementation (doveadm_cmd_param_str) expects string type, causing a type mismatch assertion failure. *## Steps to Reproduce* 1. Send any authCacheFlush request to doveadm HTTP API: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":"username(a)domain.com"},"tag1"]]' \ http://localhost:8080/doveadm/v1 2. Or with user as array (matching the declared schema): bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":["username(a)domain.com"]},"tag1"]]' \ http://localhost:8080/doveadm/v1 3. Or without any parameters: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{},"tag1"]]' \ http://localhost:8080/doveadm/v1 *## Expected Result* Auth cache should be flushed and API returns success response like: json [["doveadmResponse",[{"entries":1}],"tag1"]] *## Actual Result* Server crashes with empty reply (HTTP connection closed). The doveadm process is killed with signal 6 (SIGABRT). *## Error Log* Panic: file doveadm-cmd-parse.c: line 120 (doveadm_cmd_param_str): assertion failed: (param->type == CMD_PARAM_STR) Error: Raw backtrace: #0 test_subprocess_fork[0x7362eb54a570] -> #1 backtrace_append[0x7362eb54a820] -> #2 backtrace_get[0x7362eb54a9c0] -> #3 e_info[0x7362eb556370] -> #4 i_syslog_fatal_handler[0x7362eb5564b0] -> #5 i_panic[0x7362eb474f28] -> #6 [unw_get_proc_name() failed: -10] -> #7 http_server_connection_shut_down[0x7362eb4e6a00] -> #8 io_loop_call_io[0x7362eb572510] -> #9 io_loop_handler_run_internal[0x7362eb5743a0] -> #10 io_loop_handler_run[0x7362eb574540] -> #11 io_loop_run[0x7362eb574740] -> #12 master_service_run[0x7362eb4bc640] -> #13 main[0x64c4233d74f0] -> #14 __libc_init_first[0x7362eb02a150] -> #15 __libc_start_main[0x7362eb02a200] -> #16 _start[0x64c4233d76e0] Fatal: master: service(doveadm): child 2302469 killed with signal 6 (core dumped) *## API Schema (from GET /doveadm/v1)* The API endpoint reports the following schema for authCacheFlush: json { "command": "authCacheFlush", "parameters": [ {"name": "socketPath", "type": "string"}, {"name": "user", "type": "array"} ] } *## Analysis* The API schema declares user as array, but line 120 in doveadm-cmd-parse.c calls doveadm_cmd_param_str() which asserts param->type == CMD_PARAM_STR. This type mismatch causes the crash. The relevant assertion in source code: c // doveadm-cmd-parse.c:120 assertion failed: (param->type == CMD_PARAM_STR) *## Note* - The CLI command doveadm auth cache flush <user> works correctly - Only the HTTP API is affected - All authentication methods (X-Dovecot-API header, Basic Auth) produce the same crash - The crash occurs regardless of whether parameters are provided or not *## Workaround* Currently no workaround via HTTP API. Must use CLI directly or via SSH. *## Environment* - OS: Linux (Ubuntu/Debian) - Dovecot: 2.4.2 - doveadm HTTP API enabled on port 8080 ## Title authCacheFlush HTTP API crashes with assertion failure - type mismatch between API schema and implementation ## Dovecot Version 2.4.2 ## Component doveadm HTTP API ## Description The authCacheFlush command via doveadm HTTP API causes a server crash with an assertion failure. The HTTP API schema declares the user parameter as array type, but the internal implementation (doveadm_cmd_param_str) expects string type, causing a type mismatch assertion failure. ## Steps to Reproduce 1. Send any authCacheFlush request to doveadm HTTP API: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":"[1]username(a)domain.com"},"tag1"]]' \ [2]http://localhost:8080/doveadm/v1 2. Or with user as array (matching the declared schema): bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{"user":["[3]username(a)domain.com"]},"tag1"]]' \ [4]http://localhost:8080/doveadm/v1 3. Or without any parameters: bash curl -X POST \ -H "Authorization: X-Dovecot-API <api_key>" \ -H "Content-Type: application/json" \ -d '[["authCacheFlush",{},"tag1"]]' \ [5]http://localhost:8080/doveadm/v1 ## Expected Result Auth cache should be flushed and API returns success response like: json [["doveadmResponse",[{"entries":1}],"tag1"]] ## Actual Result Server crashes with empty reply (HTTP connection closed). The doveadm process is killed with signal 6 (SIGABRT). ## Error Log Panic: file doveadm-cmd-parse.c: line 120 (doveadm_cmd_param_str): assertion failed: (param->type == CMD_PARAM_STR) Error: Raw backtrace: #0 test_subprocess_fork[0x7362eb54a570] -> #1 backtrace_append[0x7362eb54a820] -> #2 backtrace_get[0x7362eb54a9c0] -> #3 e_info[0x7362eb556370] -> #4 i_syslog_fatal_handler[0x7362eb5564b0] -> #5 i_panic[0x7362eb474f28] -> #6 [unw_get_proc_name() failed: -10] -> #7 http_server_connection_shut_down[0x7362eb4e6a00] -> #8 io_loop_call_io[0x7362eb572510] -> #9 io_loop_handler_run_internal[0x7362eb5743a0] -> #10 io_loop_handler_run[0x7362eb574540] -> #11 io_loop_run[0x7362eb574740] -> #12 master_service_run[0x7362eb4bc640] -> #13 main[0x64c4233d74f0] -> #14 __libc_init_first[0x7362eb02a150] -> #15 __libc_start_main[0x7362eb02a200] -> #16 _start[0x64c4233d76e0] Fatal: master: service(doveadm): child 2302469 killed with signal 6 (core dumped) ## API Schema (from GET /doveadm/v1) The API endpoint reports the following schema for authCacheFlush: json { "command": "authCacheFlush", "parameters": [ {"name": "socketPath", "type": "string"}, {"name": "user", "type": "array"} ] } ## Analysis The API schema declares user as array, but line 120 in doveadm-cmd-parse.c calls doveadm_cmd_param_str() which asserts param->type == CMD_PARAM_STR. This type mismatch causes the crash. The relevant assertion in source code: c // doveadm-cmd-parse.c:120 assertion failed: (param->type == CMD_PARAM_STR) ## Note - The CLI command doveadm auth cache flush <user> works correctly - Only the HTTP API is affected - All authentication methods (X-Dovecot-API header, Basic Auth) produce the same crash - The crash occurs regardless of whether parameters are provided or not ## Workaround Currently no workaround via HTTP API. Must use CLI directly or via SSH. ## Environment - OS: Linux (Ubuntu/Debian) - Dovecot: 2.4.2 - doveadm HTTP API enabled on port 8080 References Visible links 1. mailto:username@domain.com 2. http://localhost:8080/doveadm/v1 3. mailto:username@domain.com 4. http://localhost:8080/doveadm/v1 5. http://localhost:8080/doveadm/v1

