- dovecot - dovecot.org

execute: /user/bin/checkpassword /user/libexec/dovecot/checkpassword-reply
by Steve Button 14 Jan '24

14 Jan '24

Hi, I have recently moved a dovecot installation from 2.2.36 on RHEL7.9 onto 2.3.20 on Amazon Linux 2023 and I'm now seeing the error message in the title relating to /usr/bin/checkpassword (which doesn't exist on either). This is a project that I've inherited, and I've never used dovecot previously. I've been searching around for a couple of days trying to figure this out. Running out of ideas. Here's a slightly redacted snippet from dovecot.log Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Performing passdb lookup Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): execute: /usr/bin/checkpassword /usr/libexec/dovecot/checkpassword-reply Jan 04 17:23:22 auth: Fatal: execv(/usr/bin/checkpassword) failed: No such file or directory Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Received input: Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): exit_status=84 Jan 04 17:23:22 auth: Error: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Child 106455 exited with status 84 Jan 04 17:23:22 auth: Debug: checkpassword(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Finished passdb lookup Jan 04 17:23:22 auth: Debug: auth(redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Auth request finished Jan 04 17:23:24 auth: Debug: client passdb out: FAIL 1 user=redacted(a)redacted.redacted.local code=temp_fail Jan 04 17:23:24 imap-login: Info: Disconnected: Connection closed (auth service reported temporary failure): user=redacted(a)redacted.redacted.local, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<6uwL/SEOzpt/AAAB> Jan 04 17:23:24 auth: Debug: auth client connected (pid=106456) Jan 04 17:23:24 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R5kq/SEO0Jt/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39888 As part of the build process we overwrite the config files with ones which are presumably from a previous version. In particular there's an auth.conf file which contains :- !include auth-checkpassword.conf.ext and in turn that file contains the stanza :- passdb { driver = checkpassword args = /usr/bin/checkpassword } which is where I guess the problem lies. The thing is the config files are almost identical on both systems. Here's the dovecot -n output... [root@server dovecot]# dovecot -n # 2.3.20 (xyz675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.61-85.141.amzn2023.x86_64 x86_64 ext4 # Hostname: server...1a97d auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 0 listen = * log_path = /var/project/log/dovecot/dovecot.log mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail mbox_write_locks = fcntl passdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /usr/bin/checkpassword driver = checkpassword } protocols = imap service auth { unix_listener auth-userdb \{ group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } userdb { driver = prefetch } Hi, I have recently moved a dovecot installation from 2.2.36 on RHEL7.9 onto 2.3.20 on Amazon Linux 2023 and I'm now seeing the error message in the title relating to /usr/bin/checkpassword (which doesn't exist on either). This is a project that I've inherited, and I've never used dovecot previously. I've been searching around for a couple of days trying to figure this out. Running out of ideas. Here's a slightly redacted snippet from dovecot.log Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Performing passdb lookup Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): execute: /usr/ bin/checkpassword /usr/libexec/dovecot/checkpassword-reply Jan 04 17:23:22 auth: Fatal: execv(/usr/bin/checkpassword) failed: No such file or directory Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Received input: Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): exit_status=84 Jan 04 17:23:22 auth: Error: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Child 106455 exited with status 84 Jan 04 17:23:22 auth: Debug: checkpassword (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Finished passdb lookup Jan 04 17:23:22 auth: Debug: auth (redacted(a)redacted.redacted.local,127.0.0.1,<6uwL/SEOzpt/AAAB>): Auth request finished Jan 04 17:23:24 auth: Debug: client passdb out: FAIL 1 user=redacted(a)redacted.redacted.local code=temp_fail Jan 04 17:23:24 imap-login: Info: Disconnected: Connection closed (auth service reported temporary failure): user=redacted(a)redacted.redacted.local, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<6uwL/SEOzpt/AAAB> Jan 04 17:23:24 auth: Debug: auth client connected (pid=106456) Jan 04 17:23:24 auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=R5kq/SEO0Jt/AAAB lip=127.0.0.1 rip=127.0.0.1 lport=143 rport=39888 As part of the build process we overwrite the config files with ones which are presumably from a previous version. In particular there's an auth.conf file which contains :- !include auth-checkpassword.conf.ext and in turn that file contains the stanza :- passdb { driver = checkpassword args = /usr/bin/checkpassword } which is where I guess the problem lies. The thing is the config files are almost identical on both systems. Here's the dovecot -n output... [root@server dovecot]# dovecot -n # 2.3.20 (xyz675d): /etc/dovecot/dovecot.conf # OS: Linux 6.1.61-85.141.amzn2023.x86_64 x86_64 ext4 # Hostname: server...1a97d auth_debug = yes auth_verbose = yes disable_plaintext_auth = no first_valid_gid = 0 first_valid_uid = 0 listen = * log_path = /var/project/log/dovecot/dovecot.log mail_location = maildir:/var/mail/vhosts/%d/%n mail_privileged_group = mail mbox_write_locks = fcntl passdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } passdb { args = /usr/bin/checkpassword driver = checkpassword } protocols = imap service auth { unix_listener auth-userdb \{ group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n driver = static } userdb { driver = prefetch }

2 1

Unconfigurable 500 ms debounce on IMAP IDLE notifications
by Alex 14 Jan '24

14 Jan '24

Hello all, I have been investigating the reason for high end-to-end email delivery delay (>1 second to send a message to echo bot and receive a reply back) on a Postfix+Dovecot email server setup used to run the tests for Delta Chat core [1]. It appeared that most of the time was spent between the submission SMTP service accepting the mail for delivery and receiving an IDLE wakeup on the other side. Looking into the Dovecot source code, I found that all notifications from the storage to callbacks set up by IDLE are delayed by a debounce constant NOTIFY_DELAY_MSECS [2]. It appears to have been added in 2009 [3], but even before that Dovecot was only delivering notifications when a second-resolution timer is changed by at least 1, so IDLE notifications probably were delayed by half a second on average even before that. Commit message says "If the notification is done immediately, IDLE may not notice the change because it's not finished yet." This sounds like a workaround for some internal Dovecot bug. I have nevertheless tried to compile Dovecot with this constant reduced from 500 ms to 1 ms [4] and it resulted in exceptionally fast delivery without any problems caused to the Delta Chat core online test suite which is using this Postfix+Dovecot server accounts. We are running all the tests against this server and it appears to work fine. Round trip time for sending a message to an echo bot and receiving a reply back is reduced from 1.1 s to 0.2 s, which is easily visible in a chat app [5]. I wonder if this debounce delay was added as a workaround for an internal Dovecot bug or a client bug and is not necessary anymore. It does not seem to be useful for well-behaving clients because if necessary the client may debounce notifications on its side and postpone interrupting IDLE with "DONE". I would actually like to disable this delay completely on our server setup [6], as for chat it is common to receive multiple messages in a short period of time, e.g. when sending a message to a group and receiving multiple read receipts from currently active users. [1] https://github.com/deltachat/deltachat-core-rust/ [2] https://github.com/dovecot/core/blob/93a53a9d590f0220de28600f36a969cc38c314… [3] https://github.com/dovecot/core/commit/56fb5d09955b6097f77b341717fd9b70e9f1… [4] https://github.com/deltachat/chatmail/issues/72#issuecomment-1806645153 [5] https://delta.chat/assets/blog/nine-echo.mp4 [6] https://github.com/deltachat/chatmail Best regards, Alex

2 6

Lots of "dovecot: auth: Error: auth client 0 disconnected with 1 pending requests: EOF" errors in error.log
by Jay Sladojevic 14 Jan '24

14 Jan '24

I've recently upgraded to dovecot 2.3 and now my error.log is full of this message: dovecot: auth: Error: auth client 0 disconnected with 1 pending requests: EOF In earlier versions, this error was logged at a warning level. What is the rationale behind the elevation to error log level? May I suggest to revert this change? (fyi: the code in question is in /src/auth/auth-client-connection.c) static void auth_client_disconnected(struct auth_client_connection **_conn) { struct auth_client_connection *conn = *_conn; unsigned int request_count; int err; *_conn = NULL; if (conn->input->stream_errno != 0) err = conn->input->stream_errno; else if (conn->output->stream_errno != 0) err = conn->output->stream_errno; else err = 0; request_count = conn->request_handler == NULL ? 0 : auth_request_handler_get_request_count(conn->request_handler); if (request_count > 0) { e_error(conn->event, "auth client %u disconnected with %u " "pending requests: %s", conn->pid, request_count, err == 0 ? "EOF" : strerror(err)); } auth_client_connection_destroy(&conn); }

