- dovecot - dovecot.org

[feature request] SSL handshake rejection for non-SNI clients
by Serg 16 May '23

16 May '23

I would like to offer to implement a feature to reject SSL handshakes for a default certificate-key pair for efficiently discarding bot requests (i.e. such requests that provide invalid/not configured hostname or do not specify at all, like when doing request to the IP address directly). Nginx has such feature already implemented as seen here[1], and it would be beneficial if dovecot would support this too. Currently I am using the following SSL configuration snippet to mimic such behavior: > ssl_cert = </etc/ssl/dovecot/server.crt > ssl_key = </etc/ssl/dovecot/server.key > > local_name flopster.at.encryp.ch { > ssl_cert = </etc/ssl/domains/flopster.at.encryp.ch/fullchain > ssl_key = </etc/ssl/domains/flopster.at.encryp.ch/key > } But in this case the problem is that the invalid requests (for this example it is requests that don't have Server Name Indication at all or mention anything else but not flopster.at.encryp.ch) are still being replied by Dovecot with a TLS certificate rather than being simply rejected with a TLSV1_UNRECOGNIZED_NAME error code. [1]: <https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_reject_handshake>

3 3

Re: [External] Re: Help - Permissions issue with new mail
by Mihai Badici 16 May '23

16 May '23

Sorry, I sent the reply directly to you not to the list. I try to find which is the uid expected by dovecot. Usually since in postfix the uid is set as 5000 you need to have the same "virtual" uid set in dovecot. I didn't see this in the fail you sent. Maybe you made some change in the past without restarting dovecot. Anyway i think a line like mail_uid=5000 somewhere in dovecot configuration ( location may differ )should fix your issue. Try to find if this is already set and if not add this in dovecot and restart it. On 2023-05-04 15:16, Michele Clark wrote: > Attached is a copy of my main.cf from postfix and my 10-mail from > dovecot > > Let me know if you see anything that I might try - Thanks in advance > > Michele Clark > Title | Engineering Business Unit > KBR | Government Solutions – US > Office: +1 937-713-8669 > > ------------------------- > > From: Mihai Badici <mihai(a)badici.ro> > Sent: Wednesday, May 3, 2023 3:44 PM > To: Michele Clark <Michele.Clark(a)us.kbr.com> > Subject: Re: [External] Re: Help - Permissions issue with new mail > > You don't often get email from mihai(a)badici.ro. Learn why this is > important [1] > > CAUTION: This email originated from outside of the organization. Do > Re: [External] Re: Help - Permissions issue with new mail Contact photo From Michele Clark on 2023-05-04 15:16 Details Headers Plain text Download all attachmentsSave all to cloud... 10-mail.conf.jpg.docx(~761 KB) MAIN.CF.JPG(~161 KB) Attached is a copy of my main.cf from postfix and my 10-mail from dovecot Let me know if you see anything that I might try - Thanks in advance Michele Clark Title | Engineering Business Unit KBR | Government Solutions – US Office: +1 937-713-8669 From: Mihai Badici <mihai(a)badici.ro> Sent: Wednesday, May 3, 2023 3:44 PM To: Michele Clark <Michele.Clark(a)us.kbr.com> Subject: Re: [External] Re: Help - Permissions issue with new mail You don't often get email from mihai(a)badici.ro. Learn why this is important CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe. I think the problem isn't the rights of the files but dovecot need to use the same user for read them. I have something like: mail_uid = 5000 in 10-mail.conf, this uid need to be the same as in postfix On 5/3/23 21:42, Michele Clark via dovecot wrote: > 1: This was previously working but has been down since there was an > unexpected power outage. This install has been in place for several > years > 2: When I chmod -r the CUR folder I can get mail to drop to our > roundcube inbox or if I chmod the actual email file in the cur folder > (have tried > not click links or open attachments unless you recognize the sender > and know the content is safe. > > I think the problem isn't the rights of the files but dovecot