- dovecot - dovecot.org

Problem w/ Dovecot authentication against AD
by Garry Glendown 13 Sep '17

13 Sep '17

Hi, I had to start using Dovecot on a machine as the new OS does not come with Cyrus IMAP anymore. After multiple problems, I managed to get everything working, including LDAP authentication against the (old) Novell LDAP server. Anyway, the authentication is supposed to be migrated to the new Windows AD. For other tools, I successfully migrated the config to use AD, but somehow Dovecot does not work as it should. I've been going back and forth, trying everything I could think of, but still can't get it to work. Here's the excerpt from the config file: hosts = 10.10.10.210 uris = ldap://10.10.10.210:389 dn = cn=Administrator,cn=Users,dc=srv,dc=SLD,dc=net dnpass = PASSWORD tls = no debug_level = -1 auth_bind = yes ldap_version = 3 base = DC=srv,dc=SLD,dc=net deref = never scope = subtree user_attrs = sAMAccountName=user user_filter = (&(sAMAccountName=%n)(objectclass=person)) pass_attrs = sAMAccountName=user pass_filter = (&(sAMAccountName=%n)(objectclass=person)) iterate_attrs = mail=user iterate_filter = (objectclass=person) default_pass_scheme = PLAIN The problem might be caused by the referal-info sent by the AD, which I can see both in the results dovecot gets (checked with tcpdump), as well as in ldapsearch ... apart from the actual search result, I always get three additional results: # refldap://DomainDnsZones.srv.SLD.net/DC=DomainDnsZones,DC=srv,DC=SLD,DC=net # refldap://ForestDnsZones.srv.SLD.net/DC=ForestDnsZones,DC=srv,DC=SLD,DC=net # refldap://srv.SLD.net/CN=Configuration,DC=srv,DC=SLD,DC=net >From what I can see in the pcap as well as some of the logs, dovecot binds to the AD, sends out the LDAP query correctly, gets the lookup result with the user queried plus the above three referrals, then unbinds from the (named) bind, attempts a simple bind without dn/dnpass (multiple times), and finally sends three additional search requests under the search bases cn=Configuration,DC=srv,DC=SLD,DC=net DC=ForestDnsZones,DC=srv,DC=SLD,DC=net DC=DomainDnsZones,DC=srv,DC=SLD,DC=net These three requests are denied by the AD as they are not permitted without a successful prior bind. Dovecot then fails the auth process. Is there a way to stop Dovecot from using the referals? Openldap seems to have an option to disable referals, but Dovecot does not allow that option in its LDAP config, and having the option set in the global ldap.conf doesn't seem to help any, either. Is there possibly a way to disable the referal information on the AD side? Thanks, Garry -- PGP Fingerprint: A79F A33F 5B13 BEB7 A51D 274F F99C 3AE2 4BCB 7015

3 3

Re: Dovecot and Letsencrypt certs
by Daniel Miller 13 Sep '17

13 Sep '17

And remove that "postfix reload" command - Postfix doesn't require explicit reloading. It'll pickup the changed cert automagically. Daniel On 9/12/2017 9:26 AM, Daniel Miller wrote: > What's wrong with using a certbot "post-hook" script such as: > > #!/bin/bash > echo "Letsencrypt renewal hook running..." > echo "RENEWED_DOMAINS=$RENEWED_DOMAINS" > echo "RENEWED_LINEAGE=$RENEWED_LINEAGE" > > if grep --quiet "your.email.domain" <<< "$RENEWED_DOMAINS"; then > /usr/local/sbin/dovecot reload > /usr/sbin/postfix reload > fi > > Daniel > > On 9/11/2017 1:57 PM, Joseph Tam wrote: >> <master(a)remort.net> writes: >> >>> "writing a script to check the certs" - there is no need to write any >>> scripts. As one mentioned, it's done by a hook to certbot. Please read >>> the manuals for LE or certbot. The issue you have is quite common and >>> of course certbot designed to do it for you. >> >> Won't work, of course, if you employ the least-privilege security >> principle >> and run the certbot as a non-privileged user. You'll need a script with >> administrator privileges to detect cert renewals and restart the >> service. >> >> I can't willy-nilly restart dovecot to pick up renewed certs without >> webmail disruptions. (My webmail uses persistent IMAP sessions.) >> All users get dumped and need to re-authenticate. If a user happens to >> be drafting a message that took 2 hours to compose, I will surely hear >> about it. I should probably install a IMAP proxy to isolate the effects >> of restarts. Most mail readers cope with restarts just fine, though. >> >> Joseph Tam <jtam.home(a)gmail.com>

3 3

Re: Dovecot and Letsencrypt certs
by Joseph Tam 13 Sep '17

13 Sep '17

On Tue, 12 Sep 2017, dovecot-request(a)dovecot.org wrote: > What's wrong with using a certbot "post-hook" script such as: > > #!/bin/bash > echo "Letsencrypt renewal hook running..." > echo "RENEWED_DOMAINS=$RENEWED_DOMAINS" > echo "RENEWED_LINEAGE=$RENEWED_LINEAGE" > > if grep --quiet "your.email.domain" <<< "$RENEWED_DOMAINS"; then > ??? /usr/local/sbin/dovecot reload > ?? /usr/sbin/postfix reload > fi Nothing, if you let your certbot run as root. (I'm assuming that's how these hooks work -- it's called after cert renewal using the same credentials as the certbot.) If you use privilege separation, and run the certbot as a regular user process, this won't work. You might have this scenario if, for example using the context of web serving, you serve many virtual sites with different owners, and you don't want give each owner administrative access. Joseph Tam <jtam.home(a)gmail.com>

2 1

Dynamic host with password plugin
by Jorge Bastos 12 Sep '17

12 Sep '17

Howdy, I’m making my multi-server instalation ready, but I’m facing just one small issue, that is with password plugin. So, in config.inc.php of it I have: config['password_db_dsn'] = 'mysql://webmail:bdkddddddz@192.168.69.222/postfix'; but, as I’m using in roundcube’s config.inc.php “dynamic” host: $config['default_host'] = 'mail.%s'; Can I have in the password plugin config.inc.php the same variable? (I can use same user/password/db on both servers for password change) Thanks in advanced,

1 0

Re: Dovecot and Letsencrypt certs
by Joseph Tam 12 Sep '17

12 Sep '17

<master(a)remort.net> writes: > "writing a script to check the certs" - there is no need to write any > scripts. As one mentioned, it's done by a hook to certbot. Please read > the manuals for LE or certbot. The issue you have is quite common and > of course certbot designed to do it for you. Won't work, of course, if you employ the least-privilege security principle and run the certbot as a non-privileged user. You'll need a script with administrator privileges to detect cert renewals and restart the service. I can't willy-nilly restart dovecot to pick up renewed certs without webmail disruptions. (My webmail uses persistent IMAP sessions.) All users get dumped and need to re-authenticate. If a user happens to be drafting a message that took 2 hours to compose, I will surely hear about it. I should probably install a IMAP proxy to isolate the effects of restarts. Most mail readers cope with restarts just fine, though. Joseph Tam <jtam.home(a)gmail.com>

2 1

RE: dovecot Digest, Vol 173, Issue 28 (INTERNAL)
by Arvid.Eikas＠telenor.com 12 Sep '17