1 0

Redirects 550'd So why no SRS method
by Laura Steynes 05 Jan '24

05 Jan '24

Happy New Year! Now to Aki, Timo, Corr, why, when setting up mail forwarding, is sieve not automatically configuring rules for SRS, it has this ability for long time, yet dovecots sieve based forwarding just creates a plain old redirect "forward" resulting in,in 2024, 99% of forwarded emails getting rejected for failing SPF because it's not enabling the require or the rules needed for successful sender rewriting. Is this an oversight? and I suppose the bigger question is, when is it planned to be corrected to using SRS method? Happy New Year! Now to Aki, Timo, Corr, why, when setting up mail forwarding, is sieve not automatically configuring rules for SRS, it has this ability for long time, yet dovecots sieve based forwarding just creates a plain old redirect "forward" resulting in,in 2024, 99% of forwarded emails getting rejected for failing SPF because it's not enabling the require or the rules needed for successful sender rewriting. Is this an oversight? and I suppose the bigger question is, when is it planned to be corrected to using SRS method?

3 2

Piegonhole behaviour when redirect fails
by Aubry Jaquier 04 Jan '24

04 Jan '24

Hello, I noticed an unusual behavior of the implicit keep from pigeonhole when a redirect fails in a sieve script. For instance, with the sieve below, if the relay host is unavailable, dovecot will not accept the email and will respond with a tempfail. redirect "myaddress(a)domain.com"; stop; But if my sieve script has a fileinto inside (see the example below), dovecot will accept the message, copy the email in the INBOX and in the folder from the fileinto and write the following log "Execution of script filter.sieve failed, but implicit keep was successful" fileinto "Folder"; redirect "myaddress(a)domain.com"; stop; According to the RFC 5228, section 2.10.2 Implicit keep, the last example should not trigger an implicit keep but act like the first example. An implicit keep is performed if a message is not written to a mailbox, redirected to a new address, or explicitly thrown out. That is, if a fileinto, a keep, a redirect, or a discard is performed, an implicit keep is not. Does it look like a bug to you, or is this the intended behaviour ? Best regards, Aubry Hello, I noticed an unusual behavior of the implicit keep from pigeonhole when a redirect fails in a sieve script. For instance, with the sieve below, if the relay host is unavailable, dovecot will not accept the email and will respond with a tempfail. redirect "myaddress(a)domain.com"; stop; But if my sieve script has a fileinto inside (see the example below), dovecot will accept the message, copy the email in the INBOX and in the folder from the fileinto and write the following log "Execution of script filter.sieve failed, but implicit keep was successful" fileinto "Folder"; redirect "myaddress(a)domain.com"; stop; According to the RFC 5228, section 2.10.2 Implicit keep, the last example should not trigger an implicit keep but act like the first example. An implicit keep is performed if a message is not written to a mailbox, redirected to a new address, or explicitly thrown out. That is, if a fileinto, a keep, a redirect, or a discard is performed, an implicit keep is not. Does it look like a bug to you, or is this the intended behaviour ? Best regards, Aubry

2 1

Autocreate virtual users' home directory?
by John Fawcett 04 Jan '24

04 Jan '24

Hi I have recently rectified an old configuration error whereby I had virtual users' home and mail directories set to the same value. I used option 3 from "ways to set up home directory" https://doc.dovecot.org/configuration_manual/home_directories_for_virtual_u… so I have: home= |/var/vmail/domain/user/home/| mail= |/var/vmail/domain/user/| |where domain and user are substituted for the real domain and user.| For existing users where I created the home directory when migrating the settings, there is no issue. But I am seeing errors like this for new users: lmtp(test(a)example.com)<125035><EHDOAyS1lWVr6AEAjpgUYA>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/vmail/example.com/test@example.com/home//dovecot.au… failed: safe_mkstemp(/var/vmail/example.com/test@example.com/home//dovecot.autoexpu… failed: No such file or directory Seems that differently to mail directory which is automatically created, the home directory is not created. I couldn't see any config setting that would autocreate home directories (where home directories are subdirectories of mail directories). Would it be worthwhile introducing an autocreate option for home directories? John Hi I have recently rectified an old configuration error whereby I had virtual users' home and mail directories set to the same value. I used option 3 from "ways to set up home directory" https://doc.dovecot.org/configuration_manual/ home_directories_for_virtual_users/ so I have: home= /var/vmail/domain/user/home/ mail= /var/vmail/domain/user/ where domain and user are substituted for the real domain and user. For existing users where I created the home directory when migrating the settings, there is no issue. But I am seeing errors like this for new users: lmtp(test(a)example.com)<125035><EHDOAyS1lWVr6AEAjpgUYA>: Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/vmail/ example.com/test@example.com/home//dovecot.autoexpunge.lock) failed: safe_mkstemp(/var/vmail/example.com/test@example.com/home// dovecot.autoexpunge.lock) failed: No such file or directory Seems that differently to mail directory which is automatically created, the home directory is not created. I couldn't see any config setting that would autocreate home directories (where home directories are subdirectories of mail directories). Would it be worthwhile introducing an autocreate option for home directories? John

2 2

Solr/Tika patches for dovecot 2.3.21
by John Fawcett 03 Jan '24

03 Jan '24

Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John *dovecot-2.3.21-tika-http-auth.patch* Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika *dovecot-2.3.21-solr-max-size.patch * This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M *dovecot-2.3.21-solr-max-rows.patch * When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger. Hi I've just made updated versions of 3 patches against the latest release 2.3.21 in case they are useful to someone or might get considered for official inclusion. John dovecot-2.3.21-tika-http-auth.patch Allows specification of username and password in the fts_tika setting for basic auth against tika server. For example fts_tika = https://user:password@tika_server:443/tika dovecot-2.3.21-solr-max-size.patch This is a simplified version of my previous patch. Sets a size limit (configuration fts_max_size) on message bodies that are to be indexed. Message bodies for messages larger than fts_max_size are not sent to solr. Defaults to zero which means no limit. For example fts_max_size = 10M dovecot-2.3.21-solr-max-rows.patch When dovecot sends a search to solr it uses the rows parameter. For multiple mailbox search the value used is SOLR_MAX_MULTI_ROWS , hardcoded to 100000. For single mailbox search the value is uidnext. This patch introduces an upper limit for single mailbox search using the same value as SOLR_MAX_MULTI_ROWS, while leaving the existing functionality of sending the uidnext value if it is smaller. This is just to place a more reasonable upper bound since uidnext can get much larger.

2 2

how to take mdbox extract of time interval and restore that again?
by lutz.niederer＠gmx.net 03 Jan '24

03 Jan '24

Hi! Due to a fatal hardware error we have to extract data of all existing imap accounts and all their boxes/folders etc. from an mdbox store starting with the 5th of december until today. Then we have to restore the old system and import the data back into it. Mail before 5th will come from the system backup, newer mail from that export. After that it may be possible that some/few mails may exist twice in the boxes, but that's ok. 1. What would be the command line for doveadm to extract everything starting the 5th? I find that the command line for doveadm is pretty complicated. I tried but I am not sure if I really got all mails exported. So I would like to ask if someone with much more experience can give me a command line that surely does what we want. The command will be run from a remote machine. 2. And what would be the command line to restore all the mails that we have exported back into the system? (The folder and account structure is the same.) 3. After that some of the mails may exist twice. Is that a problem, maybe because of internal IDs? 4. Are there any other things we need to be aware of when doing that? I thank you very much for your help! Cheers! -lutzn

2 1

Broken Docs
by Peter 02 Jan '24

02 Jan '24

The page: https://doc.dovecot.org/configuration_manual/protocols/lmtp_server/ ... has links to the old dovecot wiki which are now broken, specifically the Postfix and Exim links at the bottom of the page. Can someone please port those pages over to the docs and fix the links? Peter

2 1

Certificate of the documentation site (https://doc.dovecot.org/)
by gileh13242＠vasteron.com 02 Jan '24

02 Jan '24

Hey ! Your certificate expired today, I can't access it because of my business proxy :). [No Error] (TLS code: X509_V_ERR_CERT_HAS_EXPIRED) SSL Certificate expired on: Jan 2 06:31:02 2024 GMT Have a nice day !