need to > use the same user for read them. > > I have something like: mail_uid = 5000 in 10-mail.conf, this uid need > to be the same as in postfix > > On 5/3/23 21:42, Michele Clark via dovecot wrote: > >> 1: This was previously working but has been down since there was an >> unexpected power outage. This install has been in place for several >> years >> 2: When I chmod -r the CUR folder I can get mail to drop to our >> roundcube inbox or if I chmod the actual email file in the cur >> folder (have tried both) however new messages still come thru with >> -rw------- >> 3. Attached is a copy of the return from comm -23 <(postconf -n) >> <(postconf -d) with the exception of a few redactions for our >> personal data >> 4. What info would you like to see from dovecot? >> >> Any help is much app >> >> Michele Clark >> Title | Engineering Business Unit >> KBR | Government Solutions – US >> Office: +1 937-713-8669 >> >> ------------------------- >> >> From: John Stoffel <john(a)stoffel.org> >> Sent: Wednesday, May 3, 2023 2:14 PM >> To: Michele Clark <michele.clark(a)us.kbr.com> >> Cc: dovecot(a)dovecot.org <dovecot(a)dovecot.org> >> Subject: [External] Re: Help - Permissions issue with new mail >> >> [You don't often get email from john(a)stoffel.org. Learn why this is >> important at https://aka.ms/LearnAboutSenderIdentification [1] ] >> >> CAUTION: This email originated from outside of the organization. Do >> not click links or open attachments unless you recognize the sender >> and know the content is safe. >> >>>>>>> "michele" == michele clark--- via dovecot >> <dovecot(a)dovecot.org> writes: >> >>> We have an install of Dovecot running with Postfix and Roundcube >>> using virtual mail to allow us to connect to our AD domain which >> got >>> messed up after a power issue. >> >> Was this working before the AD problems, or is this a new install? >> >>> I can log into our Roundcube and see all my old emails, however >> new >>> emails keep getting stuck in the CUR files with permissions of >>> -rw------- >> >>> If I chmod the email it will deliver to the inbox in Roundcube. >> >> Where are you changing the permissions? The destination directory? >> >>> Can anyone advise on how I can adjust this so all new emails will >>> come thru with the correct permissions? - Thanks in advance >> >> It all depends on how your email are delivered, and you need to post >> some of your configuration details, such as the postfix config and >> the >> dovecot config. >> >> For postfix, just post the changed from defaults info, which you can >> get with the following bash sheel command: >> >> comm -23 <(postconf -n) <(postconf -d) >> >> See the postconf man page for details. >> >> Also post your dovecot info as well. >> >> This e-mail, including any attached files, may contain confidential >> information, privileged information and/or trade secrets for the >> sole use of the intended recipient. Any review, use, distribution, >> or disclosure by others is strictly prohibited. If you are not the >> intended recipient (or authorized to receive information for the >> intended recipient), please contact the sender by reply e-mail and >> delete all copies of this message. >> >> _______________________________________________ >> dovecot mailing list -- dovecot(a)dovecot.org >> To unsubscribe send an email to dovecot-leave(a)dovecot.org > This e-mail, including any attached files, may contain confidential > information, privileged information and/or trade secrets for the sole > use of the intended recipient. Any review, use, distribution, or > disclosure by others is strictly prohibited. If you are not the > intended recipient (or authorized to receive information for the > intended recipient), please contact the sender by reply e-mail and > delete all copies of this message. > > Links: > ------ > [1] https://aka.ms/LearnAboutSenderIdentification

4 9

replicator service
by Przemysław Kwiatkowski 15 May '23

15 May '23

I'm confused. Replicator service is bidirectional. Does it mean I should start it only on *one* end of a replication pair? Or on both, working simultaneously? -- MiCHA