12 Sep '17

Hi, I enabled rawlog. Everything seems to be OK but the dovecot-log shows a fatal error and core dump. (created a core file) Arvid Rawlog in <<< STAT >>> <<< LIST >>> <<< UIDL 1 >>> <<< UIDL >>> <<< QUIT >>> Rawlog out <<< +OK Logged in. >>> <<< +OK 22 17589388 >>> <<< +OK 22 messages: 1 6725 ¨¨¨¨¨¨ 22 17387080 . >>> <<< +OK 1 1504264023.M267772P16598V0000000000000027I00000000046A5436.nsmx2.nsc.no,S=6571 >>> <<< +OK 1 1504264023.M267772P16598V0000000000000027I00000000046A5436.nsmx2.nsc.no,S=6571 ........ 22 1505125157.M901211P7821V0000000000000027I00000000046A340F.nsmx2.nsc.no,S=17164095 . >>> <<< +OK Logging out. >>> DOVECOT LOG Sep 12 11:40:56 pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 read finished A [88.89.118.45] Sep 12 11:40:56 pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write session ticket A [88.89.118.45] Sep 12 11:40:56 pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [88.89.118.45] Sep 12 11:40:56 pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 write finished A [88.89.118.45] Sep 12 11:40:56 pop3-login: Debug: SSL: where=0x2001, ret=1: SSLv3 flush data [88.89.118.45] Sep 12 11:40:56 pop3-login: Debug: SSL: where=0x20, ret=1: SSL negotiation finished successfully [88.89.118.45] Sep 12 11:40:56 pop3-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [88.89.118.45] Sep 12 11:40:56 pop3-login: Info: Login: user=<viboge>, method=PLAIN, rip=88.89.118.45, lip=148.123.160.116, mpid=18250, TLS, session=<nR4H1/pYvc1YWXYt> Sep 12 11:40:56 pop3(viboge) Session-ID nR4H1/pYvc1YWXYt RemoteIP 88.89.118.45 Maildir /var/nextmail/nfs2.flex14/49/79/841 Info: Disconnected: Logged out top=0/0, retr=0/0, del=0/22, size=17589388, totalread=32, totalsent=2181, uidl=22/50a23327 Sep 12 11:40:56 pop3-login: Debug: SSL alert: close notify [88.89.118.45] Sep 12 11:40:56 pop3-login: Error: ENGINE_finish, bad functional reference count Sep 12 11:40:56 pop3-login: Fatal: master: service(pop3-login): child 18247 killed with signal 6 (core dumped) -----Original Message----- From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] Sent: 12. september 2017 08:37 To: dovecot(a)dovecot.org; Eikås Arvid Subject: Re: dovecot Digest, Vol 173, Issue 28 (INTERNAL) ~$ openssl s_client -connect 192.168.122.14:110 -starttls pop3 CONNECTED(00000003) <snip/> Verify return code: 10 (certificate has expired) --- +OK Dovecot ready. USER testuser1 +OK PASS pass +OK Logged in. LIST +OK 11 messages: 1 14 2 14 3 14 4 14 5 14 6 14 7 14 8 14 9 14 10 14 11 14 . QUIT DONE and no crash occurs. Using Dovecot v2.2.32 (dfbe293) Aki On 12.09.2017 09:33, Arvid.Eikas(a)telenor.com wrote: > Hi, > > It is quite easy. > I use a client (thunderbird or windows live mail) set it up to use starttls on standard port 110. Logon and just do a list on the mailbox. The fatal error occurred when I logoff. > > Arvid > > -----Original Message----- > From: dovecot [mailto:dovecot-bounces@dovecot.org] On Behalf Of > dovecot-request(a)dovecot.org > Sent: 11. september 2017 14:57 > To: dovecot(a)dovecot.org > Subject: dovecot Digest, Vol 173, Issue 28 > > Send dovecot mailing list submissions to > dovecot(a)dovecot.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://dovecot.org/mailman/listinfo/dovecot > or, via email, send a message with subject or body 'help' to > dovecot-request(a)dovecot.org > > You can reach the person managing the list at > dovecot-owner(a)dovecot.org > > When replying, please edit your Subject line so it is more specific than "Re: Contents of dovecot digest..." > > > Today's Topics: > > 1. Re: pop3-login core dump when using TLSSTART on version > dovecot-2.2.32 (INTERNAL) (Aki Tuomi) > 2. Re: Per-user quota (passwd) (Evgeniy Korneechev) > 3. Re: Per-user quota (passwd) (Aki Tuomi) > 4. Re: Is it possible to disable pipelining in imapc? (Nagy, > Attila) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 11 Sep 2017 13:57:19 +0300 > From: Aki Tuomi <aki.tuomi(a)dovecot.fi> > To: dovecot(a)dovecot.org > Subject: Re: pop3-login core dump when using TLSSTART on version > dovecot-2.2.32 (INTERNAL) > Message-ID: <cd450054-53c4-2f84-eba7-7ce602c26892(a)dovecot.fi> > Content-Type: text/plain; charset=utf-8 > > Can you outline the exact steps you perform to get this? > > Aki > > On 11.09.2017 13:42, Arvid.Eikas(a)telenor.com wrote: >> Hi, >> >> I switched back to 2.2.27 with the same config that I am using for 2.2.32 and it work fine. >> >> Sep 11 11:49:37 imap-login: Info: Login: user=<viboge>, method=PLAIN, >> rip=88.89.118.45, lip=148.123.160.116, mpid=18709, TLS, >> session=<v7o22OZYrsdYWXYt> Sep 11 11:49:40 imap(mailuser) Session-ID >> v7o22OZYrsdYWXYt RemoteIP 88.89.118.45 Maildir >> /var/nextmail/nfs2.flex14/49/79/841 Info: Logged out in=4518 >> out=273720 deleted 0 expunged 0 trashed 0 Sep 11 11:49:40 imap-login: >> Debug: SSL alert: close notify [88.89.118.45] >> >> How could I proceed? Any clue? It is quite annoying to see this entry in the log for each session. >> >> Arvid >> >> >> >> >> -----Original Message----- >> From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] >> Sent: 11. september 2017 09:18 >> To: Eik?s Arvid; dovecot(a)dovecot.org >> Subject: Re: pop3-login core dump when using TLSSTART on version >> dovecot-2.2.32 (INTERNAL) >> >> Hi! >> >> I tried to reproduce this problem with dovecot-2.2.32 and OpenSSL 1.0.1k and was not able to. I enabled -DREF_CHECK on OpenSSL, but to no avail, the process did not crash. Is there something else you've done? >> >> Aki >> >> >> On 11.09.2017 08:07, Arvid.Eikas(a)telenor.com wrote: >>> Hi, >>> >>> Here is the gdb output. >>> >>> Arvid >>> >>> GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) >>> 2013 Free Software Foundation, Inc. >>> License GPLv3+: GNU GPL version 3 or later >>> <http://gnu.org/licenses/gpl.html> >>> This is free software: you are free to change and redistribute it. >>> There is NO WARRANTY, to the extent permitted by law. Type "show copying" >>> and "show warranty" for details. >>> This GDB was configured as "x86_64-redhat-linux-gnu". >>> For bug reporting instructions, please see: >>> <http://www.gnu.org/software/gdb/bugs/>... >>> Reading symbols from /local/misc/mail/dovecot-32/libexec/dovecot/pop3-login...done. >>> [New LWP 15894] >>> Core was generated by `dovecot-test/pop3-login'. >>> Program terminated with signal 6, Aborted. >>> #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 Missing >>> separate debuginfos, use: debuginfo-install >>> glibc-2.17-157.el7_3.1.x86_64 >>> (gdb) bt full >>> #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 No symbol >>> table info available. >>> #1 0x00007ff0bd9d08c8 in abort () from /lib64/libc.so.6 No symbol >>> table info available. >>> #2 0x00007ff0bd3c0f2f in engine_unlocked_finish (e=0x1c51c60, unlock_for_handlers=1) at eng_init.c:115 >>> to_return = 1 >>> #3 0x00007ff0bd3c1064 in ENGINE_finish (e=0x1c51c60) at eng_init.c:150 >>> to_return = 1 >>> #4 0x00007ff0be0f9300 in ssl_proxy_deinit () from >>> /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 >>> No symbol table info available. >>> #5 0x00007ff0be0f4472 in main_deinit () from >>> /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 >>> No symbol table info available. >>> #6 0x00007ff0be0f479f in login_binary_run () from >>> /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 >>> No symbol table info available. >>> #7 0x00000000004032da in main (argc=1, argv=0x7ffe3059f3f8) at >>> client.c:356 No locals. >>> >>> >>> >>> -----Original Message----- >>> From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] >>> Sent: 8. september 2017 14:08 >>> To: Eik?s Arvid; dovecot(a)dovecot.org >>> Subject: Re: pop3-login core dump when using TLSSTART on version >>> dovecot-2.2.32 (OPEN) >>> >>> I assume you mean STARTTLS. Can you provide gdb /path/to/bin /path/to/core and provide output of bt full? >>> >>> Aki >>> >>> >>> On 08.09.2017 15:01, Arvid.Eikas(a)telenor.com wrote: >>>> Hi, >>>> >>>> Pop3-login are CORE-dumping when I log on with TLSSTART, I believe the same will happen with imap-logon to, but I have not tested it yet. >>>> The TLS session is coming up and it works fine until I log off, then it's core dump. Open sslvesrion is openssl-1.0.2k. >>>> We ran dovecot-2.2.27 before we upgraded to dovecote-2.2.32, and >>>> that seems to work fine. (not core dumping) >>>> >>>> >>>> Arvid >>>> >>>> >>>> LOG >>>> Sep 05 14:27:34 pop3-login: Debug: SSL: elliptic curve secp384r1 >>>> will be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: >>>> Debug: SSL: elliptic curve secp384r1 will be used for ECDH and >>>> ECDHE key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: >>>> elliptic curve >>>> secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 >>>> 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be >>>> used for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: >>>> SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key >>>> exchanges Sep 05 14:30:50 pop3-login: Info: Login: user=<tstrand>, >>>> method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18361, secured, >>>> session=<65m8ZXBYtpN/AAAB> Sep 05 14:30:50 pop3-login: Error: >>>> ENGINE_finish, bad functional reference count Sep 05 14:30:50 >>>> pop3-login: Fatal: master: service(pop3-login): child 18359 killed >>>> with signal 6 (core dumped) >>>> >>>> >>>> >>>> >>>> >>>> >>>> From ./crypto/engine/eng_init.c >>>> >>>> ......... >>>> int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { >>>> int to_return = 1; >>>> >>>> /* >>>> * Reduce the functional reference count here so if it's the terminating >>>> * case, we can release the lock safely and call the finish() handler >>>> * without risk of a race. We get a race if we leave the count until >>>> * after and something else is calling "finish" at the same time - >>>> * there's a chance that both threads will together take the count from 2 >>>> * to 0 without either calling finish(). >>>> */ >>>> e->funct_ref--; >>>> engine_ref_debug(e, 1, -1); >>>> if ((e->funct_ref == 0) && e->finish) { >>>> if (unlock_for_handlers) >>>> CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); >>>> to_return = e->finish(e); >>>> if (unlock_for_handlers) >>>> CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); >>>> if (!to_return) >>>> return 0; >>>> } >>>> #ifdef REF_CHECK >>>> if (e->funct_ref < 0) { >>>> fprintf(stderr, "ENGINE_finish, bad functional reference count\n"); >>>> abort(); >>>> >>>> ......... >>>> >>>> /* The API (locked) version of "finish" */ int ENGINE_finish(ENGINE >>>> *e) { >>>> int to_return = 1; >>>> >>>> if (e == NULL) { >>>> ENGINEerr(ENGINE_F_ENGINE_FINISH, ERR_R_PASSED_NULL_PARAMETER); >>>> return 0; >>>> } >>>> CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); >>>> to_return = engine_unlocked_finish(e, 1); >>>> CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); >>>> if (!to_return) { >>>> ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED); >>>> return 0; >>>> } >>>> return to_return; >>>> } > > > ------------------------------ > > Message: 2 > Date: Mon, 11 Sep 2017 14:48:47 +0300 (MSK) > From: Evgeniy Korneechev <ekorneechev(a)altlinux.org> > To: Aki Tuomi <aki.tuomi(a)dovecot.fi> > Cc: dovecot <dovecot(a)dovecot.org> > Subject: Re: Per-user quota (passwd) > Message-ID: > <2046000051.747964.1505130527842.JavaMail.zimbra(a)remotesystems.ru> > Content-Type: text/plain; charset=utf-8 > > Hi. > But there is one problem... > > protocol lda { > mail_plugins = " quota autocreate sieve quota" > plugin { > quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage > } > } > protocol imap { > mail_plugins = " quota autocreate autocreate imap_quota" > plugin { > autocreate = INBOX > autocreate2 = Sent > autocreate3 = Trash > autocreate4 = Drafts > autocreate5 = Junk > autosubscribe = INBOX > autosubscribe2 = Sent > autosubscribe3 = Trash > autosubscribe4 = Drafts > autosubscribe5 = Junk > quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage > } > } > >> Users with non-standard quota in passwd-file: >>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admin >>>>>>>> i strator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home >>>>>>>> / DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >> Others from passwd. > > > Files ".quotausage" are created in different directories: > /var/vmail/glu_vrem/administrator\DOM/.quotausage > /var/vmail/glu_vrem/administrator(a)email.dom/.quotausage > And must in the folder "/var/vmail/glu_vrem/administrator" > > How fix it? > > > ----- ???????? ????????? ----- >> ??: "Evgeniy Korneechev" <ekorneechev(a)altlinux.org> >> ????: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >> ?????: "dovecot" <dovecot(a)dovecot.org> >> ????????????: ???????, 30 ???? 2017 ? 10:39:16 >> ????: Re: Per-user quota (passwd) >> Our solution: >> userdb { >> args = /etc/imap.passwd >> driver = passwd-file >> override_fields = home=/var/vmail/glu_vrem/%u } userdb { driver = >> passwd override_fields = home=/var/vmail/glu_vrem/%u } >> >> Users with non-standard quota in passwd-file: >>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admin >>>>>>>> i strator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home >>>>>>>> / DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >> Others from passwd. >> >> Its works! Thanks. >> >> >> ----- ???????? ????????? ----- >>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>> ????: "dovecot" <dovecot(a)dovecot.org> >>> ????????????: ???????, 29 ???? 2017 ? 14:40:44 >>> ????: Re: Per-user quota (passwd) >>> Oh you have multiple db's, I missed that. >>> >>> Remove auth_username_format, and instead >>> >>> userdb { >>> args = /etc/imap.passwd username_format=%Ln driver = passwd-file >>> override_fields = home=/var/vmail/glu_vrem/%u } >>> >>> On 29.06.2017 14:35, Evgeniy Korneechev wrote: >>>> with auth_username_format = %Ln: >>>> >>>> Jun 28 14:43:41 auth: Debug: master in: USER 1 iivanov.ia(a)example.com >>>> service=lda >>>> Jun 28 14:43:41 auth-worker(18369): Debug: passwd(iivanov.ia): >>>> lookup Jun 28 14:43:41 auth-worker(18369): Info: passwd(iivanov.ia): >>>> unknown user - trying the next userdb Jun 28 14:43:41 >>>> auth-worker(18369): Debug: sql(iivanov.ia): SELECT email as user, >>>> maildir as home, CONCAT('maildir:', maildir, '/Maildir') as mail, >>>> uid, gid, \ >>>> CONCAT('*:storage=', quota, 'B') AS quota_rule, CONCAT(maildir, '/.sieve') as >>>> sieve FROM mail_user WHERE (login = 'iivanov.ia' OR email = >>>> 'iivanov.ia') Jun 28 14:43:41 auth-worker(18369): Info: >>>> sql(iivanov.ia): unknown user >>>> >>>> Maybe %Lu? >>>> >>>> ----- ???????? ????????? ----- >>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>> ????????????: ???????, 29 ???? 2017 ? 14:10:07 >>>>> ????: Re: Per-user quota (passwd) >>>>> Yes. >>>>> >>>>> Aki >>>>> >>>>> On 29.06.2017 14:07, Evgeniy Korneechev wrote: >>>>>> And if such a user: >>>>>> email (from AD) = ivanov.ia(a)example.com login (from AD), %n = >>>>>> iivanov %d = DOM %u = iivanov@DOM >>>>>> >>>>>> ? >>>>>> >>>>>> ----- ???????? ????????? ----- >>>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>>> ????????????: ???????, 29 ???? 2017 ? 13:59:05 >>>>>>> ????: Re: Per-user quota (passwd) or use, as I indicated before, >>>>>>> auth_username_format = %Ln >>>>>>> >>>>>>> Aki >>>>>>> >>>>>>> >>>>>>> On 29.06.2017 13:58, Evgeniy Korneechev wrote: >>>>>>>> Hi! >>>>>>>> workaround: >>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admin >>>>>>>> i strator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home >>>>>>>> / DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> >>>>>>>> But this is not a solution for 1000 users ... >>>>>>>> Maybe is there extra field "userdb_mail=administrator(a)email.dom" >>>>>>>> for email to passwd-file? >>>>>>>> >>>>>>>> ----- ???????? ????????? ----- >>>>>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>>>>> ????????????: ?????, 28 ???? 2017 ? 12:40:48 >>>>>>>>> ????: Re: Per-user quota (passwd) On 28.06.2017 12:36, Aki >>>>>>>>> Tuomi wrote: >>>>>>>>>> On 28.06.2017 12:25, Evgeniy Korneechev wrote: >>>>>>>>>>> Hello! >>>>>>>>>>> We have passwd=pam, userdb=passwd. >>>>>>>>>>> passdb { >>>>>>>>>>> driver = pam #server was entered domain Active Directory } >>>>>>>>>>> userdb { >>>>>>>>>>> driver = passwd >>>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u } >>>>>>>>>>> >>>>>>>>>>> How can i use per-user quota? Only passwd-file? >>>>>>>>>>> >>>>>>>>>>> I tried: >>>>>>>>>>> userdb { >>>>>>>>>>> args = /etc/imap.passwd >>>>>>>>>>> driver = passwd-file >>>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u } >>>>>>>>>>> /etc/imap.passwd: >>>>>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/ad >>>>>>>>>>> m inistrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>>>> >>>>>>>>>>> Authentication and quota - now OK. But doesn't work sending >>>>>>>>>>> and receiving mail... >>>>>>>>>>> postfix say 'Unknown user'... >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Turn on auth_debug and auth_verbose and see what it says. >>>>>>>>>>> >>>>>>>>>>> Aki >>>>>>>>> Also you can set auth_username_format = %Ln to force usernames >>>>>>>>> into lowercase without domain. >>>>>>>>> >>>>>>>>> Aki >> -- >> WBR, Korneechev Evgeniy >> BaseALT/ALTLinux Team > -- > WBR, Korneechev Evgeniy > BaseALT/ALTLinux Team > > > ------------------------------ > > Message: 3 > Date: Mon, 11 Sep 2017 14:51:13 +0300 > From: Aki Tuomi <aki.tuomi(a)dovecot.fi> > To: dovecot(a)dovecot.org > Subject: Re: Per-user quota (passwd) > Message-ID: <7e86447f-10e6-51a3-ce8a-3c4c8261bac1(a)dovecot.fi> > Content-Type: text/plain; charset=utf-8 > > Hi! > Just so you know, autocreate/autosubscribe is deprecated, you should > use > > namespace { > mailbox INBOX { > auto = subscribe > } > } > > can you run > > doveadm user administrator(a)email.dom > > to verify that mail_home gets set correctly? > > Aki > > On 11.09.2017 14:48, Evgeniy Korneechev wrote: >> Hi. >> But there is one problem... >> >> protocol lda { >> mail_plugins = " quota autocreate sieve quota" >> plugin { >> quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage >> } >> } >> protocol imap { >> mail_plugins = " quota autocreate autocreate imap_quota" >> plugin { >> autocreate = INBOX >> autocreate2 = Sent >> autocreate3 = Trash >> autocreate4 = Drafts >> autocreate5 = Junk >> autosubscribe = INBOX >> autosubscribe2 = Sent >> autosubscribe3 = Trash >> autosubscribe4 = Drafts >> autosubscribe5 = Junk >> quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage >> } >> } >> >>> Users with non-standard quota in passwd-file: >>>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admi >>>>>>>>> nistrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/hom >>>>>>>>> e/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>> Others from passwd. >> >> Files ".quotausage" are created in different directories: >> /var/vmail/glu_vrem/administrator\DOM/.quotausage >> /var/vmail/glu_vrem/administrator(a)email.dom/.quotausage >> And must in the folder "/var/vmail/glu_vrem/administrator" >> >> How fix it? >> >> >> ----- ???????? ????????? ----- >>> ??: "Evgeniy Korneechev" <ekorneechev(a)altlinux.org> >>> ????: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>> ?????: "dovecot" <dovecot(a)dovecot.org> >>> ????????????: ???????, 30 ???? 2017 ? 10:39:16 >>> ????: Re: Per-user quota (passwd) >>> Our solution: >>> userdb { >>> args = /etc/imap.passwd >>> driver = passwd-file >>> override_fields = home=/var/vmail/glu_vrem/%u } userdb { driver = >>> passwd override_fields = home=/var/vmail/glu_vrem/%u } >>> >>> Users with non-standard quota in passwd-file: >>>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admi >>>>>>>>> nistrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/hom >>>>>>>>> e/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>> Others from passwd. >>> >>> Its works! Thanks. >>> >>> >>> ----- ???????? ????????? ----- >>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>> ????????????: ???????, 29 ???? 2017 ? 14:40:44 >>>> ????: Re: Per-user quota (passwd) >>>> Oh you have multiple db's, I missed that. >>>> >>>> Remove auth_username_format, and instead >>>> >>>> userdb { >>>> args = /etc/imap.passwd username_format=%Ln driver = passwd-file >>>> override_fields = home=/var/vmail/glu_vrem/%u } >>>> >>>> On 29.06.2017 14:35, Evgeniy Korneechev wrote: >>>>> with auth_username_format = %Ln: >>>>> >>>>> Jun 28 14:43:41 auth: Debug: master in: USER 1 iivanov.ia(a)example.com >>>>> service=lda >>>>> Jun 28 14:43:41 auth-worker(18369): Debug: passwd(iivanov.ia): >>>>> lookup Jun 28 14:43:41 auth-worker(18369): Info: >>>>> passwd(iivanov.ia): unknown user - trying the next userdb Jun 28 >>>>> 14:43:41 auth-worker(18369): Debug: sql(iivanov.ia): SELECT email >>>>> as user, maildir as home, CONCAT('maildir:', maildir, '/Maildir') >>>>> as mail, uid, gid, \ >>>>> CONCAT('*:storage=', quota, 'B') AS quota_rule, CONCAT(maildir, '/.sieve') as >>>>> sieve FROM mail_user WHERE (login = 'iivanov.ia' OR email = >>>>> 'iivanov.ia') Jun 28 14:43:41 auth-worker(18369): Info: >>>>> sql(iivanov.ia): unknown user >>>>> >>>>> Maybe %Lu? >>>>> >>>>> ----- ???????? ????????? ----- >>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>> ????????????: ???????, 29 ???? 2017 ? 14:10:07 >>>>>> ????: Re: Per-user quota (passwd) Yes. >>>>>> >>>>>> Aki >>>>>> >>>>>> On 29.06.2017 14:07, Evgeniy Korneechev wrote: >>>>>>> And if such a user: >>>>>>> email (from AD) = ivanov.ia(a)example.com login (from AD), %n = >>>>>>> iivanov %d = DOM %u = iivanov@DOM >>>>>>> >>>>>>> ? >>>>>>> >>>>>>> ----- ???????? ????????? ----- >>>>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>>>> ????????????: ???????, 29 ???? 2017 ? 13:59:05 >>>>>>>> ????: Re: Per-user quota (passwd) or use, as I indicated >>>>>>>> before, auth_username_format = %Ln >>>>>>>> >>>>>>>> Aki >>>>>>>> >>>>>>>> >>>>>>>> On 29.06.2017 13:58, Evgeniy Korneechev wrote: >>>>>>>>> Hi! >>>>>>>>> workaround: >>>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admi >>>>>>>>> nistrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/hom >>>>>>>>> e/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>>> >>>>>>>>> But this is not a solution for 1000 users ... >>>>>>>>> Maybe is there extra field >>>>>>>>> "userdb_mail=administrator(a)email.dom" for email to passwd-file? >>>>>>>>> >>>>>>>>> ----- ???????? ????????? ----- >>>>>>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>>>>>> ????????????: ?????, 28 ???? 2017 ? 12:40:48 >>>>>>>>>> ????: Re: Per-user quota (passwd) On 28.06.2017 12:36, Aki >>>>>>>>>> Tuomi wrote: >>>>>>>>>>> On 28.06.2017 12:25, Evgeniy Korneechev wrote: >>>>>>>>>>>> Hello! >>>>>>>>>>>> We have passwd=pam, userdb=passwd. >>>>>>>>>>>> passdb { >>>>>>>>>>>> driver = pam #server was entered domain Active Directory >>>>>>>>>>>> } userdb { >>>>>>>>>>>> driver = passwd >>>>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u } >>>>>>>>>>>> >>>>>>>>>>>> How can i use per-user quota? Only passwd-file? >>>>>>>>>>>> >>>>>>>>>>>> I tried: >>>>>>>>>>>> userdb { >>>>>>>>>>>> args = /etc/imap.passwd >>>>>>>>>>>> driver = passwd-file >>>>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u } >>>>>>>>>>>> /etc/imap.passwd: >>>>>>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/a >>>>>>>>>>>> dministrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>>>>> >>>>>>>>>>>> Authentication and quota - now OK. But doesn't work sending >>>>>>>>>>>> and receiving mail... >>>>>>>>>>>> postfix say 'Unknown user'... >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> Turn on auth_debug and auth_verbose and see what it says. >>>>>>>>>>>> >>>>>>>>>>>> Aki >>>>>>>>>> Also you can set auth_username_format = %Ln to force >>>>>>>>>> usernames into lowercase without domain. >>>>>>>>>> >>>>>>>>>> Aki >>> -- >>> WBR, Korneechev Evgeniy >>> BaseALT/ALTLinux Team > > > ------------------------------ > > Message: 4 > Date: Mon, 11 Sep 2017 14:56:28 +0200 > From: "Nagy, Attila" <bra(a)fsn.hu> > To: Aki Tuomi <aki.tuomi(a)dovecot.fi>, dovecot(a)dovecot.org > Subject: Re: Is it possible to disable pipelining in imapc? > Message-ID: <a6ced659-fa75-60c9-01f7-bfb36e826466(a)fsn.hu> > Content-Type: text/plain; charset=utf-8; format=flowed > > On 09/11/2017 12:12 PM, Aki Tuomi wrote: >> Is there some reason you can't use normal proxy instead of imap backend? >> That is,return proxy, host=imap_backend, port=1430? There seems to be >> no pipeline setting currently for imapc in v2.2. >> > Yes, because it's a dumb IMAP server, which doesn't implement a lot of > things, like SEARCH, FETCH BODYSTRUCTURE and similar. > Dovecot is used as a smart proxy, which makes it possible to use it as > a fully featured IMAP server. > > > ------------------------------ > > Subject: Digest Footer > > _______________________________________________ > dovecot mailing list > dovecot(a)dovecot.org > https://dovecot.org/mailman/listinfo/dovecot > > ------------------------------ > > End of dovecot Digest, Vol 173, Issue 28 > ****************************************