2 1

mTLS ldap auth failure against openldap + TLSVerifyClient: demand
by Patrick Laimbock 16 Dec '25

16 Dec '25

Hi, I'm trying to setup up a Dovecot/Postfix/OpenLDAP combo on a Fedora 43 aarch64 box with the following versions: dovecot-2.4.2 from https://src.fedoraproject.org/rpms/dovecot/tree/rawhide and rebuilt for F43 at https://copr.fedorainfracloud.org/coprs/patrickl/dovecot/ postfix-3.10.3 openldap-2.6.10 openssl-3.5.4 Problem: I can't seem to make Dovecot (lmtp) establish a mTLS connection with the slapd server. Postfix works fine when using /etc/postfix/ldap-aliases.cf etc to get info from the slapd server which demands that the client sends a certificate due to olcTLSVerifyClient: demand. This is with a self-signed CA, intermediate CA and client & server certificates. Dovecot journalctl error: lmtp(92847): Error: lmtp-server: conn unix:pid=92846,uid=89 [1]: rcpt patrick@<domain>: Failed to lookup user patrick@<domain>: Internal error occurred. Refer to server log for more information. # doveadm log errors Dec 15 22:35:41.655525 Error: auth: ldap(ldaps://<FQDN>:636): Connection lost to LDAP server, reconnecting <snipped many more of the same message> Slapd error: TLS trace: SSL_accept:before SSL initialization <snip> TLS trace: SSL_accept:TLSv1.3 early data TLS trace: SSL_accept:error in TLSv1.3 early data TLS trace: SSL_accept:TLSv1.3 early data TLS trace: SSL3 alert write:fatal:unknown TLS trace: SSL_accept:error in error TLS: can't accept: error:0A0000C7:SSL routines::peer did not return a certificate. TLS accept failure error=-1 id=1178, closing conn=1178 fd=15 closed (TLS negotiation failure) It seems that Dovecot does not send its client certificate to the slapd server when asked? Perhaps due to a config error? Example with postfix where the client cert is sent and mTLS succeeds: # postmap -q info@<domain> ldap:/etc/postfix/ldap-aliases.cf TLS trace: SSL_accept:before SSL initialization TLS trace: SSL_accept:before SSL initialization SSL_accept:SSLv3/TLS read SSL_accept:TLSv1.3 early data TLS trace: SSL_accept:error in TLSv1.3 early data TLS trace: SSL_accept:TLSv1.3 early data TLS certificate verification: depth: 2, err: 0, subject: /C=ZZ/ST=FooBar/O=Example/OU=IT/CN=ExampleCA issuer: /C=ZZ/ST=FooBar/O=Example/OU=IT/CN=ExampleCA TLS certificate verification: depth: 1, err: 0, subject: /C=ZZ/ST=FooBar/O=Example/OU=IT/CN=ExampleSubCA, issuer: /C=ZZ/ST=FooBar/O=Example/OU=IT/CN=ExampleCA TLS certificate verification: depth: 0, err: 0, subject: /CN=postfix-ldap, issuer: /C=ZZ/ST=FooBar/O=Example/OU=IT/CN=ExampleSubCA TLS trace: SSL_accept:TLSv1.3 read client compressed certificate TLS trace: SSL_accept:SSLv3/TLS read certificate verify TLS trace: SSL_accept:SSLv3/TLS read finished TLS trace: SSL_accept:SSLv3/TLS write session ticket TLS trace: SSL_accept:SSLv3/TLS write session ticket conn=1000 fd=13 TLS established tls_ssf=256 ssf=256 tls_proto=TLSv1.3 tls_cipher=TLS_AES_256_GCM_SHA384 Dovecot config # dovecot -n: # 2.4.2 (0962ed2104): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.2 (767418c3) # OS: Linux 6.17.11-300.fc43.aarch64 aarch64 Fedora release 43 (Forty Three) # Hostname: <FQDN> # 5 default setting changes since version 2.4.1 dovecot_config_version = 2.4.1 auth_mechanisms = plain dovecot_storage_version = 2.4.1 