2 1

acl replication
by micha＠micha.waw.pl 14 May '23

14 May '23

What is correct way to sync ACLs across two servers? Example: I want user1 to have access to user2 mailbox. I do this on server1: doveadm acl set shared/user2 user=user1 admin create delete expunge insert lookup read write write-deleted write-see Now user1 can see shared/user2 when logged to server1. (Looks good!) He still has no access when logged to server2. (Seems correct.) So I do synchronization: doveadm sync -u user2 remote:server2 ...and nothing changes. He still have access only when logged to server1. So I force full synchronization: doveadm sync -u -f user2 remote:server2 ...and success! User1 has access to shared/user2 on both servers now. But now I want to remove access. So I do this on server1: doveadm acl delete shared/user2 user=user1 Of course the above affects only server1, so user1 still have access when logged to server2. So now I do synchronization: doveadm sync -u user2 remote:server2 Nothing happens. :-( So I try do do full synchro: doveadm sync -u user2 -f remote:server2 ...disaster! The ACL is COPIED BACK from server2 to server1 and effectively restoring access to shared/user2 on on both servers again. (WTH?) So big question is: Who to do it properly? It would be enough for me if ACL's were copied only one way (server1->server2), but bidirectional replication would of course also be nice. :-) Configs: namespace { disabled = no hidden = no ignore_on_failure = no inbox = no list = children location = maildir:%%h/.maildir:LAYOUT=fs:INDEX=~/.shared/%%u order = 0 prefix = shared/%%u/ separator = / subscriptions = no type = shared } plugin { acl = vfile:/etc/dovecot/mailconfig/global-acls acl_defaults_from_inbox = yes acl_shared_dict = file:/etc/dovecot/mailconfig/shared/shared-mailboxes }

3 4

Conclusion about plus address setup
by Tom Reed 14 May '23

14 May '23

Hello Just FYI, After simple putting this line into postfix's main.cf: recipient_delimiter = + And reload postfix, the plus alias address should work. I am using dovecot LMTP as delivery agent. Nothing changes to dovecot configuration. Here are the versions: Postfix 3.6.4 Dovecot 2.3.16 OS Ubuntu 22.04 Thank you very much for all helps. regards Tom

1 0

dovecot for plus address
by Tom Reed 13 May '23

13 May '23

Hello How to setup dovecot to accept the plus address? such as user+foo(a)sample.com will be delivered into user(a)sample.com Thank you. Tom R.

3 4

Sieve with several redirects stops if one redirect fails
by Matteo Staglianò 12 May '23

12 May '23

Hello, I have this block on my sieve filter: |if not header :matches "X-Spam-Status" "Yes*" {|| || redirect "atest(a)non-existent.tld";|| || redirect "info(a)existent.tld";|| ||}|| ||keep;| when the first redirect fails: |sieve: info: started log at May 12 10:33:21.|| ||error: msgid=<20230512103320.070708@candy>: redirect action: failed to redirect message to <atest(a)non-existent.tld>: smtp(host.smtp.tld): RCPT TO failed: 550 5.1.1|| ||<atest(a)non-existent.tld> recipient rejected (permanent failure).| the second one is not even triggered. I would like to know if this is an expected behaviour or a misconfiguration on my side. |dovecot-core 2:2.3.8-4~buster|| ||dovecot-imapd 2:2.3.8-4~buster|| ||dovecot-lmtpd 2:2.3.8-4~buster|| ||dovecot-mysql 2:2.3.8-4~buster|| ||dovecot-pigeonhole-dbg 2:2.3.8-4~buster|| ||dovecot-pop3d 2:2.3.8-4~buster|| ||dovecot-sieve 2:2.3.8-4~buster|| |||| ||sieve = ~/.dovecot.sieve|| ||sieve_extensions = +editheader|| ||sieve_global_extensions = +vnd.dovecot.pipe|| ||sieve_max_redirects = 15|| ||sieve_pipe_bin_dir = /usr/lib/dovecot/|| ||sieve_plugins = sieve_imapsieve sieve_extprograms|| ||sieve_vacation_default_period = 1h|| ||mail_plugins = notify mail_log quota imap_quota imap_sieve|| ||mail_plugins = notify mail_log quota sieve|| || | Thank you

1 0

doveadm on remote socket SSL problem
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, trying to exec doveadm commands on remote server: doveadm search -S domain.com:12333 -u user@domaincom mailbox Sent This produces error in remote server log: doveadm(192.168.10.19): Error: SSL handshake failed: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number How to do it right?