2 1

RE: dovecot Digest, Vol 173, Issue 28 (INTERNAL)
by Arvid.Eikas＠telenor.com 12 Sep '17

12 Sep '17

Hi, It is quite easy. I use a client (thunderbird or windows live mail) set it up to use starttls on standard port 110. Logon and just do a list on the mailbox. The fatal error occurred when I logoff. Arvid -----Original Message----- From: dovecot [mailto:dovecot-bounces@dovecot.org] On Behalf Of dovecot-request(a)dovecot.org Sent: 11. september 2017 14:57 To: dovecot(a)dovecot.org Subject: dovecot Digest, Vol 173, Issue 28 Send dovecot mailing list submissions to dovecot(a)dovecot.org To subscribe or unsubscribe via the World Wide Web, visit https://dovecot.org/mailman/listinfo/dovecot or, via email, send a message with subject or body 'help' to dovecot-request(a)dovecot.org You can reach the person managing the list at dovecot-owner(a)dovecot.org When replying, please edit your Subject line so it is more specific than "Re: Contents of dovecot digest..." Today's Topics: 1. Re: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (INTERNAL) (Aki Tuomi) 2. Re: Per-user quota (passwd) (Evgeniy Korneechev) 3. Re: Per-user quota (passwd) (Aki Tuomi) 4. Re: Is it possible to disable pipelining in imapc? (Nagy, Attila) ---------------------------------------------------------------------- Message: 1 Date: Mon, 11 Sep 2017 13:57:19 +0300 From: Aki Tuomi <aki.tuomi(a)dovecot.fi> To: dovecot(a)dovecot.org Subject: Re: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (INTERNAL) Message-ID: <cd450054-53c4-2f84-eba7-7ce602c26892(a)dovecot.fi> Content-Type: text/plain; charset=utf-8 Can you outline the exact steps you perform to get this? Aki On 11.09.2017 13:42, Arvid.Eikas(a)telenor.com wrote: > Hi, > > I switched back to 2.2.27 with the same config that I am using for 2.2.32 and it work fine. > > Sep 11 11:49:37 imap-login: Info: Login: user=<viboge>, method=PLAIN, > rip=88.89.118.45, lip=148.123.160.116, mpid=18709, TLS, > session=<v7o22OZYrsdYWXYt> Sep 11 11:49:40 imap(mailuser) Session-ID > v7o22OZYrsdYWXYt RemoteIP 88.89.118.45 Maildir > /var/nextmail/nfs2.flex14/49/79/841 Info: Logged out in=4518 > out=273720 deleted 0 expunged 0 trashed 0 Sep 11 11:49:40 imap-login: > Debug: SSL alert: close notify [88.89.118.45] > > How could I proceed? Any clue? It is quite annoying to see this entry in the log for each session. > > Arvid > > > > > -----Original Message----- > From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] > Sent: 11. september 2017 09:18 > To: Eik?s Arvid; dovecot(a)dovecot.org > Subject: Re: pop3-login core dump when using TLSSTART on version > dovecot-2.2.32 (INTERNAL) > > Hi! > > I tried to reproduce this problem with dovecot-2.2.32 and OpenSSL 1.0.1k and was not able to. I enabled -DREF_CHECK on OpenSSL, but to no avail, the process did not crash. Is there something else you've done? > > Aki > > > On 11.09.2017 08:07, Arvid.Eikas(a)telenor.com wrote: >> Hi, >> >> Here is the gdb output. >> >> Arvid >> >> GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) >> 2013 Free Software Foundation, Inc. >> License GPLv3+: GNU GPL version 3 or later >> <http://gnu.org/licenses/gpl.html> >> This is free software: you are free to change and redistribute it. >> There is NO WARRANTY, to the extent permitted by law. Type "show copying" >> and "show warranty" for details. >> This GDB was configured as "x86_64-redhat-linux-gnu". >> For bug reporting instructions, please see: >> <http://www.gnu.org/software/gdb/bugs/>... >> Reading symbols from /local/misc/mail/dovecot-32/libexec/dovecot/pop3-login...done. >> [New LWP 15894] >> Core was generated by `dovecot-test/pop3-login'. >> Program terminated with signal 6, Aborted. >> #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 Missing >> separate debuginfos, use: debuginfo-install >> glibc-2.17-157.el7_3.1.x86_64 >> (gdb) bt full >> #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 No symbol >> table info available. >> #1 0x00007ff0bd9d08c8 in abort () from /lib64/libc.so.6 No symbol >> table info available. >> #2 0x00007ff0bd3c0f2f in engine_unlocked_finish (e=0x1c51c60, unlock_for_handlers=1) at eng_init.c:115 >> to_return = 1 >> #3 0x00007ff0bd3c1064 in ENGINE_finish (e=0x1c51c60) at eng_init.c:150 >> to_return = 1 >> #4 0x00007ff0be0f9300 in ssl_proxy_deinit () from >> /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 >> No symbol table info available. >> #5 0x00007ff0be0f4472 in main_deinit () from >> /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 >> No symbol table info available. >> #6 0x00007ff0be0f479f in login_binary_run () from >> /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 >> No symbol table info available. >> #7 0x00000000004032da in main (argc=1, argv=0x7ffe3059f3f8) at >> client.c:356 No locals. >> >> >> >> -----Original Message----- >> From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] >> Sent: 8. september 2017 14:08 >> To: Eik?s Arvid; dovecot(a)dovecot.org >> Subject: Re: pop3-login core dump when using TLSSTART on version >> dovecot-2.2.32 (OPEN) >> >> I assume you mean STARTTLS. Can you provide gdb /path/to/bin /path/to/core and provide output of bt full? >> >> Aki >> >> >> On 08.09.2017 15:01, Arvid.Eikas(a)telenor.com wrote: >>> Hi, >>> >>> Pop3-login are CORE-dumping when I log on with TLSSTART, I believe the same will happen with imap-logon to, but I have not tested it yet. >>> The TLS session is coming up and it works fine until I log off, then it's core dump. Open sslvesrion is openssl-1.0.2k. >>> We ran dovecot-2.2.27 before we upgraded to dovecote-2.2.32, and >>> that seems to work fine. (not core dumping) >>> >>> >>> Arvid >>> >>> >>> LOG >>> Sep 05 14:27:34 pop3-login: Debug: SSL: elliptic curve secp384r1 >>> will be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: >>> Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE >>> key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve >>> secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 >>> 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be >>> used for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: >>> SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key >>> exchanges Sep 05 14:30:50 pop3-login: Info: Login: user=<tstrand>, >>> method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18361, secured, >>> session=<65m8ZXBYtpN/AAAB> Sep 05 14:30:50 pop3-login: Error: >>> ENGINE_finish, bad functional reference count Sep 05 14:30:50 >>> pop3-login: Fatal: master: service(pop3-login): child 18359 killed >>> with signal 6 (core dumped) >>> >>> >>> >>> >>> >>> >>> From ./crypto/engine/eng_init.c >>> >>> ......... >>> int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { >>> int to_return = 1; >>> >>> /* >>> * Reduce the functional reference count here so if it's the terminating >>> * case, we can release the lock safely and call the finish() handler >>> * without risk of a race. We get a race if we leave the count until >>> * after and something else is calling "finish" at the same time - >>> * there's a chance that both threads will together take the count from 2 >>> * to 0 without either calling finish(). >>> */ >>> e->funct_ref--; >>> engine_ref_debug(e, 1, -1); >>> if ((e->funct_ref == 0) && e->finish) { >>> if (unlock_for_handlers) >>> CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); >>> to_return = e->finish(e); >>> if (unlock_for_handlers) >>> CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); >>> if (!to_return) >>> return 0; >>> } >>> #ifdef REF_CHECK >>> if (e->funct_ref < 0) { >>> fprintf(stderr, "ENGINE_finish, bad functional reference count\n"); >>> abort(); >>> >>> ......... >>> >>> /* The API (locked) version of "finish" */ int ENGINE_finish(ENGINE >>> *e) { >>> int to_return = 1; >>> >>> if (e == NULL) { >>> ENGINEerr(ENGINE_F_ENGINE_FINISH, ERR_R_PASSED_NULL_PARAMETER); >>> return 0; >>> } >>> CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); >>> to_return = engine_unlocked_finish(e, 1); >>> CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); >>> if (!to_return) { >>> ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED); >>> return 0; >>> } >>> return to_return; >>> } > ------------------------------ Message: 2 Date: Mon, 11 Sep 2017 14:48:47 +0300 (MSK) From: Evgeniy Korneechev <ekorneechev(a)altlinux.org> To: Aki Tuomi <aki.tuomi(a)dovecot.fi> Cc: dovecot <dovecot(a)dovecot.org> Subject: Re: Per-user quota (passwd) Message-ID: <2046000051.747964.1505130527842.JavaMail.zimbra(a)remotesystems.ru> Content-Type: text/plain; charset=utf-8 Hi. But there is one problem... protocol lda { mail_plugins = " quota autocreate sieve quota" plugin { quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage } } protocol imap { mail_plugins = " quota autocreate autocreate imap_quota" plugin { autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage } } > Users with non-standard quota in passwd-file: >>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admini >>>>>>> strator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home/ >>>>>>> DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir > > Others from passwd. Files ".quotausage" are created in different directories: /var/vmail/glu_vrem/administrator\DOM/.quotausage /var/vmail/glu_vrem/administrator(a)email.dom/.quotausage And must in the folder "/var/vmail/glu_vrem/administrator" How fix it? ----- ???????? ????????? ----- > ??: "Evgeniy Korneechev" <ekorneechev(a)altlinux.org> > ????: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> > ?????: "dovecot" <dovecot(a)dovecot.org> > ????????????: ???????, 30 ???? 2017 ? 10:39:16 > ????: Re: Per-user quota (passwd) > Our solution: > userdb { > args = /etc/imap.passwd > driver = passwd-file > override_fields = home=/var/vmail/glu_vrem/%u } userdb { driver = > passwd override_fields = home=/var/vmail/glu_vrem/%u } > > Users with non-standard quota in passwd-file: >>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admini >>>>>>> strator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home/ >>>>>>> DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir > > Others from passwd. > > Its works! Thanks. > > > ----- ???????? ????????? ----- >> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >> ????: "dovecot" <dovecot(a)dovecot.org> >> ????????????: ???????, 29 ???? 2017 ? 14:40:44 >> ????: Re: Per-user quota (passwd) > >> Oh you have multiple db's, I missed that. >> >> Remove auth_username_format, and instead >> >> userdb { >> args = /etc/imap.passwd username_format=%Ln driver = passwd-file >> override_fields = home=/var/vmail/glu_vrem/%u } >> >> On 29.06.2017 14:35, Evgeniy Korneechev wrote: >>> with auth_username_format = %Ln: >>> >>> Jun 28 14:43:41 auth: Debug: master in: USER 1 iivanov.ia(a)example.com >>> service=lda >>> Jun 28 14:43:41 auth-worker(18369): Debug: passwd(iivanov.ia): >>> lookup Jun 28 14:43:41 auth-worker(18369): Info: passwd(iivanov.ia): >>> unknown user - trying the next userdb Jun 28 14:43:41 >>> auth-worker(18369): Debug: sql(iivanov.ia): SELECT email as user, >>> maildir as home, CONCAT('maildir:', maildir, '/Maildir') as mail, >>> uid, gid, \ >>> CONCAT('*:storage=', quota, 'B') AS quota_rule, CONCAT(maildir, '/.sieve') as >>> sieve FROM mail_user WHERE (login = 'iivanov.ia' OR email = >>> 'iivanov.ia') Jun 28 14:43:41 auth-worker(18369): Info: >>> sql(iivanov.ia): unknown user >>> >>> Maybe %Lu? >>> >>> ----- ???????? ????????? ----- >>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>> ????????????: ???????, 29 ???? 2017 ? 14:10:07 >>>> ????: Re: Per-user quota (passwd) >>>> Yes. >>>> >>>> Aki >>>> >>>> On 29.06.2017 14:07, Evgeniy Korneechev wrote: >>>>> And if such a user: >>>>> email (from AD) = ivanov.ia(a)example.com login (from AD), %n = >>>>> iivanov %d = DOM %u = iivanov@DOM >>>>> >>>>> ? >>>>> >>>>> ----- ???????? ????????? ----- >>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>> ????????????: ???????, 29 ???? 2017 ? 13:59:05 >>>>>> ????: Re: Per-user quota (passwd) or use, as I indicated before, >>>>>> auth_username_format = %Ln >>>>>> >>>>>> Aki >>>>>> >>>>>> >>>>>> On 29.06.2017 13:58, Evgeniy Korneechev wrote: >>>>>>> Hi! >>>>>>> workaround: >>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/admini >>>>>>> strator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home/ >>>>>>> DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>> >>>>>>> But this is not a solution for 1000 users ... >>>>>>> Maybe is there extra field "userdb_mail=administrator(a)email.dom" >>>>>>> for email to passwd-file? >>>>>>> >>>>>>> ----- ???????? ????????? ----- >>>>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>>>> ????????????: ?????, 28 ???? 2017 ? 12:40:48 >>>>>>>> ????: Re: Per-user quota (passwd) On 28.06.2017 12:36, Aki >>>>>>>> Tuomi wrote: >>>>>>>>> On 28.06.2017 12:25, Evgeniy Korneechev wrote: >>>>>>>>>> Hello! >>>>>>>>>> We have passwd=pam, userdb=passwd. >>>>>>>>>> passdb { >>>>>>>>>> driver = pam #server was entered domain Active Directory } >>>>>>>>>> userdb { >>>>>>>>>> driver = passwd >>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u } >>>>>>>>>> >>>>>>>>>> How can i use per-user quota? Only passwd-file? >>>>>>>>>> >>>>>>>>>> I tried: >>>>>>>>>> userdb { >>>>>>>>>> args = /etc/imap.passwd >>>>>>>>>> driver = passwd-file >>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u } >>>>>>>>>> /etc/imap.passwd: >>>>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/adm >>>>>>>>>> inistrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>>> >>>>>>>>>> Authentication and quota - now OK. But doesn't work sending >>>>>>>>>> and receiving mail... >>>>>>>>>> postfix say 'Unknown user'... >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> Turn on auth_debug and auth_verbose and see what it says. >>>>>>>>>> >>>>>>>>>> Aki >>>>>>>> Also you can set auth_username_format = %Ln to force usernames >>>>>>>> into lowercase without domain. >>>>>>>> >> >>>>>> Aki > > -- > WBR, Korneechev Evgeniy > BaseALT/ALTLinux Team -- WBR, Korneechev Evgeniy BaseALT/ALTLinux Team ------------------------------ Message: 3 Date: Mon, 11 Sep 2017 14:51:13 +0300 From: Aki Tuomi <aki.tuomi(a)dovecot.fi> To: dovecot(a)dovecot.org Subject: Re: Per-user quota (passwd) Message-ID: <7e86447f-10e6-51a3-ce8a-3c4c8261bac1(a)dovecot.fi> Content-Type: text/plain; charset=utf-8 Hi! Just so you know, autocreate/autosubscribe is deprecated, you should use namespace { mailbox INBOX { auto = subscribe } } can you run doveadm user administrator(a)email.dom to verify that mail_home gets set correctly? Aki On 11.09.2017 14:48, Evgeniy Korneechev wrote: > Hi. > But there is one problem... > > protocol lda { > mail_plugins = " quota autocreate sieve quota" > plugin { > quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage > } > } > protocol imap { > mail_plugins = " quota autocreate autocreate imap_quota" > plugin { > autocreate = INBOX > autocreate2 = Sent > autocreate3 = Trash > autocreate4 = Drafts > autocreate5 = Junk > autosubscribe = INBOX > autosubscribe2 = Sent > autosubscribe3 = Trash > autosubscribe4 = Drafts > autosubscribe5 = Junk > quota = dict:user::file:/var/vmail/glu_vrem/%u/.quotausage > } > } > >> Users with non-standard quota in passwd-file: >>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >> Others from passwd. > > > Files ".quotausage" are created in different directories: > /var/vmail/glu_vrem/administrator\DOM/.quotausage > /var/vmail/glu_vrem/administrator(a)email.dom/.quotausage > And must in the folder "/var/vmail/glu_vrem/administrator" > > How fix it? > > > ----- ???????? ????????? ----- >> ??: "Evgeniy Korneechev" <ekorneechev(a)altlinux.org> >> ????: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >> ?????: "dovecot" <dovecot(a)dovecot.org> >> ????????????: ???????, 30 ???? 2017 ? 10:39:16 >> ????: Re: Per-user quota (passwd) >> Our solution: >> userdb { >> args = /etc/imap.passwd >> driver = passwd-file >> override_fields = home=/var/vmail/glu_vrem/%u >> } >> userdb { >> driver = passwd >> override_fields = home=/var/vmail/glu_vrem/%u >> } >> >> Users with non-standard quota in passwd-file: >>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >> Others from passwd. >> >> Its works! Thanks. >> >> >> ----- ???????? ????????? ----- >>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>> ????: "dovecot" <dovecot(a)dovecot.org> >>> ????????????: ???????, 29 ???? 2017 ? 14:40:44 >>> ????: Re: Per-user quota (passwd) >>> Oh you have multiple db's, I missed that. >>> >>> Remove auth_username_format, and instead >>> >>> userdb { >>> args = /etc/imap.passwd username_format=%Ln >>> driver = passwd-file >>> override_fields = home=/var/vmail/glu_vrem/%u >>> } >>> >>> On 29.06.2017 14:35, Evgeniy Korneechev wrote: >>>> with auth_username_format = %Ln: >>>> >>>> Jun 28 14:43:41 auth: Debug: master in: USER 1 iivanov.ia(a)example.com >>>> service=lda >>>> Jun 28 14:43:41 auth-worker(18369): Debug: passwd(iivanov.ia): lookup >>>> Jun 28 14:43:41 auth-worker(18369): Info: passwd(iivanov.ia): unknown user - >>>> trying the next userdb >>>> Jun 28 14:43:41 auth-worker(18369): Debug: sql(iivanov.ia): SELECT email as >>>> user, maildir as home, CONCAT('maildir:', maildir, '/Maildir') as mail, uid, >>>> gid, \ >>>> CONCAT('*:storage=', quota, 'B') AS quota_rule, CONCAT(maildir, '/.sieve') as >>>> sieve FROM mail_user WHERE (login = 'iivanov.ia' OR email = 'iivanov.ia') >>>> Jun 28 14:43:41 auth-worker(18369): Info: sql(iivanov.ia): unknown user >>>> >>>> Maybe %Lu? >>>> >>>> ----- ???????? ????????? ----- >>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>> ????????????: ???????, 29 ???? 2017 ? 14:10:07 >>>>> ????: Re: Per-user quota (passwd) >>>>> Yes. >>>>> >>>>> Aki >>>>> >>>>> On 29.06.2017 14:07, Evgeniy Korneechev wrote: >>>>>> And if such a user: >>>>>> email (from AD) = ivanov.ia(a)example.com >>>>>> login (from AD), %n = iivanov >>>>>> %d = DOM >>>>>> %u = iivanov@DOM >>>>>> >>>>>> ? >>>>>> >>>>>> ----- ???????? ????????? ----- >>>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>>> ????????????: ???????, 29 ???? 2017 ? 13:59:05 >>>>>>> ????: Re: Per-user quota (passwd) >>>>>>> or use, as I indicated before, auth_username_format = %Ln >>>>>>> >>>>>>> Aki >>>>>>> >>>>>>> >>>>>>> On 29.06.2017 13:58, Evgeniy Korneechev wrote: >>>>>>>> Hi! >>>>>>>> workaround: >>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> administrator@email.dom:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>> userdb_mail=maildir:/var/vmail/glu_vrem/administrator/Maildir >>>>>>>> >>>>>>>> But this is not a solution for 1000 users ... >>>>>>>> Maybe is there extra field "userdb_mail=administrator(a)email.dom" for email to >>>>>>>> passwd-file? >>>>>>>> >>>>>>>> ----- ???????? ????????? ----- >>>>>>>>> ??: "Aki Tuomi" <aki.tuomi(a)dovecot.fi> >>>>>>>>> ????: "dovecot" <dovecot(a)dovecot.org> >>>>>>>>> ????????????: ?????, 28 ???? 2017 ? 12:40:48 >>>>>>>>> ????: Re: Per-user quota (passwd) >>>>>>>>> On 28.06.2017 12:36, Aki Tuomi wrote: >>>>>>>>>> On 28.06.2017 12:25, Evgeniy Korneechev wrote: >>>>>>>>>>> Hello! >>>>>>>>>>> We have passwd=pam, userdb=passwd. >>>>>>>>>>> passdb { >>>>>>>>>>> driver = pam #server was entered domain Active Directory >>>>>>>>>>> } >>>>>>>>>>> userdb { >>>>>>>>>>> driver = passwd >>>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u >>>>>>>>>>> } >>>>>>>>>>> >>>>>>>>>>> How can i use per-user quota? Only passwd-file? >>>>>>>>>>> >>>>>>>>>>> I tried: >>>>>>>>>>> userdb { >>>>>>>>>>> args = /etc/imap.passwd >>>>>>>>>>> driver = passwd-file >>>>>>>>>>> override_fields = home=/var/vmail/glu_vrem/%u >>>>>>>>>>> } >>>>>>>>>>> /etc/imap.passwd: >>>>>>>>>>> administrator:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G >>>>>>>>>>> >>>>>>>>>>> Authentication and quota - now OK. But doesn't work sending and receiving >>>>>>>>>>> mail... >>>>>>>>>>> postfix say 'Unknown user'... >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> Turn on auth_debug and auth_verbose and see what it says. >>>>>>>>>>> >>>>>>>>>>> Aki >>>>>>>>> Also you can set auth_username_format = %Ln to force usernames into >>>>>>>>> lowercase without domain. >>>>>>>>> >>>>>>>>> Aki >> -- >> WBR, Korneechev Evgeniy >> BaseALT/ALTLinux Team ------------------------------ Message: 4 Date: Mon, 11 Sep 2017 14:56:28 +0200 From: "Nagy, Attila" <bra(a)fsn.hu> To: Aki Tuomi <aki.tuomi(a)dovecot.fi>, dovecot(a)dovecot.org Subject: Re: Is it possible to disable pipelining in imapc? Message-ID: <a6ced659-fa75-60c9-01f7-bfb36e826466(a)fsn.hu> Content-Type: text/plain; charset=utf-8; format=flowed On 09/11/2017 12:12 PM, Aki Tuomi wrote: > Is there some reason you can't use normal proxy instead of imap backend? > That is,return proxy, host=imap_backend, port=1430? There seems to be no > pipeline setting currently for imapc in v2.2. > Yes, because it's a dumb IMAP server, which doesn't implement a lot of things, like SEARCH, FETCH BODYSTRUCTURE and similar. Dovecot is used as a smart proxy, which makes it possible to use it as a fully featured IMAP server. ------------------------------ Subject: Digest Footer _______________________________________________ dovecot mailing list dovecot(a)dovecot.org https://dovecot.org/mailman/listinfo/dovecot ------------------------------ End of dovecot Digest, Vol 173, Issue 28 ****************************************