2 1

A bug and a misleading description
by David Van Edwards 01 Jan '24

01 Jan '24

!. I have just tried deleting Sent messages and when I put the search string 1:200 in only one message was deleted. And when I put in 1:500 again only one message was deleted. In both cases a green message box came up saying the operation was successful. 2. I successfully deleted 1000 messages from my Inbox using the search string 1:1000 but it was not clear to me that this would delete the 1000 most RECENT emails, not as I imagined the FIRST 1000 emails counting from the beginning. Is that the case? It certainly seems to have been the result and it’s rather upsetting. Should your documentation make it clear whether 1:1000 is counting forwards or backwards? Best wishes, David David Van Edwards The Smokehouse 6 Whitwell Road, Norwich NR1 4HB 01603 629899 david(a)vanedwards.co.uk https://www.vanedwards.co.uk

2 1

Authentication failure due to address space limit
by Max Nikulin 26 Dec '23

26 Dec '23

Hi, I faced an error that appeared rather obscure at first, so I am trying to figure out if something can be improved. I have managed to solve the issue. I am running a Dovecot IMAP server to keep my personal mail archive. This server does not receive or send mail, just IMAP access. There was no reason to tune its performance, so its configuration is close to what Debian package has out of the box (actually doc/example-config). At certain moment I started to get authentication failures: dovecot[72165]: auth-worker: Error: fatal error: failed to reserve page summary memory dovecot[72165]: auth-worker: Error: dovecot[72165]: auth-worker: Error: runtime stack: dovecot[72165]: auth-worker: Error: runtime.throw({0x7f552c418194?, 0x7f552c1feb10?}) dovecot[72165]: auth-worker: Error: runtime/panic.go:1047 +0x5f fp=0x7f552c1feac0 sp=0x7f552c1fea90 pc=0x7f552c28a53f dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).sysInit(0x7f552c5f6fd0) dovecot[72165]: auth-worker: Error: runtime/mpagealloc_64bit.go:82 +0x195 fp=0x7f552c1feb48 sp=0x7f552c1feac0 pc=0x7f552c280ef5 dovecot[72165]: auth-worker: Error: runtime.(*pageAlloc).init(0x7f552c5f6fd0, 0x7f552c5f6fc0, 0x0?) dovecot[72165]: auth-worker: Error: runtime/mpagealloc.go:324 +0x70 fp=0x7f552c1feb70 sp=0x7f552c1feb48 pc=0x7f552c27eb50 dovecot[72165]: auth-worker: Error: runtime.(*mheap).init(0x7f552c5f6fc0) dovecot[72165]: auth-worker: Error: runtime/mheap.go:729 +0x13f fp=0x7f552c1feba8 sp=0x7f552c1feb70 pc=0x7f552c27bf5f dovecot[72165]: auth-worker: Error: runtime.mallocinit() dovecot[72165]: auth-worker: Error: runtime/malloc.go:407 +0xb2 fp=0x7f552c1febd0 sp=0x7f552c1feba8 pc=0x7f552c260e72 dovecot[72165]: auth-worker: Error: runtime.schedinit() dovecot[72165]: auth-worker: Error: runtime/proc.go:693 +0xab fp=0x7f552c1fec30 sp=0x7f552c1febd0 pc=0x7f552c28df0b dovecot[72165]: auth-worker: Error: runtime.rt0_go() dovecot[72165]: auth-worker: Error: runtime/asm_amd64.s:345 +0x120 fp=0x7f552c1fec38 sp=0x7f552c1fec30 pc=0x7f552c2b7c20 dovecot[72165]: auth: Error: auth-worker: Aborted PASSV request for mailuser: Worker process died unexpectedly dovecot[72165]: auth-worker: Fatal: master: service(auth-worker): child 72211 returned error 2 Such errors happen even for invalid users curl -v 'imap://bad:bad@localhost/' I have realized that it may be related to the pam_fscrypt plugin I had installed before. It is intended for another system user, so I did not expect any negative consequence on Dovecot. Disabling the module confirmed my guess. This PAM module is written in Go and language runtime requires almost 1G of address space (RLIMIT_AS) even when actual memory allocation is several times lower (the user has no configured login protector). https://github.com/golang/go/issues/38010 "runtime: high startup address space usage (RLIMIT_AS) on Linux AMD64" The code of the fscrypt PAM module has Go panic handlers, but this case error happens early during runtime initialization, so error handlers have not set yet and can not provide a more instructive error. I do not like that Go has no knobs like compile or link flags to prevent early allocation of rather large address space. At the same time I admit that doing garbage collection efficiently is tricky and unreasonable efforts may be required to allow modest address space at startup. Default Dovecot configuration has vsz_limit = $default_vsz_limit = 256M The following configuration snippet solves the issue: service auth-worker { # still crash, but later # vsz_limit = 800M vsz_limit = 1024M } I am realizing that my use case is rather specific. Mail and encrypted home directories are hardly compatible. However some other PAM modules may cause similar issues. Cgroup Linux kernel feature should allow to limit real memory usage and it should be better than per-process limits imposed on address space size. However assigning proper control groups for Dovecot processes may be not so trivial. I am unsure if auth-worker vsz_limit or default_vsz_limit should be raised in the example configuration. Do you think it is reasonable to add warnings concerning PAM plugins and vsz_limit to docs? I mean - https://doc.dovecot.org/configuration_manual/authentication/pam/ - https://doc.dovecot.org/configuration_manual/service_configuration/#auth-wo… in a similar way as it is done for Argon2 in https://doc.dovecot.org/configuration_manual/authentication/password_scheme… P.S. Debian 12 bookworm, Dovecot 1:2.3.19.1+dfsg1-2.1

2 4

Elevate Your Storytelling Experience with Start Motion Media
by petersthomas383＠gmail.com 19 Dec '23

19 Dec '23

Startmotionmedia.com Media, we specialize in crafting captivating visual narratives through expert video production services. Our dedicated team focuses on delivering compelling storytelling that resonates across diverse industries, creating impactful videos that leave a lasting impression. At Start Motion Media, our mission is to bring creativity to life. From conceptualization to production, we ensure each project reflects our commitment to excellence. Our portfolio showcases the artistry and skill behind Start Motion Media's captivating visual storytelling. Experience storytelling prowess firsthand by exploring <a href="https://www.startmotionmedia.com/can-web-development-be-a-side-hustle-for-s…">startmotionmedia</a>. Immerse yourself in our gallery of projects, witnessing the transformative power of visual narratives. Start Motion Media invites you to witness how storytelling unfolds through our lens, shaping brands and captivating audiences worldwide. For businesses seeking to amplify their narratives and engage audiences effectively, Start Motion Media is the answer. Harness the storytelling expertise of Start Motion Media to elevate your brand's story and make a lasting impact in the digital sphere.

1 0

Re-Enabling TLS1.1 in dovecot 2.3.16
by Nils 14 Dec '23

14 Dec '23

Hi, I'd like to re-enable TLS1.1 (at least temporary) to see if it fixes a problem with one of my clients. When I add "ssl_min_protocol = TLSv1.1" to either dovecot.conf or conf.d/10-ssl.conf it doesn't seem to have an effect. Still the client is not working. I used testssl.sh to check the available ssl versions and it says that tls1.1 is not offered: $ ./testssl.sh --starttls imap SERVERNAME.TLD:143 ... Service set: STARTTLS via IMAP Testing protocols via sockets SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 not offered TLS 1.1 not offered TLS 1.2 offered (OK) TLS 1.3 offered (OK): final Kind regards, Nils

2 2

dovecot submission max line length
by Kees van Vloten 13 Dec '23

13 Dec '23

Hi all, After upgrading Debian Bullseye (Dovecot 2.3.13) to Bookworm (Dovcecot 2.3.19), submission-login returns an error on Kerberos authentication: "Client sent invalid command: Command line is too long". When I initially set this up on Bullseye I have seen the same issue, but adding "imap_max_line_length = 2M" solved it. Now with 2.3.19 kerberos authentication still works (with this setting) for imap connections but it stopped working for submission. Is there a new config setting for submission-login that I missed? Or is this a bug in 2.3.19? - Kees.