1 0

dsync start/end date issue
by miro.igov＠pharmya.com 11 May '23

11 May '23

Hello, i am trying to do a backup with doveadm backup command. I need to set date filter with argument [-e end date]. Doing so with -e 2020-01-01 or -e 1577829600 shows error: dovecot: doveadm: Error: dsync(mail-archive.domain.com): handshake: Invalid sync_until_timestamp: 0 What is the correct way of time filter?

1 0

Best practice for Dovecot with LDAP and Postfix
by Moritz Pflanzer 09 May '23

09 May '23

Hi all, so far I had a setup where Dovecot was using a passwd file as userdb and passdb. Postfix was then authenticating with Dovecot via SASL to validate user accounts. Now I added an LDAP backend and would like to use that for Dovecot and Postfix. My first approach was to change the passdb to use the LDAP driver with the following settings: hosts = openldap:1389 base = ou=users,dc=example,dc=com auth_bind = yes auth_bind_userdn = uid=%n,ou=users,dc=example,dc=com And I changed the userdb driver to static since anyway there is just the vmail system account for all virtual user mailboxes. This is working as expected for the IMAP connections. But postfix authentication fails as it is apparently using a wrong user_filter. This is what I see in the logs from OpenLDAP: docker-openldap-1 | 645908ae.1d975b70 0x7fe379297700 conn=1347 fd=12 ACCEPT from IP=172.19.0.7:52144 (IP=0.0.0.0:1389) docker-openldap-1 | 645908ae.1d98571f 0x7fe379a98700 conn=1347 op=0 BIND dn="" method=128 docker-openldap-1 | 645908ae.1d993bd7 0x7fe379a98700 conn=1347 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000072 text= docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: 8A9FC1E03C5: client=mo4-p01-ob.smtp.rzone.de[85.215.255.51] docker-postfix-1 | May 08 14:35:26 nest postfix/cleanup[12461]: 8A9FC1E03C5: message-id=<713569303.508224.1683556526256(a)webmail.strato.de> docker-postfix-1 | May 08 14:35:26 nest postfix/qmgr[951]: 8A9FC1E03C5: from=<moritz(a)pflanzer.eu>, size=3340, nrcpt=1 (queue active) docker-postfix-1 | May 08 14:35:26 nest postfix/smtpd[12455]: disconnect from mo4-p01-ob.smtp.rzone.de[85.215.255.51] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 docker-openldap-1 | 645908ae.2616b031 0x7fe379297700 conn=1347 op=1 SRCH base="ou=users,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=posixAccount)(uid=moritz(a)example.com))" docker-openldap-1 | 645908ae.26179272 0x7fe379297700 conn=1347 op=1 SRCH attr=uid docker-openldap-1 | 645908ae.2619389b 0x7fe379297700 conn=1347 op=1 SEARCH RESULT tag=101 err=32 qtime=0.000017 etime=0.000221 nentries=0 text= I tried setting the user_filter manually to "user_filter = (mail=%u)" but that doesn't have any effect. Is this the expected behavior from Dovecot? I guess I can get it working by using the ldap driver for the userdb as well. But is that the best approach since I technically don't need it for dovecot itself. Or should I now change the postfix config as well to directly authenticate against the LDAP server instead of using SASL with Dovecot? Looking forward to recommendations, Moritz

7 16

Re: dmarc user can't receive email because of encrypted storage
by Aki Tuomi 09 May '23