2 1

Moving emails tagged as spam to the Junk folder
by Mika Leppänen 12 Sep '17

12 Sep '17

I am running Ubuntu 16.04. I am following this guide: https://wiki2.dovecot.org/HowTo/AntispamWithSieve. At the end when I try to compile the .sieve files, I get this error: sievec(root): Fatal: Plugin 'sieve_imapsieve' not found from directory /usr/lib/dovecot/modules/sieve. Does anyone know about this? I have dovecot-sieve installed and I'm using Postfix and Spamassassin. -- Mika Leppänen -- mika.leppanen(a)iki.fi

3 2

Re: Share Website certificate with SSL/STL Dovecot IMAP and Postifix SMTP
by Joseph Tam 11 Sep '17

11 Sep '17

Marco Marco writes writes: > I've bought a certificate from the authority for my website to use to > access in https mode. > > Is it possible to share the same pairs to authenticate the emails sent > by postfix and Dovecot in order to avoid that client as Hotmail.it or > Gmail intercept these as Spam? By "same pairs", I assume you mean key and certificate. Yes, just as long as you use the same Subject for all your services (e.g. "mail.yourdomain.com") or you have purchased a wildcard certificate e.g. "*.yourdomain.com" to authenticate "webmail.yourdomain.com", "imap.yourdomain.com", "smtp.yourdomain.com", etc.) Certificates do not authenticate services or protocols, but server names (typically). Joseph Tam <jtam.home(a)gmail.com>

1 0

Returning error response to the client from passdb (with dict protocol)
by Nagy, Attila 11 Sep '17

11 Sep '17

Hi, When using a passdb with (UNIX socket) dict protocol, I can return a JSON with fields. When I want to deny the user, I can send a JSON like this: {"fail":true} which yields (on POP) a friendly -ERR [AUTH] Authentication failed. Is it possible to return the response text itself? I want to tell the user why the authentication has failed.

1 0

Fail2ban 'Password mismatch' regex
by James Brown 11 Sep '17

11 Sep '17

I have turned on 'auth_debug_passwords=yes’ in dovecot.conf. I’m trying to get Fail2ban to detect this log line: Sep 11 15:52:49 mail dovecot[54239]: auth-worker(10094): sql(user(a)bordo.com.au <mailto:user@bordo.com.au>,::1,<L2xqieNYeM4AAAAAAAAAAAAAAAAAAAAB>): Password mismatch (given password: 2) I’ve added it as the last line of my dovecot filter regex: failregex = ^%(__prefix_line)s(%(__pam_auth)s($dovecot:auth$)?:)?\s+authentication failure; logname=\S* uid=\S* euid=\S* tty=dovecot ruser=\S* rhost=<HOST>(\s+user=\S*)?\s*$ ^%(__prefix_line)s(pop3|imap)-login: (Info: )?(Aborted login|Disconnected)(: Inactivity)? $((auth failed, \d+ attempts)( in \d+ secs)?|tried to use (disabled|disallo$ ^%(__prefix_line)s(Info|dovecot: auth\(default$|auth-worker$\d+$): pam$\S+,<HOST>$: pam_authenticate failed: (User not known to the underlying authentication$ ^%(__prefix_line)s(auth|auth-worker$\d+$): (pam|passwd-file)$\S+,<HOST>$: unknown user\s*$ ^%(__prefix_line)s(auth|auth-worker$\d+$): Info: ldap$\S*,<HOST>,\S*$: invalid credentials\s*$ ^%(__prefix_line)sauth: Info: sql$\S+,<HOST>$: (Password mismatch|unknown user)( $(SHA1 of given password: [0-9a-f]{5,40}|given password: \w*)$)?$ Have spent ages googling and trying different variations. Does anyone have a fail2ban regex that would work on the above Dovecot log line? (Running latest versions of Dovecot and fail2ban) Many thanks, James.