3 3

Username used by dovecot to access database certificate and key files
by John Fawcett 08 Dec '23

08 Dec '23

Hi does anyone happen to know the username under which dovecot accesses the certificate and key files when connecting to a mariadb database with ssl? I can't seem to get dovecot to read the files without a "other" readable bit set. I have dovecot users in mysql with the following connect string in dovecot-sql.conf.ext connect = host=x.x.x host=y.y.y host=z.z.z dbname=maildb user=mailuser password=xxxxxx \ ssl_ca=/etc/ssl/mysql/ca-cert.pem \ ssl_cert=/etc/ssl/mysql/client-cert.pem \ ssl_key=/etc/ssl/mysql/client-key.pem \ ssl_verify_server_cert=yes The certificate and key files in /etc/ssl/mysql/ are owned by root with group users: ls -l /etc/ssl/mysql total 12 -r--r--r--. 1 root root 2041 Jun 22 15:32 ca-cert.pem -r--r--r--. 1 root users 1907 Jun 22 15:32 client-cert.pem -r--r--r--. 1 root users 3272 Jun 22 15:32 client-key.pem For my test dovecot, dovenull and vmail are all members of group users: grep users /etc/group users:x:100:postfix,dovecot,dovenull,vmail If I remove the "other" readable attribute on the certificate and key files, dovecot complains it can't connect to the db server: auth: Error: mysql(x.x.x): Connect failed to database (maildb): TLS/SSL error: Permission denied (13) - waiting for 1 seconds before retry I realize it only adds marginal security to not have these files world readable, but still it is puzzling why dovecot cannot read them in that case. Can anyone see what I am missing? Thanks John

3 5

Unlocking Entertainment Excellence: Explore jGuru's Latest Netflix Series Guide
by Angelique Medina 08 Dec '23

08 Dec '23

Discover a digital haven at jgurucom, where entertainment expertise meets insightful curation. JGuru, a premier online destination, stands as a beacon for enthusiasts seeking the latest trends and in-depth knowledge. As a dynamic platform, jGuru transcends conventional boundaries, offering a plethora of resources for tech aficionados, gamers, and pop culture enthusiasts alike. Navigate through jGuru's diverse content to unearth gems like their comprehensive guide to the most anticipated Netflix series of 2022. Delve into the intricacies of storytelling, cinematography, and exclusive insights that make each series a must-watch. JGuru's commitment to excellence shines through in its meticulous coverage, establishing it as a go-to hub for all things entertainment. For an unparalleled experience, visit http://www.jguru.com/the-most-anticipated-netflix-series-2022/ – where entertainment aficionados converge to elevate their viewing journey. JGuru: Your Gateway to Entertainment Brilliance.

1 0

Compiler error
by Goetz Schultz 06 Dec '23

06 Dec '23

Hi, I have upgraded my system to FreeBSD14 and tried to recompile dovecot. The following error is thrown now (It did compile on FBSD13): <quote> test-mail-index-transaction-update.c:650:36: error: incompatible pointer to integer conversion passing 'char *(*)(int, int)' to parameter of type 'time_t' (aka 'long') [-Wint-conversion] mail_index_update_day_headers(t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ </quote> (t, tests[i].now + timezone); ^~~~~~~~~~~~~~~~~~~~~~~ Is there a patch or something like that to compensate? -- Thanks and regards Goetz R Schultz ---------------->8---------------- Quis custodiet ipsos custodes? /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ ----------------8<---------------- ---------------------------->8------------------------------ /"\ \ / ASCII Ribbon Campaign X against HTML e-mail / \ This message is transmitted on 100% recycled electrons. ---------------------------->8------------------------------ Unsigned message - no responsibillity that content is not altered

4 9

replicator: Panic: data stack: Out of memory when allocating 268435496 bytes
by Gerben Wierda 05 Dec '23

05 Dec '23

One step further in my quest to create a replacement mail server. I now have my old mail server (2.3.19.1, macOS + MacPorts) and my new (2.3.20, Alpine Linux, Docker, apk package). When I turn on replication it works, but, after a while I see: Jan 06 00:50:31 replicator: Panic: data stack: Out of memory when allocating 268435496 bytes Jan 06 00:50:32 replicator: Fatal: master: service(replicator): child 133 killed with signal 6 (core dumped) Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Sync failure: Jan 06 00:50:32 lmtp(pid 195 user sysbh): Warning: replication(sysbh): Remote sent invalid input: - I've removed synchronous operation for now (found a message on the net suggesting that) but is this known and what does it mean? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

6 15

Enhance Your Website Content: Logicsofts' Expert Tips
by Angelique Medina 04 Dec '23

04 Dec '23

Logicsofts, a leading web development company, is dedicated to empowering businesses through cutting-edge solutions. With a proven track record of creating visually appealing and functionally robust websites, Logicsofts stands out in the digital landscape. Their commitment to excellence extends to providing valuable insights through their blog. In a recent post https://www.logicsofts.co.uk/blog/how-to-write-website-content-rules-to-fol… , Logicsofts unravels the art of crafting compelling website content. The blog delves into essential rules for creating impactful content that resonates with your audience. Logicsofts emphasizes the significance of engaging and user-centric content to boost online presence and drive conversions. For businesses seeking to elevate their online game, Logicsofts' blog is a goldmine of practical advice. Implement the strategies outlined in the post to transform your website content and leave a lasting impression on your visitors. Explore the full article for a deep dive into the nuances of content creation - an invaluable resource for businesses striving to stay ahead in the digital realm.

1 0

auth_mechanisms per listener or local_name?
by Kees van Vloten 01 Dec '23

01 Dec '23

Hi all, I would like to use kerberos authentication on the local network but not for connections from internet, which are forwarded by haproxy. So both types of login can be distinguished by a different inet_listener and also a different by local_name. Is there a way to set auth_mechanisms such the it will impossible to use kerberos via haproxy connections or by filtering on local_name? - Kees.

1 0

client port int auth-worker log
by Joao Reis 29 Nov '23

29 Nov '23

Hello, Can the client's port number be included in the log entries generated by auth-worker, without needing to recompile Dovecot? Currently, the log entries look like this: |auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123): Password mismatch | I would like the log entries to appear as follows: |auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123,45343): Password mismatch | In this format, the client's port number (e.g., 45343) is also logged. thanks in advance. Hello, Can the client's port number be included in the log entries generated by auth- worker, without needing to recompile Dovecot? Currently, the log entries look like this: auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123): Password mismatch I would like the log entries to appear as follows: auth-worker(3538137): sql(user(a)domain.tld,123.123.123.123,45343): Password mismatch In this format, the client's port number (e.g., 45343) is also logged. thanks in advance.

1 0

Re: Replication going away?
by Peter Wienemann 28 Nov '23

28 Nov '23

Hi, On 2023-11-28 16:20:56 +0100, gerben.wierda(a)rna.nl wrote: >From what version on is replication gone? I am running 2.3.20 and it still there. it will be gone from version 2.4/3.0 onward (see [0]). Best regards, Peter [0] https://doc.dovecot.org/3.0/installation_guide/upgrading/from-2.3-to-3.0

1 0

I've sent a question to dovecot@dovecot.org via mail. Why is it not ending up here?
by gerben.wierda＠rna.nl 28 Nov '23

28 Nov '23

This is what my postfix server says: Nov 28 14:23:12 albus postfix/qmgr[654]: 823D71CDE2714: from=<gerben.wierda(a)rna.nl>, size=9144, nrcpt=1 (que ue active) Nov 28 14:23:12 albus postfix/smtp[2294]: Untrusted TLS connection established to talvi.dovecot.org[94.237.1 05.223]:25: TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server -signature RSA-PSS (2048 bits) server-digest SHA256 Nov 28 14:23:13 albus postfix/smtp[2294]: 823D71CDE2714: to=<dovecot(a)dovecot.org>, relay=talvi.dovecot.org[9 4.237.105.223]:25, delay=2.1, delays=0.51/0.02/0.75/0.83, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as E5 C425DEEF) Nov 28 14:23:13 albus postfix/qmgr[654]: 823D71CDE2714: removed But I can't see it here nor do I get it sent back to me.