09 May '23

> On 04/05/2023 21:08 EEST efeizbudak(a)disroot.org wrote: > > > On 2023-05-04 20:53, Aki Tuomi via dovecot wrote: > >> On 04/05/2023 20:11 EEST efeizbudak--- via dovecot > >> <dovecot(a)dovecot.org> wrote: > >> > >> > >> Hi all, > >> > >> So recently google has been trying to send email to dmarc(a)domain.com > >> on > >> my server but I'm using encrypted storage and since the dmarc user has > >> no password the email is being rejected with the error: > >> > >> May 4 16:51:50 domain dovecot: > >> lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: > >> msgid=<10341808348719730099(a)google.com>: failed to store into mailbox > >> 'INBOX': generate_keypair(INBOX) failed: > >> mail_crypt_require_encrypted_user_key set, cannot generate user > >> keypair > >> without password or key > >> > >> How can I fix this, or at least read what the mail says? Would it be > >> safe to just give dmarc user a strong password? > > > > You can run > > > > doveadm mailbox cryptokey generate -U dmarc -N > > > > so the user will have a keypair generated. Then it should work. > > > > Aki > > I'm getting > > generate: invalid option -- 'N' > > should I just run it without -N ? > > Thank you! Please keep responses on the list. Try -n password? I have a faint recall of a buggy version like this. Aki

2 11

Documentation issue: incorrect link
by Tom Hendrikx 05 May '23

05 May '23

Hello, In the second paragraph at https://doc.dovecot.org/configuration_manual/sieve/extensions/duplicate/, a link is included to RFC7353, but this RFC is not related to sieve at all. I think the correct RFC to link is RFC7352, like in the first paragraph. Kind regards, Tom

1 0

amount of users
by Thomas Schäfer 05 May '23

05 May '23

Hi, is somewhere a table/matrix/function based on experience how many users require which values for mail_max_userip_connections default_client_limit default_process_limit ...? I run into problems with a small group of users, since the defaults seem to be only for single man shows. The second assumption is: User are permanently online (connected to imap) and using two devices in average (one or two desktops, + one mobile device) Regards, Thomas -- There’s no place like ::1 Thomas Schäfer (Systemverwaltung) Ludwig-Maximilians-Universität Centrum für Informations- und Sprachverarbeitung Oettingenstraße 67 Raum C109 80538 München ☎ +49/89/2180-9706 ℻ +49/89/2180-9701

1 0

dmarc user can't receive email because of encrypted storage
by efeizbudak＠disroot.org 04 May '23

04 May '23

Hi all, So recently google has been trying to send email to dmarc(a)domain.com on my server but I'm using encrypted storage and since the dmarc user has no password the email is being rejected with the error: May 4 16:51:50 domain dovecot: lda(dmarc)<3326><l0J9NabiU2T+DAAA1iAyAg>: Error: sieve: msgid=<10341808348719730099(a)google.com>: failed to store into mailbox 'INBOX': generate_keypair(INBOX) failed: mail_crypt_require_encrypted_user_key set, cannot generate user keypair without password or key How can I fix this, or at least read what the mail says? Would it be safe to just give dmarc user a strong password?

2 1

Error: read() failed for file :: No buffer space available
by rudolf＠padaru.de 04 May '23