3 5

Is it possible to disable pipelining in imapc?
by Nagy, Attila 11 Sep '17

11 Sep '17

Hi, I've a broken IMAP server, which doesn't support pipelining and fails on dovecot's attempt to do this ([C] is dovecot's imapc, [S] is the IMAP server): [C] 24 LOGIN "user" "pass" [S] 23 OK [C] 25 SELECT "INBOX" [C] 23 UID FETCH 2 (INTERNALDATE) [S] 25 OK [S] 23 BAD No mailbox selected Sadly, fixing the server would be a hard task, turning off pipelining in dovecot's imapc (which already supports many workarounds for different servers) could be easy... ... except I can see no place to do this in imapc (only in pop3c and imap proxy, which I guess doesn't apply here). If I'm right, may I ask for a knob for such dumb servers? Thanks,

3 13

Per-user quota (passwd)
by Evgeniy Korneechev 11 Sep '17

11 Sep '17

Hello! We have passwd=pam, userdb=passwd. passdb { driver = pam #server was entered domain Active Directory } userdb { driver = passwd override_fields = home=/var/vmail/glu_vrem/%u } How can i use per-user quota? Only passwd-file? I tried: userdb { args = /etc/imap.passwd driver = passwd-file override_fields = home=/var/vmail/glu_vrem/%u } /etc/imap.passwd: administrator:*:95400500:95400513:Administrator:/home/DOM/administrator:/bin/bash::userdb_quota_rule=*:bytes=10G Authentication and quota - now OK. But doesn't work sending and receiving mail... postfix say 'Unknown user'... Is there "extra_field" in passwd-file for email? What generally will be advice on quotas in our case? dovecot -n: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.4.39-std-def-alt0.M80P.1 x86_64 ALT 8.1 Server auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 auth_socket_path = /var/run/dovecot/auth-userdb auth_username_chars = auth_verbose = yes auth_verbose_passwords = plain base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot disable_plaintext_auth = no first_valid_gid = 502 first_valid_uid = 502 last_valid_gid = 268999999 last_valid_uid = 268999999 log_path = /var/log/dovecot login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = vmail mail_debug = yes mail_gid = 502 mail_location = maildir:/%Lh/Maildir/:INDEX=/%Lh/Maildir/ mail_plugins = " quota autocreate" mail_privileged_group = vmail mail_uid = 502 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify mbox_write_locks = fcntl namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = prefix = separator = / type = private } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { quota_rule = *:storage=5G recipient_delimiter = + sieve = /etc/dovecot/sieves/default.sieve sieve_default = /etc/dovecot/sieves/default.sieve sieve_dir = ~/sieve sieve_extensions = +notify +imapflags sieve_max_redirects = 8 } protocols = imap pop3 lmtp sieve service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service dict { unix_listener dict { group = vmail mode = 0600 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service imap { process_limit = 1024 vsz_limit = 256 M } service lmtp { unix_listener lmtp { mode = 0666 } } service managesieve-login { inet_listener sieve { port = 4190 } vsz_limit = 64 M } service pop3-login { inet_listener pop3 { port = 110 } } service pop3 { process_limit = 1024 } ssl_ca = </usr/share/ca-certificates/ca-bundle.crt ssl_cert = </etc/dovecot/server.crt ssl_key = # hidden, use -P to show it userdb { driver = passwd override_fields = home=/var/vmail/glu_vrem/%u } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota autocreate sieve" } protocol lda { mail_plugins = " quota autocreate sieve quota" plugin { quota = dict:user::file:/var/vmail/glu_vrem/%n/.quotausage } } protocol imap { mail_plugins = " quota autocreate autocreate imap_quota" plugin { autocreate = INBOX autocreate2 = Sent autocreate3 = Trash autocreate4 = Drafts autocreate5 = Junk autosubscribe = INBOX autosubscribe2 = Sent autosubscribe3 = Trash autosubscribe4 = Drafts autosubscribe5 = Junk quota = dict:user::file:/var/vmail/glu_vrem/%n/.quotausage } } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 65536 } protocol pop3 { pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv } -- WBR, Korneechev Evgeniy BaseALT/ALTLinux Team

2 11

RE: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (INTERNAL)
by Arvid.Eikas＠telenor.com 11 Sep '17

11 Sep '17

Hi, I switched back to 2.2.27 with the same config that I am using for 2.2.32 and it work fine. Sep 11 11:49:37 imap-login: Info: Login: user=<viboge>, method=PLAIN, rip=88.89.118.45, lip=148.123.160.116, mpid=18709, TLS, session=<v7o22OZYrsdYWXYt> Sep 11 11:49:40 imap(mailuser) Session-ID v7o22OZYrsdYWXYt RemoteIP 88.89.118.45 Maildir /var/nextmail/nfs2.flex14/49/79/841 Info: Logged out in=4518 out=273720 deleted 0 expunged 0 trashed 0 Sep 11 11:49:40 imap-login: Debug: SSL alert: close notify [88.89.118.45] How could I proceed? Any clue? It is quite annoying to see this entry in the log for each session. Arvid -----Original Message----- From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] Sent: 11. september 2017 09:18 To: Eikås Arvid; dovecot(a)dovecot.org Subject: Re: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (INTERNAL) Hi! I tried to reproduce this problem with dovecot-2.2.32 and OpenSSL 1.0.1k and was not able to. I enabled -DREF_CHECK on OpenSSL, but to no avail, the process did not crash. Is there something else you've done? Aki On 11.09.2017 08:07, Arvid.Eikas(a)telenor.com wrote: > Hi, > > Here is the gdb output. > > Arvid > > GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 > Free Software Foundation, Inc. > License GPLv3+: GNU GPL version 3 or later > <http://gnu.org/licenses/gpl.html> > This is free software: you are free to change and redistribute it. > There is NO WARRANTY, to the extent permitted by law. Type "show copying" > and "show warranty" for details. > This GDB was configured as "x86_64-redhat-linux-gnu". > For bug reporting instructions, please see: > <http://www.gnu.org/software/gdb/bugs/>... > Reading symbols from /local/misc/mail/dovecot-32/libexec/dovecot/pop3-login...done. > [New LWP 15894] > Core was generated by `dovecot-test/pop3-login'. > Program terminated with signal 6, Aborted. > #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 Missing > separate debuginfos, use: debuginfo-install > glibc-2.17-157.el7_3.1.x86_64 > (gdb) bt full > #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 No symbol > table info available. > #1 0x00007ff0bd9d08c8 in abort () from /lib64/libc.so.6 No symbol > table info available. > #2 0x00007ff0bd3c0f2f in engine_unlocked_finish (e=0x1c51c60, unlock_for_handlers=1) at eng_init.c:115 > to_return = 1 > #3 0x00007ff0bd3c1064 in ENGINE_finish (e=0x1c51c60) at eng_init.c:150 > to_return = 1 > #4 0x00007ff0be0f9300 in ssl_proxy_deinit () from > /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 > No symbol table info available. > #5 0x00007ff0be0f4472 in main_deinit () from > /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 > No symbol table info available. > #6 0x00007ff0be0f479f in login_binary_run () from > /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 > No symbol table info available. > #7 0x00000000004032da in main (argc=1, argv=0x7ffe3059f3f8) at > client.c:356 No locals. > > > > -----Original Message----- > From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] > Sent: 8. september 2017 14:08 > To: Eikås Arvid; dovecot(a)dovecot.org > Subject: Re: pop3-login core dump when using TLSSTART on version > dovecot-2.2.32 (OPEN) > > I assume you mean STARTTLS. Can you provide gdb /path/to/bin /path/to/core and provide output of bt full? > > Aki > > > On 08.09.2017 15:01, Arvid.Eikas(a)telenor.com wrote: >> Hi, >> >> Pop3-login are CORE-dumping when I log on with TLSSTART, I believe the same will happen with imap-logon to, but I have not tested it yet. >> The TLS session is coming up and it works fine until I log off, then it's core dump. Open sslvesrion is openssl-1.0.2k. >> We ran dovecot-2.2.27 before we upgraded to dovecote-2.2.32, and that >> seems to work fine. (not core dumping) >> >> >> Arvid >> >> >> LOG >> Sep 05 14:27:34 pop3-login: Debug: SSL: elliptic curve secp384r1 will >> be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: >> Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE >> key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve >> secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 >> 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be >> used for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: >> SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key >> exchanges Sep 05 14:30:50 pop3-login: Info: Login: user=<tstrand>, >> method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18361, secured, >> session=<65m8ZXBYtpN/AAAB> Sep 05 14:30:50 pop3-login: Error: >> ENGINE_finish, bad functional reference count Sep 05 14:30:50 >> pop3-login: Fatal: master: service(pop3-login): child 18359 killed >> with signal 6 (core dumped) >> >> >> >> >> >> >> From ./crypto/engine/eng_init.c >> >> ......... >> int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { >> int to_return = 1; >> >> /* >> * Reduce the functional reference count here so if it's the terminating >> * case, we can release the lock safely and call the finish() handler >> * without risk of a race. We get a race if we leave the count until >> * after and something else is calling "finish" at the same time - >> * there's a chance that both threads will together take the count from 2 >> * to 0 without either calling finish(). >> */ >> e->funct_ref--; >> engine_ref_debug(e, 1, -1); >> if ((e->funct_ref == 0) && e->finish) { >> if (unlock_for_handlers) >> CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); >> to_return = e->finish(e); >> if (unlock_for_handlers) >> CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); >> if (!to_return) >> return 0; >> } >> #ifdef REF_CHECK >> if (e->funct_ref < 0) { >> fprintf(stderr, "ENGINE_finish, bad functional reference count\n"); >> abort(); >> >> ......... >> >> /* The API (locked) version of "finish" */ int ENGINE_finish(ENGINE >> *e) { >> int to_return = 1; >> >> if (e == NULL) { >> ENGINEerr(ENGINE_F_ENGINE_FINISH, ERR_R_PASSED_NULL_PARAMETER); >> return 0; >> } >> CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); >> to_return = engine_unlocked_finish(e, 1); >> CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); >> if (!to_return) { >> ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED); >> return 0; >> } >> return to_return; >> }

2 1

doveadm expunge returns error code 68
by Florian Lohoff 11 Sep '17

11 Sep '17

Hi, i am running basically this from cron: /usr/bin/doveadm -v expunge -u * mailbox INBOX.Spam SENTBEFORE 90d /usr/bin/doveadm -v expunge -u * mailbox INBOX.Trash SENTBEFORE 90d /usr/bin/doveadm -v expunge -u * mailbox INBOX.Junk SENTBEFORE 90d Now i am experiencing that the first line e.g. expunging INBOX.Spam returns the error code 68. No syslog/Output whatsoever. I tried running with -vvv -D which gives me a lot of output (for all mailboxes) but still i am unable to pinpoint the problem. The later 2 commands return "0" as expected. Where does the error return code come from and what does 68 mean? Flo -- Florian Lohoff f(a)zz.de UTF-8 Test: The 🐈 ran after a 🐁, but the 🐁 ran away

2 3

Dovecot and Letsencrypt certs
by ＠lbutlr 11 Sep '17

11 Sep '17

So this morning at 4am I was awoken to my mail clients getting certificate errors for an expired certificate. I hopped on to the server and checked and… no, the LE certs renewed last month and are valid until November. After some moments of confusion I noticed that dovecot had been running since before the renewal, so I did a quick service dovecot restart which fixed everything. Should dovecot check for certs being refreshed? Or is this an artifact of my using symbolic links everywhere to point to the newest LE certs (which are themselves links the dehydrate script creates to point to the newest cert-1502534746.csr etc files? Should I just create a monthly cron to restart dovecot or is there something else? -- Apple broke AppleScripting signatures in Mail.app, so no random signatures.

8 14

RE: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (INTERNAL)
by Arvid.Eikas＠telenor.com 11 Sep '17

11 Sep '17

Hi, Here is the gdb output. Arvid GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-94.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /local/misc/mail/dovecot-32/libexec/dovecot/pop3-login...done. [New LWP 15894] Core was generated by `dovecot-test/pop3-login'. Program terminated with signal 6, Aborted. #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 Missing separate debuginfos, use: debuginfo-install glibc-2.17-157.el7_3.1.x86_64 (gdb) bt full #0 0x00007ff0bd9cf1d7 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x00007ff0bd9d08c8 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x00007ff0bd3c0f2f in engine_unlocked_finish (e=0x1c51c60, unlock_for_handlers=1) at eng_init.c:115 to_return = 1 #3 0x00007ff0bd3c1064 in ENGINE_finish (e=0x1c51c60) at eng_init.c:150 to_return = 1 #4 0x00007ff0be0f9300 in ssl_proxy_deinit () from /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 No symbol table info available. #5 0x00007ff0be0f4472 in main_deinit () from /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 No symbol table info available. #6 0x00007ff0be0f479f in login_binary_run () from /local/nextmail/dovecot/lib64/dovecot/libdovecot-login.so.0 No symbol table info available. #7 0x00000000004032da in main (argc=1, argv=0x7ffe3059f3f8) at client.c:356 No locals. -----Original Message----- From: Aki Tuomi [mailto:aki.tuomi@dovecot.fi] Sent: 8. september 2017 14:08 To: Eikås Arvid; dovecot(a)dovecot.org Subject: Re: pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (OPEN) I assume you mean STARTTLS. Can you provide gdb /path/to/bin /path/to/core and provide output of bt full? Aki On 08.09.2017 15:01, Arvid.Eikas(a)telenor.com wrote: > Hi, > > Pop3-login are CORE-dumping when I log on with TLSSTART, I believe the same will happen with imap-logon to, but I have not tested it yet. > The TLS session is coming up and it works fine until I log off, then it's core dump. Open sslvesrion is openssl-1.0.2k. > We ran dovecot-2.2.27 before we upgraded to dovecote-2.2.32, and that > seems to work fine. (not core dumping) > > > Arvid > > > LOG > Sep 05 14:27:34 pop3-login: Debug: SSL: elliptic curve secp384r1 will > be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: > Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE > key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve > secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 > 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used > for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: > SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key > exchanges Sep 05 14:30:50 pop3-login: Info: Login: user=<tstrand>, > method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18361, secured, > session=<65m8ZXBYtpN/AAAB> Sep 05 14:30:50 pop3-login: Error: > ENGINE_finish, bad functional reference count Sep 05 14:30:50 > pop3-login: Fatal: master: service(pop3-login): child 18359 killed > with signal 6 (core dumped) > > > > > > > From ./crypto/engine/eng_init.c > > ......... > int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { > int to_return = 1; > > /* > * Reduce the functional reference count here so if it's the terminating > * case, we can release the lock safely and call the finish() handler > * without risk of a race. We get a race if we leave the count until > * after and something else is calling "finish" at the same time - > * there's a chance that both threads will together take the count from 2 > * to 0 without either calling finish(). > */ > e->funct_ref--; > engine_ref_debug(e, 1, -1); > if ((e->funct_ref == 0) && e->finish) { > if (unlock_for_handlers) > CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); > to_return = e->finish(e); > if (unlock_for_handlers) > CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); > if (!to_return) > return 0; > } > #ifdef REF_CHECK > if (e->funct_ref < 0) { > fprintf(stderr, "ENGINE_finish, bad functional reference count\n"); > abort(); > > ......... > > /* The API (locked) version of "finish" */ int ENGINE_finish(ENGINE > *e) { > int to_return = 1; > > if (e == NULL) { > ENGINEerr(ENGINE_F_ENGINE_FINISH, ERR_R_PASSED_NULL_PARAMETER); > return 0; > } > CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); > to_return = engine_unlocked_finish(e, 1); > CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); > if (!to_return) { > ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED); > return 0; > } > return to_return; > }

2 1

Share Website certificate with SSL/STL Dovecot IMAP and Postifix SMTP
by Marco Marco 10 Sep '17

10 Sep '17

Hi guys, I've bought a certificate from the authority for my website to use to access in https mode. Is it possible to share the same pairs to authenticate the emails sent by postfix and Dovecot in order to avoid that client as Hotmail.it or Gmail intercept these as Spam? Thank you

2 1

Embeding a path in address extensions
by ＠lbutlr 09 Sep '17

09 Sep '17

I generate bcc backups with the pattern backups+DATE.user.domain.tld(a)myBackupDomain.tld (for example, backups+20170908.kremels.kreme.com(a)myBackupDomain.tld) This puts mail in …/.20170908.kremels.kreme.com/new What I would like to do is get the expansion to generate the following path …/.20170908/.kremels.kreme.com/new Of course the date changes everyday, but it will always be numeric if that helps. dovecot get the mail from postfix: dovecot unix - n n - - pipe flags=DRhu user=vpopmail:vchkpw argv=/usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${user}@${nexthop} -m ${extension} -a ${original_recipient} Would it make more sense (or is it even possible) to split the extension in postfix or to do something with sieve? Or is there a character I can use in the extension that tells dovecot to create a path? Even though I am using a maildir structure for the backups, this "account" never accesses the mail via a MUA, only via the command line when an admin has to restore an email, so it would be much easier to deal with this with daily subfolders. Or, maybe I make the admins use an MUA? If so, I should replace most of these .'s with dashes… -- Apple broke AppleScripting signatures in Mail.app, so no random signatures.