1 0

OT? Maybe so, maybe no.
by joe a 27 Nov '23

27 Nov '23

Dovecot installation on OpenSuse LEAP 15.5. Works fine via Thunderbird. Roundcube install works great. Astonishing given my rusting skills. But only until . . . I try to send email. Then RoundCube tells me smtp error(): connection to server failed. Well, yeah, 'you're trying port 587, when I told you to use port 25. Whatareya, dense?'. Nah, yer just a machine, must be me. Posted on Roundcube board, views but no replies. Perhaps someone here knows what else I need to change besides: ~etc/roundcubemail/config.inc.php //$config['smtp_port'] = 587; $config['smtp_port'] = 25; I don't find any other relevant referenced to SMTP port in RC configuration.

2 5

Couldn't get vsize Issue
by duluxoz 26 Nov '23

26 Nov '23

Hi All, Looking for a little help, please. We're getting the following showing up in our dovecot logs: `Debug: Mailbox Junk: Couldn't get vsize from mailbox list index: Record for vsize`. This is happening for all(?) the different mailboxes We're not sure what we're looking at or looking for to even begin the t/shoot. I dropped the above into google but couldn't *seem* to find anything relevant. Would someone(s) be able to point me in the right direction as to what the actual issue is (ie some more in-depth detail than just the log message - yes, it may be obvious to some but not to me) and, more importantly, what to look at to get it resolved, please. :-) Thanks in advance Dulux-Oz

3 4

Re: How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 26 Nov '23

26 Nov '23

I would like to avoid making a local deep copy first. This essentially doubles the required storage on the local disk and it also wears down the disk much faster as I will write gigabytes of data onto the disk every 24 hours. I would prefer an option which allows the backup program (Borg backup in my case) to only read the local data and send it to the remote backup space directly.

3 3

2 users who are the same user
by Michael Grant 26 Nov '23

26 Nov '23

I have been using system users (/etc/passwd). I recently started using, in addition, passwd-file with a separate dovecot password database so that I could have user@domainname users with a different password as their shell login password. This means I have dovecot authenticating on users in both /etc/passwd and /etc/dovecot/users. If I have a user in /etc/passwd, for example 'joe' and a user in /etc/dovecot/users, joe(a)example.org, and both of these users are in fact the same user but different password. They use the same inbox and the same mail files. Dovecot does not seem to like this very much. I am seeing many errors like this: Error: Mailbox INBOX: Sync failed for mbox: UID inserted in the middle of mailbox (4315358 > 4312144, seq=1, idx_msgs=3212) I think I'm causing this by having 2 users that are in fact the same user and dovecot is stepping on itself. Is it possible to tell Dovecot that these 2 users are in fact the same, as in like an alias user? Or is it possible to tell dovecot not to process mail for say for 'joe' the system user? Michael Grant

3 5

RE: How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 25 Nov '23

25 Nov '23

> Why would you want to do that? Afaik sdbox stores email per file. There is also an index file which stores meta attributes per mail/file and I want them to be consistent. > The mta just delivers the email later and your backup is already old. That's not really am argument. Just imagine the mail would have been sent some moment later after the backup has been started. In that case the mail wouldn't be in the backup either. A backup on a regular schedule for catastrophe recovery always has the "issue" that it will be old by half the time of the schedule on average in case one really needs it. Regarding snapshots on ZFS an similar file system: Not an option as I am using a shared hoster and the file system does not allow snapshots. Am 22. November 2023 21:46:19 schrieb Marc <Marc(a)f1-outsourcing.eu>: > Why would you want to do that? Afaik sdbox stores email per file. The mta > just delivers the email later and your backup is already old. Are you > making a snapshot and backup that, that is a very short time window. > >> >> I am using Dovecot sdbox format for mailboxes. Is there an option to >> temporarily make Dovecot read-only while the mailboxes are being backed-up >> such that a consistent state is backed-up? >> >> I am looking for some command which I can use as pre- and post-hook for >> Borgbackup. I am looking for a way such that Dovecot defers any mail coming >> in via LMTP from Postfix, denies modifying mails/mailboxes via IMAP while >> Dovecot still allows to browse mails read-only.

2 1

How to temporarily make all mailboxes read-only for backup purposes?
by Matthias Nagel 24 Nov '23

24 Nov '23

Dear all, I am using Dovecot sdbox format for mailboxes. Is there an option to temporarily make Dovecot read-only while the mailboxes are being backed-up such that a consistent state is backed-up? I am looking for some command which I can use as pre- and post-hook for Borgbackup. I am looking for a way such that Dovecot defers any mail coming in via LMTP from Postfix, denies modifying mails/mailboxes via IMAP while Dovecot still allows to browse mails read-only. Is that possible? Bests, Matthias

2 1

Ouath2 compatible mail clients
by Francis Augusto Medeiros-Logeay 23 Nov '23

23 Nov '23

Hi, Are there any oauth2 compatible mail clients out there? For Mac/iOS? I see that Mail for Mac supports it, but just for Exchange. __ Francis Augusto Medeiros-Logeay Oslo, Norway Sent from a mobile device / Enviado a partir de dispositivo móvel Hi, Are there any oauth2 compatible mail clients out there? For Mac/iOS? I see that Mail for Mac supports it, but just for Exchange. __ Francis Augusto Medeiros-Logeay Oslo, Norway Sent from a mobile device / Enviado a partir de dispositivo móvel

1 0

[CFP] "Modern Email" Developer Room at FOSDEM '24
by Joris Baum 23 Nov '23

23 Nov '23

Hi, There will be a developer room that I think will be of particular interest for subscribers of this mailing list for "Modern Email" during FOSDEM '24. It will center around the current state of email, free/open source software projects related to email and current developments. FOSDEM is and event for free software and open source developers. The event encompasses two main streams: talks curated by organizers covering diverse topics and the developer rooms. Spread across multiple buildings at the venue, the developer rooms are focusing on specific concepts, technologies, and ideas. This is where the fun is. And most of the fun will obviously happen in the "Modern Email" room. The submission deadline for proposals is 1st December 2023. You can find more info on GitHub: https://github.com/modern-email/FOSDEM-24 . Regards, Joris Baum -- Joris Baum Tel: +49 721 170293 16 Fax: +49 721 170293 179 http://www.audriga.com | http://www.twitter.com/audriga -------------------------------------------------------------------------- audriga GmbH | Alter Schlachthof 57 | 76137 Karlsruhe Sitz der Gesellschaft: Karlsruhe - Amtsgericht Mannheim - HRB 713034 Geschäftsführer: Dr. Frank Dengler, Dr. Hans-Jörg Happel --------------------------------------------------------------------------

2 2

Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Michael Peddemors 21 Nov '23

21 Nov '23

There is a network claiming to be a security company, however the activity appears to be a little more malicious, and appears to be attempting buffer overflows against POP-SSL services.. (and other attacks). https://www.abuseipdb.com/check/104.156.155.21 Just thought it would be worth mentioning, you might want to keep an eye out for traffic from this company... Might want to make up your own mind, or maybe someone has more information, but enough of a red flag, that thought it warranted posting on the list. Not sure yet if it is Dovecot, or the SSL libraries they are attempting to break, but using a variety of SSL/TLS methods and connections... Anyone with more information? NetRange: 104.156.155.0 - 104.156.155.255 CIDR: 104.156.155.0/24 NetName: ACDRESEARCH NetHandle: NET-104-156-155-0-1 Parent: NET104 (NET-104-0-0-0-0) NetType: Direct Allocation OriginAS: Organization: Academy of Internet Research Limited Liability Company (AIRLL) RegDate: 2022-01-07 Updated: 2022-01-07 Ref: https://rdap.arin.net/registry/ip/104.156.155.0 OrgName: Academy of Internet Research Limited Liability Company OrgId: AIRLL Address: #A1- 5436 Address: 1110 Nuuanu Ave City: Honolulu StateProv: HI PostalCode: 96817 Country: US RegDate: 2021-10-15 Updated: 2022-11-06 Ref: https://rdap.arin.net/registry/entity/AIRLL -- "Catch the Magic of Linux..." ------------------------------------------------------------------------ Michael Peddemors, President/CEO LinuxMagic Inc. Visit us at http://www.linuxmagic.com @linuxmagic A Wizard IT Company - For More Info http://www.wizard.ca "LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd. ------------------------------------------------------------------------ 604-682-0300 Beautiful British Columbia, Canada This email and any electronic data contained are confidential and intended solely for the use of the individual or entity to which they are addressed. Please note that any views or opinions presented in this email are solely those of the author and are not intended to represent those of the company.