04 May '23

Hey there, ive got a situation with one of mine mailusers he cant access his mailbox and i cant resync the mailuser or access the mails with doveadm too: In maillog we got a lot of these errors, ist only m.73 that makes problems: Error: Syncing mailbox INBOX failed: read() /mdbox/storage/m.73: No buffer space available I dont really understand whats the problem here, the partition has ~500gb free space and all other mailboxes work fine on this server. Is there somebody who can give me a hint to solve this? First i thought the mdbox file is to obig, so i increased the mdbox_rotate_size limit without success. To restart the dovecot changes nothing too. In the dovecot journal i cant find other problems wo cause in this one, same in syslog, nothing special to see, like segfaults or so. My doveconf -n: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.4.0-146-generic x86_64 Ubuntu 20.04.6 LTS auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@üÜöÖäÄ auth_worker_max_count = 60 default_vsz_limit = 1000 M disable_plaintext_auth = no imap_capability = +XLIST imap_logout_format = in=%i out=%o del=%{deleted} fetched_mails=%{fetch_hdr_count} lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lock_method = flock login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c mail_always_cache_fields = date.received date.sent imap.envelope hdr.x-spam hdr.x-virus-status hdr.return-path hdr.received flags mail_cache_min_mail_count = 30 mail_location = auto: mail_max_userip_connections = 30 mail_never_cache_fields = mail_plugins = " zlib" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapflags notify vnd.dovecot.pipe vnd.dovecot.filter vnd.dovecot.execute mbox_read_locks = dotlock mbox_very_dirty_syncs = yes mdbox_rotate_size = 250 M namespace inbox { inbox = yes location = mailbox Archiv { auto = no special_use = } mailbox Drafts { auto = no special_use = } mailbox Junk { auto = no special_use = } mailbox Sent { auto = no special_use = } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = no special_use = } prefix = } passdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } plugin { sieve = ~/sieve/.dovecot.sieve sieve_after = ~/sieve_after/.dovecot_after.sieve sieve_before = ~/sieve_before/.dovecot_before.sieve sieve_dir = ~/sieve sieve_execute_bin_dir = /usr/local/bin/ sieve_execute_input_eol = lf sieve_extensions = +notify +imapflags +vnd.dovecot.pipe +vnd.dovecot.filter +vnd.dovecot.execute +editheader -reject sieve_filter_bin_dir = /usr/local/bin/ sieve_filter_input_eol = lf sieve_global_dir = /etc/dovecot/sieve/ sieve_max_redirects = 25 sieve_pipe_bin_dir = /usr/local/bin/ sieve_pipe_input_eol = lf sieve_plugins = sieve_extprograms sieve_redirect_envelope_from = recipient zlib_save = gz zlib_save_level = 6 } protocols = imap pop3 sieve service auth-worker { idle_kill = 1 mins } service auth { idle_kill = 1 mins unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = root } service imap-login { executable = /usr/lib/dovecot/imap-login process_min_avail = 4 service_count = 0 user = dovecot } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 0 user = dovecot } service managesieve { process_limit = 1024 user = dovecot } service pop3-login { executable = /usr/lib/dovecot/pop3-login process_min_avail = 4 service_count = 0 user = dovecot } service pop3 { executable = /usr/lib/dovecot/pop3 process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0666 } unix_listener stats-writer { group = dovecot mode = 0666 } } shutdown_clients = no ssl_cert = </etc/certs/ourCert.com.pem ssl_cipher_list = EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:E ECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:!aNULL:!eNU LL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/conf.d/zDovecot-sql.conf.ext driver = sql } verbose_proctitle = yes protocol lda { mail_plugins = " zlib sieve zlib" rejection_reason = Your message to <%t> was automatically discarded:%n%r } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = " zlib mail_log notify zlib" ssl = yes } protocol pop3 { mail_plugins = zlib pop3_client_workarounds = oe-ns-eoh outlook-no-nuls pop3_no_flag_updates = no pop3_uidl_format = %08Xu%08Xv ssl = yes } Size oft he mdbox-file: du -b m.73 262143997 m.73 Mit freundlichen Grüßen Yours sincerely <https://padaru.de/> Pascal Rudolf | Geschäftsführer PADARU-IT | Bielebohstraße 10 | 02736 Beiersdorf @: rudolf(a)padaru.de | www: <http://padaru.de/> padaru.de mobil: +49 (0) 17 772 595 32