first_valid_uid = 1000 ldap_auth_dn = cn=dovecot,dc=hosted,dc=ldap ldap_auth_dn_password = # hidden, use -P to show it ldap_uris = ldaps://<FQDN> log_debug = category=ssl mail_driver = sdbox mail_gid = vmail mail_home = /var/mail/virtual/%{user | domain}/%{user | username} mail_path = ~/mail mail_uid = vmail protocols { imap = yes lmtp = yes } ssl = required ssl_cipher_list = PROFILE=SYSTEM ssl_cipher_suites = TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl_min_protocol = TLSv1.3 namespace inbox { inbox = yes separator = / } ssl_server { ca_file = /etc/pki/dovecot/certs/dovecot_ca_bundle.pem cert_file = /etc/pki/dovecot/certs/kronos.laimbock.nl.crt key_file = /etc/pki/dovecot/private/kronos.laimbock.nl_nopass.key.crt prefer_ciphers = server request_client_cert = yes require_crl = no } ssl_client { ca_file = /etc/pki/dovecot/certs/dovecot_ca_bundle.pem cert_file = /etc/pki/dovecot/certs/dovecot-ldap.crt key_file = /etc/pki/dovecot/private/dovecot-ldap_nopass.key.crt require_valid_cert = yes } protocol !smtp { auth_ssl_require_client_cert = yes } passdb ldap { ldap_base = ou=People,ou=%{ user | domain },dc=hosted,dc=ldap default_password_scheme = CRYPT fields { user = %{ldap:mail} } bind = yes filter = (&(objectClass=person)(mail=%{user})) } userdb ldap { ldap_base = ou=People,ou=%{ user | domain },dc=hosted,dc=ldap fields { user = %{ldap:mail} } filter = (&(objectClass=person)(uid=%{user})) } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } The dovecot_ca_bundle.pem is created with # cat subca.crt ca.crt > dovecot_ca_bundle.pem The RootCA is imported into the trust store via: # cp ca.crt /etc/pki/ca-trust/source/anchors/ # update-ca-trust extract The public certificates live in /etc/pki/dovecot/certs: lrwxrwxrwx. 1 root root 16 Dec 15 15:49 1c2dd8a4.0 -> dovecot-ldap.crt lrwxrwxrwx. 1 root root 22 Dec 15 15:49 8dafd16f.0 -> <FQDN>.crt lrwxrwxrwx. 1 root root 9 Dec 15 20:15 d18284cf.0 -> subca.crt -rw-r--r--. 1 root root 773 Dec 12 21:21 dhparam -rw-r--r--. 1 root root 3456 Dec 15 21:34 dovecot_ca_bundle.pem -rw-r--r--. 1 root root 1586 Dec 15 20:15 dovecot-ldap.crt -rw-r--r--. 1 root root 1655 Dec 15 20:15 <FQDN>.crt -rw-r--r--. 1 root root 1850 Dec 15 20:15 subca.crt The private keys live in /etc/pki/dovecot/private: -rw-------. 1 root root 1704 Dec 15 20:15 dovecot-ldap_nopass.key.crt -rw-------. 1 root root 1704 Dec 15 20:15 <FQDN>_nopass.key.crt SELinux: there are no AVCs in /var/log/audit/audit.log but to make sure I ran: # restorecon -v -F -R /etc/dovecot # restorecon -v -F -R /etc/pki/doveecot With setenforce 0 no change in results. The slapd config: dn: cn=config objectClass: olcGlobal cn: config olcArgsFile: /run/openldap/slapd.args olcPidFile: /run/openldap/slapd.pid olcPasswordCryptSaltFormat: $6$%s olcLogLevel: 1023 # cat subca.crt ca.crt > slapd_ca_bundle.pem olcTLSCACertificateFile: /etc/openldap/certs/slapd_ca_bundle.pem olcTLSCertificateFile: /etc/openldap/certs/<FQDN>.crt olcTLSCertificateKeyFile: /etc/openldap/certs/<FQDN>_nopass.key.crt olcTLSCipherSuite: TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 olcTLSVerifyClient: demand olcTLSCRLCheck: none I would appreciate any hints what I missed, what to read, where to look, etc If you need more info I'll be happy to provide. Thanks! Cheers, Patrick

1 0