11 15

dovecot and oauth2 (with keycloak) not working
by Francis Augusto Medeiros-Logeay 20 Nov '23

20 Nov '23

Hi, I successfully configured Roundcube to use keycloak for oauth2. However, I am having trouble to make it work with dovecot. My configuration is this: cat dovecot-oauth2.conf.ext tokeninfo_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/userinfo introspection_url = https://auth.mydomain.com/realms/myrealm/protocol/openid-connect/token/intr… introspection_mode = post username_attribute = postfixMailAddress debug = yes scope = openid Roundcube_email This is what I am getting from the logs: Nov 20 08:20:30 auth: Error: ldap(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): ldap_bind() failed: Constraint violation Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Host session created Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: IPs have expired; need to refresh DNS lookup Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: Performing asynchronous DNS lookup Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Submitted (requests left=1) Nov 20 08:20:30 auth: Debug: http-client: host auth.mydomain.com: DNS lookup successful; got 1 IPs Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443 (shared): Peer created Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Peer pool created Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Peer created Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Setting up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) (1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Linked queue https://auth.mydomain.com:443 (1 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Started new connection to 10.10.100.10:443 (SSL=auth.mydomain.com) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Making new connection 1 of 1 (0 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connecting Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Waiting for connect (fd=23) to finish for max 0 msecs Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: HTTPS connection created (1 parallel connections exist) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Client connection failed (fd=23) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Connection failed (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client: peer 10.10.100.10:443: Failed to make connection (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Failed to establish any connection within our peer pool: connect(10.10.100.10:443) failed: Connection refused (1 connections exist, 0 pending) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up connection to 10.10.100.10:443 (SSL=auth.mydomain.com) connect(10.10.100.10:443) failed: Connection refused (1 peers pending, 1 requests pending) Nov 20 08:20:30 auth: Debug: http-client[1]: peer 10.10.100.10:443: Unlinked queue https://auth.mydomain.com:443 (0 queues linked) Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Failed to set up any connection; failing all queued requests Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Error: 9003 connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: queue https://auth.mydomain.com:443: Dropping request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Nov 20 08:20:30 auth: Error: oauth2(francis(a)mydomain.com,10.10.40.30,<yskzUpAKb9EKCige>): oauth2 failed: connect(10.10.100.10:443) failed: Connection refused Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Destroy (requests left=1) Nov 20 08:20:30 auth: Debug: http-client[1]: request [Req1: GET https://auth.mydomain.com/realms/med-lo/protocol/openid-connect/userinfoeyJ…] Free (requests left=0) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection close Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection disconnect Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Disconnected: connect() failed: Connection refused (fd=23) Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Detached peer Nov 20 08:20:30 auth: Debug: http-client: conn 10.10.100.10:443 [1]: Connection destroy Nov 20 08:20:32 imap-login: Info: Disconnected (auth service reported temporary failure): user=<francis(a)mydomain.com>, method=XOAUTH2, rip=10.10.40.30, lip=172.18.0.10, TLS, session=<yskzUpAKb9EKCige> My dovecot version is 2.3.7.2 (3c910f64b). I find it odd that it is sending the token as a parameter, when I chose “post” as the introspection mode. But I don’t know if that is the problem. best, Francis

3 6

Avoiding POODLE vulnerability
by Steve Litt 20 Nov '23

20 Nov '23

Hi all, Ten years after the fact I learned about POODLE (Padding Oracle On Downgraded Legacy Encryption) vulnerabilities, which enable a poorly configured server to force my client to downgrade to vulnerable encryption. My current conf.d/10-ssl.conf contains the following line: ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL I've read that I should change the preceding line to the following: ssl_protocols = !SSLv3 !SSLv2 Is this correct? For some reason I have the same ssl_cipher_list in dovecot.conf. Should I make the change there too? Is there anything else I need to change? The following is my current dovecot.conf: ================================================= # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # OS: Linux 5.10.12_1 x86_64 # Hostname: mydesk.domain.cxm mail_location = maildir:~/mail/Maildir:INBOX=~/mail/Maildir/.INBOX namespace inbox { inbox = yes location = prefix = } passdb { driver = pam args = %s } userdb { driver = passwd } protocols = imap service imap-login { inet_listener imap { #port = 143 port = 0 } inet_listener imaps { port = 993 #port = 0 ssl = yes #ssl = no } } ssl = required #ssl = yes ssl_cert = </etc/ssl/dovecot_certs/certs/dovecot.pem ssl_cipher_list = ALL:!LOW:!SSLv3:!EXP:!aNULL ssl_key = </etc/ssl/dovecot_certs/private/dovecot.pem ================================================= By the way, does the preceding dovecot.conf even use the files in directories off conf.d ? Thanks, SteveT Steve Litt Autumn 2023 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

3 8

passdb doesn't support credential lookups
by Michael Grant 20 Nov '23

20 Nov '23

I'm having trouble authenticating certain users. I see this in the logs: Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Performing passdb lookup Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): passdb doesn't support credential lookups Nov 19 16:26:40 auth: Debug: pam(jane,192.168.2.83,<...>): Finished passdb lookup at the command line, if I run this: % doveadm auth login jane Password: passdb: jane auth succeeded Oddly, I have a handfull of users that are failing and others that are not and I don't see the difference.

1 0

Re: DMARC Failures for Mailing List
by dovecot＠x9p.org 18 Nov '23

18 Nov '23

On 11/17/23 10:38, Nick Lockheart wrote: > The DKIM check is also failing. I think the list software may be re-writing the > message bodies. I believe one of the reasons for the DKIM failure is this addition/configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list --dovecot(a)dovecot.org To unsubscribe send an email todovecot-leave(a)dovecot.org >>>>>>>> --x9p On 11/17/23 10:38, Nick Lockheart wrote: The DKIM check is also failing. I think the list software may be re- writing the message bodies. I believe one of the reasons for the DKIM failure is this addition/ configuration by mailman in the footer of every message (the unsubscribe stuff): >>>>>>>> _______________________________________________ dovecot mailing list -- dovecot(a)dovecot.org To unsubscribe send an email to dovecot-leave(a)dovecot.org >>>>>>>> --x9p

1 0

DMARC Failures for Mailing List
by Nick Lockheart 18 Nov '23

18 Nov '23

Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re- writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message. Now that we've got our new mail server going and the DMARC reports are coming in, I'm finding a lot of DMARC failures for messages that I'm sending to this list. It seems that when I send a message to this list, the list software forwards it to other people on my behalf, but uses my email address in the header_from. This results in an SPF failure, because SPF only allows our MX to send mail for our domain. The DKIM check is also failing. I think the list software may be re-writing the message bodies. Another user that I replied to on this list a day ago said my list mail went to spam on his gmail. 1. Will our domain reputation be harmed by having a lot of copies of the same messages going to a bunch of different people on different ISPs and all of them failing DMARC? It seems that some places are using databases that look for duplicate content sent to multiple recipients to identify bulk mail and spam. 2. Is there any way to mitigate DMARC issues for mailing lists? It seems like the mailing list software should be sending out the emails as itself, not as the user that submitted the message.