1 0

Help - Permissions issue with new mail
by michele.clark＠us.kbr.com 03 May '23

03 May '23

Hi all. We have an install of Dovecot running with Postfix and Roundcube using virtual mail to allow us to connect to our AD domain which got messed up after a power issue. I can log into our Roundcube and see all my old emails, however new emails keep getting stuck in the CUR files with permissions of -rw------- If I chmod the email it will deliver to the inbox in Roundcube. Can anyone advise on how I can adjust this so all new emails will come thru with the correct permissions? - Thanks in advance

5 4

managesieve problem
by Soeren Malchow 25 Apr '23

25 Apr '23

Hi, i am struggeling with a managesieve problem, we are using docker mailserver and managesieve login does not work, if i understand correctly, then dovecot should offer something like this "SASL" "PLAIN" on our server it is simply empty "SASL" "" i was trying to authenticate in a telnet connection AUTHENTICATE "PLAIN" "LOGINSTRING_HERE" And i get this NO "Error in MANAGESIEVE command received by server." first of all i would like to ask where the SASL capabilites come from, how can i get it to offer "PLAIN" or "AUTH" everything else (e.g. sieve itself) just works find Cheers Soeren

2 2

dovecot sasl with postfix, smtp auth not available
by Badli Al Rashid 24 Apr '23

24 Apr '23

Hi All, I have set up dovecot sasl with postfix. When I check the smtp with ehlo there is no auth advertise. Connected to www.zystro.xyz. Escape character is '^]'. 220 www.zystro.xyz ehlo x.zystro.xyz 250-www.zystro.xyz 250-PIPELINING 250-SIZE 10485760 250-ETRN 250-STARTTLS 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING I did a number of installations the auth was not shown. I have use debian distributed and also dovecot packages. Sasl. root@www:~# postconf -a cyrus dovecot root@www:~# postconf -A cyrus Dovecot version. root@www:~# dovecot --version 2.3.20 (80a5ac675d) Dovecot configuration. root@www:~# dovecot -n # 2.3.20 (80a5ac675d): /etc/dovecot/dovecot.conf # OS: Linux 5.10.0-21-amd64 x86_64 Debian 11.6 # Hostname: www.zystro.xyz auth_mechanisms = plain login debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = mbox:~/Mailbox namespace { inbox = yes location = prefix = separator = / } passdb { driver = pam } postmaster_address = postmaster(a)zystro.xyz protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { address = 127.0.0.1,::1 port = 143 } inet_listener imaps { address = * port = 993 ssl = yes } } ssl_cert = </etc/letsencrypt/live/www.zystro.xyz/fu llchain.pem ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } I have followed the guide at postfix and dovecot but still the auth did not appear. https://doc.dovecot.org/configuration_manual/howto/postfix_and_dovecot_sasl/ https://www.postfix.org/SASL_README.html Anybody got any ideas ? Regards, -badli