1 1

can't get quota working. I use static userdb driver.
by Вадим Бажов 08 Sep '17

08 Sep '17

Hi, people ! Set up global quota according to docs to 2 Mb. Send more than ten Mb on the box. Mail still getting put in the box, no bounces, no error messages in logs, nothing to prevent mail to be delivered in overflooded mailbox. quota settings are: mail_plugins = quota lmtp_rcpt_check_quota = yes quota_full_tempfail = yes protocol lmtp { postmaster_address = postmaster # required mail_plugins = $mail_plugins sieve } protocol lda { mail_plugins = $mail_plugins sieve } protocol imap { mail_plugins = $mail_plugins imap_quota } plugin { quota = maildir:"User quota" quota_rule = *:storage=10M quota_rule3 = INBOX.Trash:storage=+10%% quota_exceeded_message = "552 5.2.2 Mailbox is full" } doveconf -n is attached. # doveadm quota get Quota name Type Value Limit % "User quota" STORAGE 0 10240 0 "User quota" MESSAGE 0 - # doveadm quota get -u vadim Quota name Type Value Limit % "User quota" STORAGE 0 10240 0 "User quota" MESSAGE 0 - # du -sh /var/mail/vadim/ 23M /var/mail/vadim/ I tried to pass quota_rule as an argument to userdb, quota is being parsed, but still doesn't work. I think problem is that dovecot can't (re)calculate the actual quota on disc (cant calculate how disk space mailbox is used), despite the fact that quota limit itself is configured correctly, since dovecot shows it in log and doveconf -n. What I am dong wrong ?

4 8

EOF from net_disconnect(fd)
by Steffan Cline 08 Sep '17

08 Sep '17

I’m working on an OS project from github. There are two parts: Dovecot plugin - https://github.com/st3fan/dovecot-xaps-plugin Daemon written in Go - https://github.com/st3fan/dovecot-xaps-daemon # dovecot --version 2.2.10 Both parts worked fine on CentOS 6 but I recently rebuilt them both for CentOS 7 and have run into some errors. The plugin sends a notification over a socket to the daemon. The daemon then processes the request and returns a message to the plugin. The plugin reads the response then closes the socket and at that point, I’m running into an issue. The daemon reports the following: read unix /tmp/xapsd.sock->@: read: connection reset by peer In reading the Go language docs, it says that it will throw the first error it hits before the EOF from the socket. This led me to think that perhaps the plugin was not sending an EOF when closing the socket. I tried to write an EOF to the socket before the close but no change. Everything works between the plugin and daemon right up until the socket close. Is there a way to monitor the stream through the socket so I can see if the plugin is indeed sending the EOF? Knowing that lets me know if I need to chase down the issue in the Go daemon code. I’m no pro with C but I tried. The snippet from the plugin follows: alarm(1); { if (net_transmit(fd, str_data(req), str_len(req)) < 0) { i_error("write(%s) failed: %m", socket_path); ret = -1; } else { char res[1024]; ret = net_receive(fd, res, sizeof(res)-1); if (ret < 0) { i_error("read(%s) failed: %m", socket_path); } else { res[ret] = '\0'; if (strncmp(res, "OK ", 3) == 0) { ret = 0; } } } } alarm(0); char stx[1]; stx[0]=(char) 4; //stx[1]='\0'; if ( net_transmit(fd, stx, sizeof(stx) ) < 0 ) { i_error("Error writing EOF"); } //string_t *testEOF= t_str_new(2); //str_append(testEOF, (char*) 4); //if ( net_transmit(fd, str_data(testEOF), str_len(testEOF) ) < 0 ) { // i_error("Error writing EOF"); // } //i_close_fd(&fd); net_disconnect(fd); fd=-1; Thank you, Steffan Cline 602-793-0014

3 6

Automatic DB password hash scheme selection
by Kurt Fitzner 08 Sep '17

08 Sep '17

Hi all, Is there a way to get dovecot to recognize arbitrary password hash schemes when looking up a password in a database? I originally set up with #default_pass_scheme = MD5, and I would like to migrate to SHA512. Seeing as the scheme is actually stored in the password column along with the password in the format $_<scheme#>_$_<salt>_$_<passwordhash>_, it seems to me that dovecot should be able to look at the scheme number and simply do the right thing. If this is possible, then migrating passwords over would be much easier, since people will still be able to log in with their old MD5-hashed password and the changer can be set up to hash with the new method. Is this possible currently? Thanks, Kurt

2 2

Hide public mailboxes from some users
by Arie Peterson 08 Sep '17

08 Sep '17

Hi all, I'm trying to set up public mailboxes for a subset of my users. This is on dovecot 2.2.27. I've created a new public namespace, and the new mailboxes indeed show up for everyone. So far so good. Now I want to restrict access: these mailboxes shouldn't be visible at all except to a fixed list of users. This part I can't seem to get working. I've added acl data along these lines: ``` pubbox anyone pubbox/* anyone pubbox user=me(a)example.com lrwstipekxa pubbox/* user=me(a)example.com lrwstipekxa ``` However, other users can still see "pubbox" and its subfolders, although they can't actually view the contents. This is corroborated by some of the output of `doveadm mailbox list`: ``` # doveadm -D mailbox list -u other(a)example.com … doveadm(other(a)example.com): Debug: Namespace : type=public, prefix=pubbox/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no … doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Drafts' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Drafts' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/Drafts/dovecot-acl doveadm(other(a)example.com): Debug: acl: No lookup right to mailbox: pubbox/Drafts doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Sent' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Sent' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/Sent/dovecot-acl doveadm(other(a)example.com): Debug: acl: No lookup right to mailbox: pubbox/Sent doveadm(other(a)example.com): Debug: Mailbox 'pubbox' matches global ACL pattern 'pubbox' doveadm(other(a)example.com): Debug: Mailbox 'pubbox' matches global ACL pattern 'pubbox' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/dovecot-acl pubbox pubbox/Drafts pubbox/Sent INBOX ``` Why do these "pubbox/*" mailboxes show up in the `mailbox list` output, even though the debug messages say that the user has no lookup right for them? `doveadm acl rights` seems to confirm that `other(a)example.com` does not have the lookup right for these mailboxes. So why do they show up in their email clients anyway? Thanks for any advice!

1 2

password reset
by ＠lbutlr 08 Sep '17

08 Sep '17

This is off topic, but I am not sure where to go. I have a local user who cannot login because of a forgotten password, so I went to reset her password with sudo passed <user> Which appears to work, asking for a new password and a confirmation. No error occurs (unless I give it unmatched passwords), but the password is not changed. if I try to change the password in the user's account (after su <user>) t requires the old password. running on FreeBSD 11.0 When I try to change the password with sudo, the timestamp on /etc/passwd gets updated but there is nothing logged to anything in /var/log/

4 6

pop3-login core dump when using TLSSTART on version dovecot-2.2.32 (OPEN)
by Arvid.Eikas＠telenor.com 08 Sep '17

08 Sep '17

Hi, Pop3-login are CORE-dumping when I log on with TLSSTART, I believe the same will happen with imap-logon to, but I have not tested it yet. The TLS session is coming up and it works fine until I log off, then it's core dump. Open sslvesrion is openssl-1.0.2k. We ran dovecot-2.2.27 before we upgraded to dovecote-2.2.32, and that seems to work fine. (not core dumping) Arvid LOG Sep 05 14:27:34 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:30 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:42 pop3-login: Debug: SSL: elliptic curve secp384r1 will be used for ECDH and ECDHE key exchanges Sep 05 14:30:50 pop3-login: Info: Login: user=<tstrand>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, mpid=18361, secured, session=<65m8ZXBYtpN/AAAB> Sep 05 14:30:50 pop3-login: Error: ENGINE_finish, bad functional reference count Sep 05 14:30:50 pop3-login: Fatal: master: service(pop3-login): child 18359 killed with signal 6 (core dumped) >From ./crypto/engine/eng_init.c ......... int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers) { int to_return = 1; /* * Reduce the functional reference count here so if it's the terminating * case, we can release the lock safely and call the finish() handler * without risk of a race. We get a race if we leave the count until * after and something else is calling "finish" at the same time - * there's a chance that both threads will together take the count from 2 * to 0 without either calling finish(). */ e->funct_ref--; engine_ref_debug(e, 1, -1); if ((e->funct_ref == 0) && e->finish) { if (unlock_for_handlers) CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); to_return = e->finish(e); if (unlock_for_handlers) CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); if (!to_return) return 0; } #ifdef REF_CHECK if (e->funct_ref < 0) { fprintf(stderr, "ENGINE_finish, bad functional reference count\n"); abort(); ......... /* The API (locked) version of "finish" */ int ENGINE_finish(ENGINE *e) { int to_return = 1; if (e == NULL) { ENGINEerr(ENGINE_F_ENGINE_FINISH, ERR_R_PASSED_NULL_PARAMETER); return 0; } CRYPTO_w_lock(CRYPTO_LOCK_ENGINE); to_return = engine_unlocked_finish(e, 1); CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE); if (!to_return) { ENGINEerr(ENGINE_F_ENGINE_FINISH, ENGINE_R_FINISH_FAILED); return 0; } return to_return; }

2 1

Strange SASL issue
by Antoine Nguyen 07 Sep '17

07 Sep '17

Hi all, I've just upgraded my server from debian 8 to debian 9 and I now encounter a strange issue. I'm using prosody (XMPP server), configured to authenticate against dovecot using SASL and a unix socket. This setup was working fine on debian 8. Now, each time I try to connect using my XMPP client, the authentication fails and I see the following error in logs: auth: Error: BUG: Authentication client said it's PID 0 Have you ever heard about this? For information, dovecot version is 2.2.27. Thank you, Antoine Nguyen

4 6

imapc bug (signal 6)
by Ralf Hildebrandt 07 Sep '17

07 Sep '17

Running 2.3.0~alpha0-1~auto+1045, basically as a proxy between MUA and Exchange (IMAP): Sep 7 16:10:32 mproxy dovecot: imap-login: Login: user=<holtgrem>, method=PLAIN, rip=172.16.128.8, lip=141.42.206.11, mpid=61031, TLS, session=<fp3JBZpYop+sEIAI> Sep 7 16:10:32 mproxy dovecot: imap(holtgrem)<fp3JBZpYop+sEIAI>: imapc(exchange-imap.charite.de:993): Connected to 10.32.37.100:993 (local 141.42.206.11:58124) Sep 7 16:10:32 mproxy dovecot: imap(holtgrem)<fp3JBZpYop+sEIAI>: Panic: file mail-index-sync-update.c: line 1056 (mail_index_sync_map): assertion failed: (map->hdr.indexid == index->indexid || map->hdr.indexid == 0) Sep 7 16:10:32 mproxy dovecot: imap(holtgrem)<fp3JBZpYop+sEIAI>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xa1c2e) [0x7f059bd4cc2e] -> /usr/lib/dovecot/libdovecot.so.0(+0xa1d1c) [0x7f059bd4cd1c] -> /usr/lib/dovecot/libdovecot.so.0(i_fatal+0) [0x7f059bcdbbce] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_sync_map+0x6a0) [0x7f059c0c91c0] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_map+0xf8) [0x7f059c0c01c8] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_index_refresh+0xe) [0x7f059c0d66de] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_list_index_refresh_force+0x8c) [0x7f059c094e7c] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xab786) [0x7f059c091786] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0xabadc) [0x7f059c091adc] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync_deinit+0x35) [0x7f059c02f925] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_sync+0x4b) [0x7f059c0315bb] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](cmd_select_full+0x170) [0x55fac9ae2b60] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](command_exec+0x5c) [0x55fac9aea39c] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](+0x1b822) [0x55fac9ae8822] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](+0x1b8ac) [0x55fac9ae88ac] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](client_handle_input+0x1e5) [0x55fac9ae8d05] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](client_input+0x85) [0x55fac9ae9265] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_call_io+0x69) [0x7f059bd63469] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0x10a) [0x7f059bd64c9a] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_handler_run+0x52) [0x7f059bd63572] -> /usr/lib/dovecot/libdovecot.so.0(io_loop_run+0x38) [0x7f059bd63788] -> /usr/lib/dovecot/libdovecot.so.0(master_service_run+0x13) [0x7f059bce6fe3] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](main+0x343) [0x55fac9adb143] -> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf0) [0x7f059b901830] -> dovecot/imap [holtgrem 172.16.128.8 EXAMINE](+0xe323) [0x55fac9adb323] Sep 7 16:10:32 mproxy dovecot: imap(holtgrem)<fp3JBZpYop+sEIAI>: Fatal: master: service(imap): child 61031 killed with signal 6 (core dumped) Sep 7 16:10:33 mproxy dovecot: imap-login: Login: user=<holtgrem>, method=PLAIN, rip=172.16.128.8, lip=141.42.206.11, mpid=61034, TLS, session=<X48IBppYpJ+sEIAI> Sep 7 16:10:33 mproxy dovecot: imap(holtgrem)<X48IBppYpJ+sEIAI>: imapc(exchange-imap.charite.de:993): Connected to 10.32.37.100:993 (local 141.42.206.11:58128) Sep 7 16:10:33 mproxy dovecot: imap-login: Login: user=<holtgrem>, method=PLAIN, rip=172.16.128.8, lip=141.42.206.11, mpid=61036, TLS, session=<0CQPBppYpp+sEIAI> Sep 7 16:10:33 mproxy dovecot: imap(holtgrem)<0CQPBppYpp+sEIAI>: imapc(exchange-imap.charite.de:993): Connected to 10.32.37.100:993 (local 141.42.206.11:58132) Sep 7 16:12:30 mproxy dovecot: imap(holtgrem)<0CQPBppYpp+sEIAI>: Connection closed (EXAMINE finished 28.690 secs ago) in=643 out=101173 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Sep 7 16:12:30 mproxy dovecot: imap(holtgrem)<X48IBppYpJ+sEIAI>: Connection closed (FETCH running for 116.592 + waiting input for 0.001 secs, 0.001 in locks, 28 B in + 64787+2070 B out, state=wait-input) in=105 out=66175 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Sep 7 16:12:35 mproxy dovecot: imap-login: Login: user=<holtgrem>, method=PLAIN, rip=172.16.128.8, lip=141.42.206.11, mpid=61049, TLS, session=<2ZkfDZpYKKCsEIAI> Sep 7 16:12:35 mproxy dovecot: imap(holtgrem)<2ZkfDZpYKKCsEIAI>: imapc(exchange-imap.charite.de:993): Connected to 10.32.37.100:993 (local 141.42.206.11:58160) Sep 7 16:12:36 mproxy dovecot: imap-login: Login: user=<holtgrem>, method=PLAIN, rip=172.16.128.8, lip=141.42.206.11, mpid=61051, TLS, session=<eg9cDZpYLqCsEIAI> Sep 7 16:12:36 mproxy dovecot: imap(holtgrem)<eg9cDZpYLqCsEIAI>: imapc(exchange-imap.charite.de:993): Connected to 10.32.37.100:993 (local 141.42.206.11:58164) Sep 7 16:12:41 mproxy dovecot: imap(holtgrem)<2ZkfDZpYKKCsEIAI>: Error: imapc: Remote server didn't send BODY[] for UID 1 in Calendar/BIH BCU (FETCH replied: FETCH completed.) Sep 7 16:14:19 mproxy dovecot: imap(holtgrem)<2ZkfDZpYKKCsEIAI>: Error: imapc(exchange-imap.charite.de:993): Command '1321 APPEND "INBOX" (\Seen) "29-Aug-2017 11:36:49 +0200" {42176625}' failed with BAD: 1321 Command Argument Error. 11 Sep 7 16:14:19 mproxy dovecot: imap(holtgrem)<2ZkfDZpYKKCsEIAI>: Error: imapc: APPEND failed: Command Argument Error. 11 Sep 7 16:14:19 mproxy dovecot: imap(holtgrem)<2ZkfDZpYKKCsEIAI>: IMAP session state is inconsistent, please relogin. in=42180017 out=220890 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=788 Sep 7 16:14:19 mproxy dovecot: imap-login: Login: user=<holtgrem>, method=PLAIN, rip=172.16.128.8, lip=141.42.206.11, mpid=61072, TLS, session=<Aa2IE5pYkKCsEIAI> Sep 7 16:14:19 mproxy dovecot: imap(holtgrem)<Aa2IE5pYkKCsEIAI>: imapc(exchange-imap.charite.de:993): Connected to 10.32.37.100:993 (local 141.42.206.11:58198) Sep 7 16:14:27 mproxy dovecot: imap(holtgrem)<Aa2IE5pYkKCsEIAI>: Connection closed (EXAMINE finished 8.029 secs ago) in=63 out=1372 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 Sep 7 16:14:29 mproxy dovecot: imap(holtgrem)<eg9cDZpYLqCsEIAI>: Connection closed (FETCH running for 112.511 + waiting input for 0.001 secs, 0.001 in locks, 28 B in + 127311+2054 B out, state=wait-input) in=105 out=128699 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=0 body_bytes=0 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