4 3

how to filter in doevecot/lmtp with sieve according to postfix orig_to value
by TSHIMANGA Minkoka 17 Nov '23

17 Nov '23

Dear All, I am managing an email infrastructure running with the below. Rocky Linux 8.7 (Green Obsidian) 4.18.0-425.3.1.el8.x86_64 postfix-3.5.8-4.el8.x86_64 dovecot-2.3.16-3.el8.x86_64 dovecot-pigeonhole-2.3.16-3.el8.x86_64 In reality there are more packages installed and configured. But I limited my enumeration above to what I think is relevant. I will be happy to provide more details if needed and/or requested. Here is my problem, or at least on what I need help/guidance/assistance. I have a virtual alias that forward emails to support(a)example.com to my inbox tshimanga.minkoka(a)example.com. That works fine as I can see those emails in my INBOX. And I want those emails to be moved in INBOX/support with a local sieve rule. For that I have the below that works. # rule:[support] if allof (header :is "to" "support(a)example.com") { fileinto :create "INBOX/support"; } The problem is that the above sieve rule seems not enough to catch email where support(a)example.com is not the "To" fields, as with cases of "Cc:" or "Bcc:". In the log of postfix, I can see lines with "... postfix/lmtp ... orig_to=<support(a)example.com> ...". The problem I am facing is that "orig_to" is not part of the headers postfix/lmtp (in reality dovecot/lmtp process) can see in order to apply on it a sieve rule. Any suggestions on how I can also sieve filter those emails ? Regards, Tshimanga

2 2

auth service over tls
by ibra 17 Nov '23

17 Nov '23

Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing? Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/10-myconfig.conf": service auth { inet_listener { name = dovecot_auth address = 127.0.0.1 port = 12345 ssl = yes } user = mail # I've also tried with different users and without set it as well. } service lmtp { inet_listener { name = dovecot_lmtp address = 127.0.0.1 port = 24 ssl = yes } } Is something else I'm missing?

4 5

Re: Anyone Watching Actvity from this network? Attempting Dovecot Buffer Overflows?
by Joseph Tam 16 Nov '23

16 Nov '23

On Wed, 15 Nov 2023, 23:25 Michael Peddemors, <michael(a)linuxmagic.com> wrote: > Not sure yet if it is Dovecot, or the SSL libraries they are > attempting > to break, but using a variety of SSL/TLS methods and connections... > > They are not interested in dovecot per se. They scan for TLS vulnerabilities, > mostly. They're running comprehensive port scans, so they're targeting more than just SSL services. > OrgName: Academy of Internet Research Limited Liability > Company > OrgId: AIRLL > Address: #A1- 5436 > Address: 1110 Nuuanu Ave > City: Honolulu > StateProv: HI > PostalCode: 96817 > Country: US Out of business virtual offices, naturally. AIRLL also operating out of 195.96.137.0/24. Joseph Tam <jtam.home(a)gmail.com>

3 2

Re: auth service over tls
by ibra 16 Nov '23

16 Nov '23

I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: > > Are Postfix and Dovecot running on the same server? If so, you might be > better served by connecting with a UNIX socket rather than TCP. > > I'm not sure there is much security benefit to using TLS on the loopback > interface which is what was in your example from the previous email. > > And to clarify, Postfix supports TLS for authentication between an email > program like Thunderbird and the Postfix server, but does not support TLS > for the SASL AUTH *service* connection from Postfix to the AUTH provider > (Dovecot or Cyrus-SASL). > > Also, please use the group reply function so your email goes to the list, > this email only went to me. > > > On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: > > Good Morning, > thank you for your fast response, and sorry to not answer before, I forgot > to check spam folder. Good to know that postfix does not support SASL AUTH > over TLS, because actually I was planning to use it. > I started with Dovecot to check if auth port support tls. For that I > launched tls handshake using openssl, like this command: > $ openssl s_client -servername mail.sample.com -connect localhost:12345 > > But I got an error. (In summary Dovecot ends the connection). > Anyway, it would be awesome that in the future both Postfix and Dovecot > could support it. > > > On LMTP port, tls handshake worked in Dovecot side, now I have to > configure Postfix to make the request to dovecot LMTP over tls. > > With Postfix I was able to send data to Dovecot LMTP port, but was not > over TLS. Do you know what settings should I enable in Postfix side? > > Regards > Ibra. > > > On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> > wrote: > > On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: > > Hi, > I'm trying running tls connections for both auth and lmtp services. For > lmtp it is ok, for auth service I couldnt make it. I configure dovecot with > the next configuration in file "conf.d/10-myconfig.conf": > > > Which MTA are you trying to connect from? Postfix does not support SASL > AUTH over TLS, for example. > > > I was testing a bit this setup of putting them in different servers, since these options are implemented. What I was not sure was if they support TLS as well. So Postfix-Dovecot SASL AUTH is not supported. Is TLS LMTP supported between Postfix and Dovecot? I see that Dovecot LMTP supports a TLS connection, but not sure if Postfix can make the TLS initial request. I just could exchange data over LMTP in plain (no TLS) between Postfix and Dovecot. Regards, Ibra On Thu, 16 Nov 2023 at 12:28, Nick Lockheart <forum(a)ageofdream.com> wrote: Are Postfix and Dovecot running on the same server? If so, you might be better served by connecting with a UNIX socket rather than TCP. I'm not sure there is much security benefit to using TLS on the loopback interface which is what was in your example from the previous email. And to clarify, Postfix supports TLS for authentication between an email program like Thunderbird and the Postfix server, but does not support TLS for the SASL AUTH *service* connection from Postfix to the AUTH provider (Dovecot or Cyrus-SASL). Also, please use the group reply function so your email goes to the list, this email only went to me. On Thu, 2023-11-16 at 09:38 +0000, ibra wrote: Good Morning, thank you for your fast response, and sorry to not answer before, I forgot to check spam folder. Good to know that postfix does not support SASL AUTH over TLS, because actually I was planning to use it. I started with Dovecot to check if auth port support tls. For that I launched tls handshake using openssl, like this command: $ openssl s_client -servername mail.sample.com -connect localhost:12345 But I got an error. (In summary Dovecot ends the connection). Anyway, it would be awesome that in the future both Postfix and Dovecot could support it. On LMTP port, tls handshake worked in Dovecot side, now I have to configure Postfix to make the request to dovecot LMTP over tls. With Postfix I was able to send data to Dovecot LMTP port, but was not over TLS. Do you know what settings should I enable in Postfix side? Regards Ibra. On Wed, 15 Nov 2023 at 11:08, Nick Lockheart <nlockheart(a)ageofdream.com> wrote: On Wed, 2023-11-15 at 10:00 +0000, ibra wrote: Hi, I'm trying running tls connections for both auth and lmtp services. For lmtp it is ok, for auth service I couldnt make it. I configure dovecot with the next configuration in file "conf.d/ 10-myconfig.conf": Which MTA are you trying to connect from? Postfix does not support SASL AUTH over TLS, for example.

1 0

Fwd: dovecot submission max line length
by Kees van Vloten 14 Nov '23

14 Nov '23

Op 14-11-2023 om 14:35 schreef Aki Tuomi: >> On 14/11/2023 14:59 EET Kees van Vloten <keesvanvloten(a)gmail.com> wrote: >> >> Hi all, >> >> >> After upgrading Debian Bullseye (Dovecot 2.3.13) to Bookworm (Dovcecot >> 2.3.19), submission-login returns an error on Kerberos authentication: >> "Client sent invalid command: Command line is too long". >> >> When I initially set this up on Bullseye I have seen the same issue, but >> adding "imap_max_line_length = 2M" solved it. >> >> Now with 2.3.19 kerberos authentication still works (with this setting) >> for imap connections but it stopped working for submission. >> >> Is there a new config setting for submission-login that I missed? Or is >> this a bug in 2.3.19? >> >> >> - Kees. >> >> > You are probably running into a client-side issue. SMTP RFC says that > all commands, including sasl ir, must be at most 998 bytes. Can you > check if the client is sending AUTH KERBEROS which is longer than 998 > lines? > > After AUTH KERBEROS you can send longer lines. The client has not changed. I have just upgraded the server from Bullseye to Bookworm, without configuration changes to Dovecot. The only change is version 2.3.13 to 2.3.19, that is why my first suspicion is that something changed in dovecot submission-login. The client is Thunderbird 102 and that has not changed for a long time (a year or so). Is there a way to create debug logs that show the client communication to submission-login? I had enabled "auth_debug" and "auth_verbose" in Dovecot but that seems to log the server side communication only (see below). And even with that information, would it be possible to convince Thunderbird to send 'AUTH KERBEROS' if it does not do that already? I logging I have is this: Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sent: 220 mailserver.example.com Dovecot ready. Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Received new command: EHLO [192.168.1.106] Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: New command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Execute command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Pipeline blocked Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Submitted Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Replied Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Ready to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Completed Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Pipeline unblocked Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Connection state reset Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Sent: 250-mailserver.example.com 8BITMIME AUTH GSSAPI GSS-SPNEGO PLAIN BURL imap CHUNKING ENHANCEDSTATUSCODES SIZE PIPELINING Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Finished Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command EHLO: 250 reply: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Client sent invalid command: Command line is too long Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Invalid command Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Submitted Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Replied Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Ready to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Next to reply Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Completed Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Sent: 500 5.5.2 Line too long Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Finished Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: command [unknown]: 500 reply: Destroy Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Trigger output Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Sending replies Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: No more commands pending Nov 14 13:44:37 mailserver dovecot: submission-login: Debug: smtp-server: Remote closed connection: Connection closed Do note that I redacted a column with the server ipaddress to make the lines a bit shorter and more readable. - Kees > > Aki

1 0

MySQL connection keepalive for pass/auth db
by dvuoud＠at.encryp.ch 14 Nov '23

14 Nov '23

Hello, Is it possible to configure SQL connection keepalive for Dovecot? Probably what I have to do is "Note that the SQL backend must be used via Proxy", however I was unsucsessful in figuring out how can I setup this to get use of connection pool at Dovecot. Thanks. > $ dovecot --version > 2.3.20 (80a5ac675d) > $ dovecot -n > # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.20 (149edcf2) > # OS: Linux 6.1.57 x86_64 Gentoo Base System release 2.14 > # Hostname: flopster > import_environment = TZ CORE_OUTOFMEM CORE_ERROR TZ=:/etc/localtime > lmtp_add_received_header = no > mail_gid = vmail > mail_location = maildir:~/.maildir > mail_server_admin = mailto:me@at.encryp.ch > mail_uid = vmail > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader > metric auth_failures { > filter = event=auth_request_finished AND NOT success=yes > } > metric auth_success { > filter = event=auth_request_finished AND success=yes > } > metric imap_command { > filter = event=imap_command_finished > group_by = cmd_name tagged_reply_state > } > metric mail_delivery { > filter = event=mail_delivery_finished > group_by = duration:exponential:1:5:10 > } > metric smtp_command { > filter = event=smtp_server_command_finished > group_by = cmd_name status_code duration:exponential:1:5:10 > } > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = * > driver = pam > } > passdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > sieve_extensions = +editheader > } > protocols = imap lmtp sieve > service auth { > unix_listener /var/spool/postfix/private/auth { > group = postfix > mode = 0660 > user = postfix > } > vsz_limit = 2 G > } > service dict { > unix_listener dict-passdb { > mode = 0600 > user = vmail > } > unix_listener dict-userdb { > mode = 0600 > user = vmail > } > } > service lmtp { > unix_listener /var/spool/postfix/private/dovecot-lmtp { > group = postfix > mode = 0600 > user = postfix > } > } > service managesieve-login { > inet_listener sieve { > port = 4190 > } > } > service stats { > inet_listener http { > address = [::] > port = 9900 > } > } > ssl = required > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_dh = # hidden, use -P to show it > ssl_key = # hidden, use -P to show it > userdb { > driver = passwd > } > userdb { > args = /etc/dovecot/dovecot-sql.conf.ext > driver = sql > } > protocol lmtp { > mail_plugins = " sieve" > postmaster_address = postmaster(a)at.encryp.ch > } > protocol lda { > mail_plugins = sieve > } > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = # hidden, use -P to show it > }

1 0

ldap passdb, userdb imap auth sasl and lmtp
by bd730c5053df9efb 14 Nov '23

14 Nov '23

Hi! I'm trying to setup dovecot 2.3.17 such that it authenticates users against a samba4 ad dc when they connect through imap. I would also need dovecot to authenticate the same users through sasl so that postfix can relay mails based on the user's auth and finally I would also need for an lmtp service that maps email addresses into AD users. I've been tinkering with dovecot-ldap.conf.ext using auth_bind = yes and no, with all sorts of pass_filters, user_filter, pass_attr and user_attr and I just can't figure out how it works. I assume that for the auth part (both imap and sasl) I would rather benefit with using auth_bind = yes and auth_bind_userdn = %u and I seem to be able to authenticate the user but I can't get the passdb to prefetch the userdb attributes. I also assume that for lmtp to be able to fetch the ad information it would be necessary for dovecot to be able to bind to the ad ldap server with a "service account" to be able to query the ldap server and I haven't been able to figure out how to have both kinds of auth schemas. Does anyone know of some documentation that could clarify some of this issues, I have been searching the web for days to no avail. I'm sorry I can't show what I have tried for I have tried so many things with more or less the same lack of success that I wouldn't know where to start. Thanks in advance. Best regards, Dave.

2 1

More information on dict proxy
by Steve 09 Nov '23

09 Nov '23

Hello, I'm working on an implementation of a dict server. I've looked through all your documentation but can't seem to find how I can create the proper URI to direct the quota plugin to use a TCP socket instead of a UNIX socket. I'd appreciate any insight you can provide. Steve

2 1

file dotlock create
by The Doctor 07 Nov '23

07 Nov '23

I am seeing errors in our log as follows Nov 07 14:20:06 POP3(user937):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user937) failed: Permission denied (euid=937(user937) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) Nov 07 14:21:03 IMAP(user3094):Error: Mailbox INBOX: file_dotlock_create(/var/mail/user3094) failed: Permission denied (euid=3094(user3094) egid=100(user) missing +w perm: /var/mail, we're not in group 6(mail), dir owned by 0:6 mode=0775) (set mail_privileged_group=mail) /var/mail is set to 1775 Running FreeBSD 14.0-RC4 -- Member - Liberal International This is doctor(a)nk.ca Ici doctor(a)nk.ca Yahweh, King & country!Never Satan President Republic!Beware AntiChrist rising! Look at Psalms 14 and 53 on Atheism ; unsubscribe from Google Groups to be seen Suffering will continue until we stop believing lies. -unknown Beware https://mindspring.com

1 0

mail boxes on net mounted filesystem with multiple Dovecots
by lejeczek 07 Nov '23

07 Nov '23

Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount-point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L. Hi guys. I see that with mailboxes stored on a network mount-point and more than one box with Dovecot using such a mailbox, Dovecots step on each others toes. ... lmtp(minemail(a)lemko.xyz)<2674357><uATxGqbaSGW1zigAn4O9eQ>: Error: lmtp-server: conn unix:pid=2600068,uid=89 [2]: rcpt minemail(a)my.private: Mailbox INBOX: Corrupted transaction log file /VMAIL/my.private/minemail/dovecot.index.log seq 4: ext intro: name_size too large (sync_offset=6368) ... Above happened if the same one user was having mail delivered on two Postfix+Dovecot servers at the same time. I hope experts who know Dovecot's internals better can tell... having such multiple node/server Dovecots "talking" to that same network mount- point but!.. only one Dovecot being active - having Postfix using it and other, however many, Dovecots only "idling" - not having Postifx using it (+ no client connections is a goal too) Would that make such multi-Dovecot setup safe & free from errors as above & any storage related ones? Or perhaps there are other ways to have many Dovecots with the same user-base, using same networked storage simultaneously? many thanks, L.

4 3

Can Dovecot Use Wildcard TLS Certificates?
by duluxoz 07 Nov '23

07 Nov '23

Hi All, Quick Q: Can dovecot use wildcard TLS Certificates? I'm having issues with a new dovecot/postfix stack set-up and I can't get mutt on the local box to connect via imap - its coming back with an SSL error, and as I'm using a wildcard cert for the domain I was wondering if that was my issue. If dovecot can use wildcard certs then I'll look elsewhere in my troubleshooting. Thanks in advance Cheers Dulux-Oz

8 7

Minimum configuration for Dovecot SASL only?
by Nick Lockheart 06 Nov '23

06 Nov '23

I have a Dovecot IMAP server and a Postfix server on separate machines. The user information is stored in a MariaDB database that is replicated on both servers. Postfix needs to authenticate outgoing mail against our valid user database. I believe this requires us to install a "dummy" Dovecot on the Postfix server so that Dovecot SASL can provide authentication to Postfix from the database. I think Cyrus had a standalone Cyrus-SASL package, but Dovecot doesn't? If I wanted to setup a Dovecot instance on the Postfix server just for the purposes of SMTP authentication, and not use it to handle any mail, what is the minimum configuration required to make that work? Is the dovecot-common package (Debian) enough? Or do I need the full dovecot-imap package? What protocols go in the protocols directive? Can you just make it "protocols = auth" to disable IMAP connections?

5 9