1 0

master: Warning: Sent SIGKILL to 511 pop3-login processes
by Luciano Mannucci 07 Sep '17

07 Sep '17

I have a lot of "master: Warning: Sent SIGKILL to 511 pop3-login processes" in my log file. Should I worry? (I'm running # 2.2.32 (dfbe293d4)) Thanks to all, Luciano. -- /"\ /Via A. Salaino, 7 - 20144 Milano (Italy) \ / ASCII RIBBON CAMPAIGN / PHONE : +39 2 485781 FAX: +39 2 48578250 X AGAINST HTML MAIL / E-MAIL: posthamster(a)sublink.sublink.ORG / \ AND POSTINGS / WWW: http://www.lesassaie.IT/

1 0

migrate courier to dovecot and forward mail like maildrop does it
by Markus Rosjat 07 Sep '17

07 Sep '17

Hi there, I was wondering what's the way to go if I want to migrate my courier/maildrop setup to dovecot/sieve? Is it even possible or do I need something else? The approach of using maildrop with postfix just hit the fan because I'm to dumb to configure it :( so with maildrop I have a .mailfilter file with cc "!some_email(a)some_domain.tld" and this just works like a charm with courier and maildrop but whats the equivalent in dovecote and the sieve plugin ? regards -- Markus Rosjat fon: +49 351 8107223 mail: rosjat(a)ghweb.de G+H Webservice GbR Gorzolla, Herrmann Königsbrücker Str. 70, 01099 Dresden http://www.ghweb.de fon: +49 351 8107220 fax: +49 351 8107227 Bitte prüfen Sie, ob diese Mail wirklich ausgedruckt werden muss! Before you print it, think about your responsibility and commitment to the ENVIRONMENT

1 0

lda
by dovecotml＠fuckaround.org 07 Sep '17

07 Sep '17

Hi all :) I will try to use /usr/lib/dovecot/deliver instead of postfix. I'd like automatically move email to junk folder. I use debian 9. cat /etc/postfix/master.cf [...] spamassassin unix - n n - - pipe user=debian-spamd argv=/usr/bin/spamc -f -e /usr/lib/dovecot/deliver -f ${sender} -d ${recipient} with this line dovecot works perfectly but only with virtual users, my system has also system users /etc/passwd How to tell dovecot to deliver email also to real system users? Sep 03 17:05:08 auth: Debug: master in: USER 1 test(a)mydomain.org service=lda Sep 03 17:05:08 auth-worker(24749): Debug: passwd(test(a)mydomain.org): lookup Sep 03 17:05:08 auth: Debug: pam(test(a)mydomain.org): passdb doesn't support credential lookups Sep 03 17:05:08 lda(test(a)mydomain.org): Debug: auth USER input: Sep 03 17:05:08 auth: Debug: passwd-file(test(a)mydomain.org): lookup: user=todo(a)fuckaround.org file=/etc/dovecot/users Sep 03 17:05:08 auth: Debug: userdb out: NOTFOUND 1 Sep 03 17:05:08 auth: Debug: auth client connected (pid=24758) Sep 03 17:05:08 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=GIfuUUpY1BCXMEZw lip=192.168.0.2 rip=x.x.x.x lport=993 rport=4308 local_name=imap.mydomain.org Sep 03 17:05:08 auth: Debug: client passdb out: CONT 1 Sep 03 17:05:08 auth: Debug: client in: CONT 1 hfdskjfsdkjdshjkfd== (previous base64 data may contain sensitive data) Sep 03 17:05:08 auth-worker(24749): Debug: pam(user,151.48.70.112,<GIfuUUpY1BCXMEZw>): lookup service=dovecot Sep 03 17:05:08 auth-worker(24749): Debug: pam(user,151.48.70.112,<GIfuUUpY1BCXMEZw>): #1/1 style=1 msg=Password: Sep 03 17:05:09 auth: Debug: client passdb out: OK 1 user=user Sep 03 17:05:09 auth: Debug: master in: REQUEST 2331639809 24758 1 754574397549379543789547 session_pid=24760 request_auth_token thanks for help! Pol

4 4

Improve dovecot logging
by Slobodan Zdravkovic 06 Sep '17

06 Sep '17

In case when user login with pop3 and only download only mail headers (partial download), but not email body, there is nothing in mail.log Is it possible to configure one of the existing dovecot plugins to log actions like TOP and LIST or is it possible to write new plugin for dovecot which can fetch this actions ?

1 0

error while compiling
by Rajesh M 05 Sep '17

05 Sep '17

hello this may not be in the scope of this forum, so am sorry about that i use qmailtoaster with dovecot i am trying to update dovecot to version 2.29, using the source rpm rpmbuild --rebuild --define "dist .qt.el6" dovecot-2.2.29.1-15.qt.src.rpm but getting error as follow. help require to identify the cause please make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/quota' Making check in quota-clone make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/quota-clone' make[3]: Nothing to be done for `check'. make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/quota-clone' Making check in imap-quota make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/imap-quota' make[3]: Nothing to be done for `check'. make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/imap-quota' Making check in pop3-migration make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/pop3-migration' for bin in test-pop3-migration-plugin; do \ if ! ./$bin; then exit 1; fi; \ done pop3 migration get hdr sha1 .......................................... : ok 0 / 1 tests failed make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/pop3-migration' Making check in replication make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/replication' make[3]: Nothing to be done for `check'. make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/replication' Making check in snarf make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/snarf' make[3]: Nothing to be done for `check'. make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/snarf' Making check in stats make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/stats' make[3]: Nothing to be done for `check'. make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/stats' Making check in imap-stats make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/imap-stats' make[3]: Nothing to be done for `check'. make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/imap-stats' Making check in mail-crypt make[3]: Entering directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/mail-crypt' for bin in test-mail-global-key test-mail-key; do \ if ! env NOUNDEF=1 ./$bin; then exit 1; fi; \ done try_load_keys ........................................................ : ok test_empty_keyset .................................................... : ok 0 / 2 tests failed generate user key .................................................... : ok generate inbox key ................................................... : ok cache reset .......................................................... : ok verify keys .......................................................... : ok test-mail-key.c:429: Assert failed: mail_crypt_get_private_key(t, mcp_old_box_key_id, FALSE, FALSE, &privkey, &error) > 0 test: random seed #2 was 2074645272 test-mail-key(root): Error: mail_crypt_get_private_key(7c9a1039ea2e4fed73e81dd3ffc3fa22ea4a28352939adde7bf8ea858b00fa4f) failed: Cannot decrypt key 7c9a1039ea2e4fed73e81dd3ffc3fa22ea4a28352939adde7bf8ea858b00fa4f: error:100AE081:elliptic curve routines:EC_GROUP_new_by_curve_name:unknown group test-mail-key.c:438: Assert failed: privkey != NULL old keys ............................................................. : FAILED 1 / 5 tests failed make[3]: *** [check-test] Error 1 make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins/mail-crypt' make[2]: *** [check-recursive] Error 1 make[2]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src/plugins' make[1]: *** [check-recursive] Error 1 make[1]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.29.1/src' make: *** [check-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.LDWEGt (%check) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.LDWEGt (%check) thanks rajesh

1 0

pam authentication
by Pol Hallen 05 Sep '17

05 Sep '17

Hello all I use debian 9 with dovecot 2.x: real system users and virtual users: almost all works perfectly ;) Virtual users can connect via imap and pop using name + domain name: user00(a)domain1.org, etc. pam (real system users) users can connect via imap and pop ONLY without domain name It's a problem with pam authentication because linux make users authentication with only username (and not with also domain name) but I'd like user full email like test00(a)realdomain.org cat /etc/dovecot/conf.d/auth-passwdfile.conf.ext passdb { driver = passwd-file args = scheme=SHA256 username_format=%u /etc/dovecot/users } userdb { driver = passwd-file args = scheme=SHA256 username_format=%u /etc/dovecot/users } cat /etc/dovecot/conf.d/auth-system.conf.ext passdb { driver = pam } userdb { driver = passwd } inside /etc/dovecot/conf.d/10-auth.conf [...] #auth_username_format = %n is commented because I've multiple domains cat /var/log/dovecot.debug Sep 05 01:49:51 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Sep 05 01:49:51 auth: Debug: passwd-file /etc/dovecot/users: Read 4 users in 0 secs Sep 05 01:49:51 auth: Debug: auth client connected (pid=23412) Sep 05 01:49:51 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=hjdhgfghhg lip=192.168.1.100 rip=192.168.1.100 lport=143 rport=39356 resp=hsdfhsfddfjk jklsdfkljkdlskfljsdkjlfds== (previous base64 data may contain sensitive data) Sep 05 01:49:51 auth-worker(23414): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Sep 05 01:49:51 auth-worker(23414): Debug: passwd-file /etc/dovecot/users: Read 4 users in 0 secs Sep 05 01:49:51 auth-worker(23414): Debug: pam(test(a)realdomain.org,192.168.1.100,<PitAxGVYvJnAqAFk>): lookup service=dovecot Sep 05 01:49:51 auth-worker(23414): Debug: pam(test(a)realdomain.org,192.168.1.100,<PitAxGVYvJnAqAFk>): #1/1 style=1 msg=Password: Sep 05 01:49:53 auth: Debug: passwd-file(test(a)realdomain.org,192.168.1.100,<PitAxGVYvJnAqAFk>): lookup: user=test(a)realdomain.org file=/etc/dovecot/users Sep 05 01:49:55 auth: Debug: client passdb out: FAIL 1 user=test(a)realdomain.com Sep 05 01:51:15 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Sep 05 01:51:15 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Sep 05 01:51:15 auth: Debug: passwd-file /etc/dovecot/users: Read 4 users in 0 secs Sep 05 01:51:15 auth: Debug: auth client connected (pid=23461) Sep 05 01:51:26 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=ycnxyWVYQYokInmi lip=192.168.0.2 rip=36.34.121.162 lport=993 rport=35393 Sep 05 0 any idea? thanks for help! Pol -- Pol

3 13

transition from 1.x to 2? What did I break?
by Paul Beard 05 Sep '17

05 Sep '17

It’s been awhile since I set up my dovecot instance (like several years) and my transition from 1.x to 2 seems to have not gone well: all I can see is that authentication is banjaxed and I’m not sure what needs to be done to fix it. # 2.2.32 (dfbe293d4): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 10.3-STABLE i386 auth_debug = yes auth_mechanisms = plain login listen = *,[::] log_path = /var/log/dovecot.log mail_access_groups = mail mail_location = /var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { driver = pam } passdb { driver = pam } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/ssl/certs/dovecot.pem userdb { driver = passwd } userdb { driver = passwd } userdb { driver = passwd } protocol lda { postmaster_address = postmaster@redacted quota_full_tempfail = no } Sep 02 07:54:08 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<2hS8DDZYyN7AqAAB> Sep 02 07:54:08 auth: Debug: auth client connected (pid=47645) Sep 02 07:54:08 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<SFK8DDZYyt7AqAAB> Sep 02 07:54:54 auth: Warning: auth client 0 disconnected with 2 pending requests: EOF Sep 02 07:55:19 auth: Debug: auth client connected (pid=47714) Sep 02 07:55:19 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<WbD0EDZY2N7AqAAB> Sep 02 07:55:19 auth: Debug: auth client connected (pid=47716) Sep 02 07:55:19 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=192.168.0.1, lip=192.168.0.25, TLS handshaking: SSL_accept() failed: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher, session=<1Qb1EDZY2d7AqAAB>

3 3

Mac Os mail error while moving msg in subfolder
by Antonello Cioffi 05 Sep '17

05 Sep '17

Hi all we are experiencing several errors like this: WROTE Sep 05 11:30:57.700 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 35.156 UID COPY 76543 GARR.Eduroam_tech READ Sep 05 11:30:57.702 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 35.156 NO [CANNOT] Character not allowed in mailbox name: '.' (0.001 + 0.000 secs). WROTE Sep 05 11:30:57.719 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 36.156 UID STORE 76543 +FLAGS.SILENT (\Deleted) READ Sep 05 11:30:57.733 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 * 7776 FETCH (UID 76543 MODSEQ (201448)) 36.156 OK Store completed (0.012 + 0.000 + 0.011 secs). WROTE Sep 05 11:30:57.734 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 37.156 IDLE READ Sep 05 11:30:57.740 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x60000127b140 + idling READ Sep 05 11:31:08.857 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6000004b1dc0 -- thread:0x608001475180 * OK Still here READ Sep 05 11:31:09.369 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:mail.uniparthenope.it -- port:993 -- socket:0x6080006ba580 -- thread:0x608001475180 * OK Still here while a mail client on mac os tries to move a message to a subfolder Dovecot version in use is: 2.2.31 and the configuration extract file is: namespace { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = order = 0 prefix = separator = / subscriptions = yes type = private } namespace { disabled = no hidden = yes ignore_on_failure = no inbox = no list = no location = maildir:~/Maildir/expunged order = 0 prefix = .EXPUNGED/ separator = / subscriptions = yes type = private } all other client like thunderbird, outlook and horde imap web interface work fine. Is there something who could help me? thank you regards -- Dott. Antonello Cioffi Ufficio Servizi Informatici Università degli Studi di Napoli Parthenope Tel. 081/5475292 - Fax. 081/5475180

1 0

AW: problem with shared folders and acls - only able to share INBOX
by Christian Eisert 05 Sep '17

05 Sep '17

Hi, i found the solution for my problem (RTFM) doveadm acl debug => Folder \.Subfolder cannot be accessed => dots in maildir format I added a 'Layout=fs' to the namespace definition. Thanks and cheers Christian -----Ursprüngliche Nachricht----- Von: Christian Eisert [mailto:christian.eisert@gmx.net] Gesendet: Freitag, 1. September 2017 09:36 An: 'dovecot(a)dovecot.org' Betreff: problem with shared folders and acls - only able to share INBOX Hi everybody, I have a problem that I cannot share subfolders of the mailboxes INBOX , e.g. /Sent / Trash etc. but also no self created folders. The ACLs seem to be set right. I have the suspicion that the dictionary ( /var/lib/dovecot/db/shared-mailboxes.db ) is not updated - there are no entries for the sub folders I just cannot find the problem within my configuration. Many thanks for having a look at it. Cheers from Hamburg, Germany, Christian Configuration attached: ---------------------------------------------------------------------------- ---------------------------------- # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-3-amd64 x86_64 Debian 9.1 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes mail_debug = yes mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_plugins = acl mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = yes location = maildir:%%h/mail:INDEX=%h/shared/%%u:CONTROL=%h/shared/%%u:INDEXPVT=%h/share d/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db antispam_backend = pipe antispam_mail_notspam = learn_ham antispam_mail_sendmail = /usr/bin/rspamc antispam_mail_spam = learn_spam antispam_spam = Spam antispam_trash = Trash quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-scr ipt.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.mydomain.org/fullchain.pem ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128 :+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDE A:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = acl quota imap_quota antispam imap_acl } protocol lmtp { mail_plugins = acl sieve postmaster_address = postmaster(a)mydomain.org } ---------------------------------------------------------------------------- ----------------------------------

1 0

questions concerning dovecot
by Rajesh M 04 Sep '17

04 Sep '17

hello all had some basic questions 1) what is the logic behind the numbering of files in the conf.d folder ... is this to define the sequence of execution of the config files ? 2) Concerning global scripts, is the default.sieve, before i understand that they get executed when the user does not have his private sieve script. are sieve_before, sieve_after and sieve_global_path all globalscripts ? thanks rajesh

2 1

Failed to repair mdbox index / wrong dbox version
by Peer Heinlein 04 Sep '17

04 Sep '17

After a filesystem crash dovecot isn't able to repair some of the m-Files. That's okay in general -- but I wonder why he's complaining about "wrong dsync version" if I execute "doveadm force-resync" locally: doveadm(user(a)mailbox.org): Warning: mdbox /mail-mailbox/mailbox.org/1846405//mdbox/storage: rebuilding indexes doveadm(user(a)mailbox.org): Error: Corrupted dbox file /xxxx//mdbox/storage/m.340 (around offset=154): Invalid dbox version I would accept every log that it's too broken to be repaired, but "Invalid dbox version"? Maybe it's somewhere else a bug that this m-file couldn't be repaired? # 2.2.32 (dfbe293): /etc/dovecot/dovecot.conf # Object storage plugin version 2.2.32 (afd3ef1) # Pigeonhole version 0.4.20 (11e3001) # OS: Linux 3.16.0-4-amd64 x86_64 Debian 8.9 with mdbox/zlib. Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

1 0

v2.2.32 released
by Timo Sirainen 04 Sep '17

04 Sep '17

https://dovecot.org/releases/2.2/dovecot-2.2.32.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.32.tar.gz.sig Two more fixes since rc2. And repeating: There are various changes in this release that can be used to significantly reduce disk IO with: 1) NFS storage especially, but I guess also other remote filesystems and even some with local disks 2) When mail storage and INDEX storage are separated * imapc: Info-level line is logged every time when successfully connected to the remote server. This includes local/remote IP/port, which can be useful for matching against external logs. * config: Log a warning if plugin { key=no } is used explicitly. v2.3 will support "no" properly in plugin settings, but for now any value at all for a boolean plugin setting is treated as "yes", even if it's written as explicit "no". This change will now warn that it most likely won't work as intended. + Various optimizations to avoid accessing files/directories when it's not necessary. Especially avoid accessing mail root directories when INDEX directories point to a different filesystem. + mail_location can now include ITERINDEX parameter. This tells Dovecot to perform mailbox listing from the INDEX path instead of from the mail root path. It's mainly useful when the INDEX storage is on a faster storage. + mail_location can now include VOLATILEDIR=<path> parameter. This is used for creating lock files and in future potentially other files that don't need to exist permanently. The path could point to tmpfs for example. This is especially useful to avoid creating lock files to NFS or other remote filesystems. For example: mail_location=sdbox:~/sdbox:VOLATILEDIR=/tmp/volatile/%2.256Nu/%u + mail_location's LISTINDEX=<path> can now contain a full path. This allows storing mailbox list index to a different storage than the rest of the indexes, for example to tmpfs. + mail_location can now include NO-NOSELECT parameter. This automatically deletes any \NoSelect mailboxes that have no children. These mailboxes are sometimes confusing to users. + mail_location can now include BROKENCHAR=<char> parameter. This can be useful with imapc to access mailbox names that aren't valid mUTF-7 charset from remote servers. + If mailbox_list_index_very_dirty_syncs=yes, the list index is no longer refreshed against filesystem when listing mailboxes. This allows the mailbox listing to be done entirely by only reading the mailbox list index. + Added mailbox_list_index_include_inbox setting to control whether INBOX's STATUS information should be cached in the mailbox list index. The default is "no", but it may be useful to change it to "yes", especially if LISTINDEX points to tmpfs. + userdb can return chdir=<path>, which override mail_home for the chdir location. This can be useful to avoid accessing home directory on login. + userdb can return postlogin=<socket> to specify per-user imap/pop3 postlogin socket path. + cassandra: Add support for result paging by adding page_size=<n> parameter to the connect setting. + dsync/imapc, pop3-migration plugin: Strip also trailing tabs from headers when matching mails. This helps with migrations from Zimbra. + imap_logout_format supports now %{appended} and %{autoexpunged} + virtual plugin: Optimize IDLE to use mailbox list index for finding out when something has changed. + Added apparmor plugin. See https://wiki2.dovecot.org/Plugins/Apparmor - virtual plugin: A lot of fixes. In many cases it was also working very inefficiently or even incorrectly. - imap: NOTIFY parameter parsing was incorrectly "fixed" in v2.2.31. It was actually (mostly) working in previous versions, but broken in v2.2.31. - Modseq tracking didn't always work correctly. This could have caused imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to not work perfectly. - mdbox: "Inconsistency in map index" wasn't fixed automatically - dict-ldap: %variable values used in the LDAP filter weren't escaped. - quota=count: quota_warning = -storage=.. was never executed (try #2). v2.2.31 fixed it for -messages, but not for -storage. - imapc: >= 32 kB mail bodies were supposed to be cached for subsequent FETCHes, but weren't. - quota-status service didn't support recipient_delimiter - acl: Don't access dovecot-acl-list files with acl_globals_only=yes - mail_location: If INDEX dir is set, mailbox deletion deletes its childrens' indexes. For example if "box" is deleted, "box/child" index directory was deleted as well (but mails were preserved). - director: v2.2.31 caused rapid reconnection loops to directors that were down.

2 1

Commands loging to mail log
by Slobodan Zdravkovic 04 Sep '17

04 Sep '17

Hi, In case when user login with pop3 and only download only mail headers (partial download), but not email body, there is nothing in mail.log Is it possible to configure one of the existing dovecot plugins to log actions like TOP and LIST or is it possible to write new plugin for dovecot which can fetch this actions ? Thank you and regards,

1 0

Mixed Autehtnication and password schemes
by Raymond Sellars 04 Sep '17

04 Sep '17

Hi Looking for some confirmation/direction on how to achieve the following. We have a requirement to support both SASL PLAIN and DIGEST-MD5 authentication (certification reasons). In addition to this we have an application (webmail) that utilises a master password pattern for access, as the contain web portal provides the necessary authentication. I have access to users passwords in PLAIN text and looking to utilise the dict lookup mechanism for passwords. Problem #1 https://wiki2.dovecot.org/Authentication/MultipleDatabases - "Currently the fallback works only with the PLAIN authentication mechanism." The above not suggests I can't use DIGEST-MD5 with master password configuration, if using more than one passdb setup. I don't understand why there would be a restriction as the password validation should just fall through irrespective. Problem #2 How do I enforce some kind of account access policy Currently we're backing the authentication with an Identity and Authentication system. I would like to block IMAP access if a user's account is locked out, expired, or inactive. Similarly if there are too many IMAP attempts with the incorrect password I would like the account system wide to be locked out. With Dict lookup I don't seem a mechanism to keep the IDM system aware of login attempt/failures, since it pulls the plaintext password and validates internally. Is this possible? As a worse case does Dovecot implement any type of account access policies? Out IT security reviewers are hot on account policies, i.e. lockouts, expiries, and back off attempts. Thanks Raymond Solution Architect - Orion Health

2 4

Pigeonhole 0.4.20 source archive based on v. 0.4.20-rc1?
by Markus Schönhaber 02 Sep '17

02 Sep '17

Hi, looking at the source archive of pigeonhole 0.4.20 <https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.20.t…> I noticed that the contained ChangeLog mentions v0.4.20.rc1 as first entry and pigeonhole-version.h defines git revision 7cd71ba as version where I'd expect 4a55e6c. This is probably no big deal. But since Makefile.in and install-sh also differ (see attached diff) from the patch contained in <http://xi.rename-it.nl/debian.new/pool/jessie-rc-auto/dovecot-2.2/dovecot_2…> I thought I'd ask whether this is something without importance or something which should be changed. -- Regards mks

2 2

mail_log_events and dsync
by manu＠netbsd.org 02 Sep '17

02 Sep '17

Hello mail_log_events is handy to track what happened to a given message. Unfortunatly, it seems dsync activity is not captured. This causes messages to appear or vanish without a log trace. Did I miss a setting to get it? How should I track how something went wrong with dsync? -- Emmanuel Dreyfus http://hcpnet.free.fr/pubz manu(a)netbsd.org

1 0

RE: General IMAP question
by Joseph Tam 02 Sep '17

02 Sep '17

"Scott Techlist" <techlist06(a)msws.org> writes: > How will the IMAP account behave with the current mail_location setting below? > > mail_location = mbox:~/mail:INBOX=/var/mail/%u > > That is, where will the IMAP account's mail "go"? Right now it goes to > /var/mail/[localusername]. Maybe incorrectly, I assumed IMAP required > Maildir format? How are folders handled with this setting?. The one > IMAP account would be used for spamassassin training, it would need 2 > shared/public folders ("spam", "ham"). IMAP is a protocol: it does not dictate the storage format. You're free to use whatever format dovecot supplies a backend for, including mbox or maildir. What your mail_location specifies is that the INBOX is a mbox (not maildir) formatted file located at /var/mail/[localusername]. Other mailboxes are located in ~[localusername]/mail/* (also mbox formatted). If the IMAP account requires 2 externally supplied mailboxes or folders (spam, ham) accessible via IMAP, you'll either have to copy them into the IMAP user's mail/ folder, or setup special name spaces that maps to the mailboxes' path. The mailboxes need appropriate file permissions so that the IMAP user can access it. Joseph Tam <jtam.home(a)gmail.com>

1 0

Sync mailservera!
by nlekkas＠gmail.com 02 Sep '17

02 Sep '17

Hello to all ! I have two servers using dovecot and want to sync them with doveasm ...... I am using usersb as user backend ....database Can anyone help me config them... Is there any use guide about it ? Thans in advance for the help ! Nick

4 4

RE: General IMAP question
by Scott Techlist 01 Sep '17

01 Sep '17

Software is Centos7, Dovecot 2.2.10 >Use that single mailbox with IMAP, others stay to POP Thanks, I considered that and looked up the ways to restrict IMAP access. But: How will the IMAP account behave with the current mail_location setting below? mail_location = mbox:~/mail:INBOX=/var/mail/%u That is, where will the IMAP account's mail "go"? Right now it goes to /var/mail/[localusername]. Maybe incorrectly, I assumed IMAP required Maildir format? How are folders handled with this setting?. The one IMAP account would be used for spamassassin training, it would need 2 shared/public folders ("spam", "ham").

3 2

problem with shared folders and acls - only able to share INBOX
by Christian Eisert 01 Sep '17

01 Sep '17

Hi everybody, I have a problem that I cannot share subfolders of the mailboxes INBOX , e.g. /Sent / Trash etc. but also no self created folders. The ACLs seem to be set right. I have the suspicion that the dictionary ( /var/lib/dovecot/db/shared-mailboxes.db ) is not updated - there are no entries for the sub folders I just cannot find the problem within my configuration. Many thanks for having a look at it. Cheers from Hamburg, Germany, Christian Configuration attached: ---------------------------------------------------------------------------- ---------------------------------- # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-3-amd64 x86_64 Debian 9.1 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes mail_debug = yes mail_gid = vmail mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/mail:LAYOUT=fs mail_plugins = acl mail_privileged_group = vmail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = yes location = maildir:%%h/mail:INDEX=%h/shared/%%u:CONTROL=%h/shared/%%u:INDEXPVT=%h/share d/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db antispam_backend = pipe antispam_mail_notspam = learn_ham antispam_mail_sendmail = /usr/bin/rspamc antispam_mail_spam = learn_spam antispam_spam = Spam antispam_trash = Trash quota = maildir:User quota quota_exceeded_message = Benutzer %u hat das Speichervolumen überschritten. / User %u has exhausted allowed storage space. sieve = file:/var/vmail/sieve/%d/%n/scripts;active=/var/vmail/sieve/%d/%n/active-scr ipt.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve } protocols = imap lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = vmail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.mydomain.org/fullchain.pem ssl_cipher_list = EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA256:EECDH:+CAMELLIA128 :+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!IDE A:!ECDSA:kEDH:CAMELLIA128-SHA:AES128-SHA ssl_dh_parameters_length = 2048 ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol imap { imap_idle_notify_interval = 29 mins mail_max_userip_connections = 20 mail_plugins = acl quota imap_quota antispam imap_acl } protocol lmtp { mail_plugins = acl sieve postmaster_address = postmaster(a)mydomain.org } ---------------------------------------------------------------------------- ----------------------------------

1 0

Re: General IMAP question
by Joseph Tam 01 Sep '17

01 Sep '17

"Scott Techlist" <techlist06(a)msws.org> writes: > Currently my POP users have a max mbox size but that is how much it > will store before they "come get it". I ensure they have at least one > device set to delete from the server periodically (i.e. 1 week). So > users with multiple devices get their mail duplciated on their devices > and at least one devices keeps the server emptied so their mbox does > not hit any limits. Traditionally, POP was a store and forward protocol. The client would download all the message in INBOX, them empty the mailbox. Nowadays, many POP users configure their clients to "Leave on server mode", which essentially accumulate on the server. The client may or may not also keep a cached copy. > As I understand it, when using IMAP, the user's messages are > perpetually stored on the server. IMAP is oriented as a remote mail service (client fetches and manipulate mail data on a remote server), so yes, messages are meant to remain on the server until deleted. There are probably some clients that cache local copies, but the remote server is considered canonical, so that local copies are deleted if the remote copies disappear. > How do other's deal with this? Am I misunderstanding something? As > popular as it seems to be, these seem like big hurdles to overcome. > Appreciate some help for a IMAP noob. What problem are you trying to solve? Is there a particularly compelling reason for you to move to IMAP (if not, stay with POP3)? You want to curtail space usage by users? You want to force users to retain client side copies of the messages? (Mind you, you'll still could have the same problem with POP -- there's nothing you can do to enforce the client to download/delete messages. Whether you use IMAP or POP3, you'll probably need some client side set up.) Joseph Tam <jtam.home(a)gmail.com>

1 0

RE: Iterate All Dovecot Users !
by Nick Lekkas 31 Aug '17

31 Aug '17

Hi Thomas ! So simple.... But you save my ass ..... And yes it works ! Thanks a lot ! Really ! I appreciate it ! Thanks Nick -----Original Message----- From: Thomas Reifferscheid [mailto:thomas@reifferscheid.org] Sent: Thursday, August 31, 2017 10:49 PM To: nlekkas(a)gmail.com Subject: Re: Iterate All Dovecot Users ! Am 31.08.2017 um 18:18 schrieb Nick Lekkas: > Hello to all ! > > I am trying to write a script that iterate all users that are created in > dovecot and postfix .... > Is there any way ..? > Hi Nick for user in $(doveadm user -u '*'); do echo $user; done Thomas __________ Information from ESET Endpoint Antivirus, version of detection engine 16008 (20170831) __________ The message was checked by ESET Endpoint Antivirus. part000.txt - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 16008 (20170831) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

1 0

Iterate All Dovecot Users !
by Nick Lekkas 31 Aug '17

31 Aug '17

Hello to all ! I am trying to write a script that iterate all users that are created in dovecot and postfix .... Is there any way ..? Thanks in advance for your time ! Nick __________ Information from ESET Endpoint Antivirus, version of detection engine 16007 (20170831) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

2 1