6 12

dovecot-fts-solr Solr9 support
by PGNet Dev 24 Apr '23

24 Apr '23

I run dovecot-2.3.18 , & am deploying Solr search with 'dovecot-fts-solr' I run Solr standalone. When creating a dedicated 'dovecot' core, cp'ing from Dovecot's included solr schemas ls -al /usr/share/doc/dovecot/solr-* -rw-r--r-- 1 root root 12K Dec 3 06:48 /usr/share/doc/dovecot/solr-config-7.7.0.xml -rw-r--r-- 1 root root 2.7K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema-7.7.0.xml -rw-r--r-- 1 root root 2.9K Dec 3 06:48 /usr/share/doc/dovecot/solr-schema.xml is tested only for Solr 7.7.0 https://doc.dovecot.org/configuration_manual/fts/solr/ "The steps described in this page are tested for Solr 7.7.0. For other versions, this these steps may need to be adjusted." which, per solr docs https://solr.apache.org/downloads.html About versions and support Version Description 9.x Current major version for feature releases (STABLE) 8.11.x Previous major version may sometimes receive critical bugfix releases 10 Next major version, yet to be released (UNSTABLE) <8.11 All older versions are End Of Life (EOL) is EOL'd and unsupported. In the dovecot 7.7.0 schema, FastLRUCache/LRUCache are used as the caching class(es), grep class=.*LRU /usr/share/doc/dovecot/solr-config-7.7.0.xml <filterCache class="solr.FastLRUCache" <queryResultCache class="solr.LRUCache" <documentCache class="solr.LRUCache" class="solr.search.LRUCache" For Solr 9, cat CHANGES.txt Upgrade Notes --------------------- ... * SOLR-13817: Deprecate legacy SolrCache implementations. Users are encouraged to transition their configurations to use org.apache.solr.search.CaffeineCache instead. (ab) running solr9 + dovecot-fts-solr search, based on the 7.7.0 schemas, results in errors, failed scan & search. Modifying the config to use CaffeineCache cp solr-config-7.7.0.xml solr-config-9.0.0.xml perl -pi -e '\ s|solr.FastLRUCache|solr.CaffeineCache|g; \ s|solr.LRUCache|solr.CaffeineCache|g; \ s|solr.search.LRUCache|solr.search.CaffeineCache|g;' \ solr-config-9.0.0.xml appears to do the trick. Atm, indexing & search -- both manually triggered, and on delivery receipt to Dovecot store -- is working with no errors (yet). I've not tested exhaustively yet, & don't know if this Cache class change in the schema is both necessary & sufficient for dovecot-fts-solr search use with solr 9.0.0 Given that for Solr "<8.11 All older versions are End Of Life (EOL)" it'd be useful for Dovecot to 'retest' for current, not-EOL'd Solr, and publish/package compatible schemas accordingly.

5 8

Indexer opening emails in write mode ?
by Andre Rodier 23 Apr '23

23 Apr '23

Hi, I have dovecot indexer working inside AppArmor, and I am confused by some error messages: > name="/home/users/andre/mails/maildir/.Sent/cur/1682251668.M110083P109814.pigment,S=1743,W=1776:2,S" pid=111784 > comm="indexer-worker" requested_mask="wd" denied_mask="wd" fsuid=1001 ouid=1001 Why the indexer would open email files in write mode, please ? Thanks for your advice

1 0

sieve traces not logged
by Christian Weiske 23 Apr '23

23 Apr '23

Hello, Some sieve filters do not work as expected and I want to debug why. For that I configured in /etc/dovecot/conf.d/90-sieve.conf sieve_trace_dir = /var/log/dovecot/ sieve_trace_level = matching and created /var/log/dovecot/ and gave it the user+group "Debian-exim". Unfortunately, no logs are written into that direcory. The normal log file in /var/log/dovecot.log contains no information - except that lmtp stored the mail in mailbox "test". The docs[1] only say that those two options need to be enabled. Sieve itself works, which I confirmed by creating a rule that moves mails with subject "test" into a separate folder. What am I doing wrong? ---- $ dovecot --version 2.3.20 (80a5ac675d) Running on Debian 11, packages from https://repo.dovecot.org/ce-2.3-latest/debian/bullseye Full sieve config from "dovecot -n": plugin { imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/.dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /etc/dovecot/sieve-bin/ sieve_plugins = sieve_imapsieve sieve_extprograms sieve_trace_debug = no sieve_trace_dir = /var/log/dovecot-sieve sieve_trace_level = matching } [1] https://doc.dovecot.org/configuration_manual/sieve/configuration/#trace-deb… -- Regards/Mit freundlichen Grüßen Christian Weiske -=≡ Geeking around in the name of science since 1982 ≡=-

1 1

Blacklistd
by Doug Hardie 22 Apr '23

22 Apr '23

Are there any plans to interface to blacklistd? -- Doug

6 9

quotas and Trash
by David Koski 22 Apr '23

22 Apr '23

Hello, I am testing quotas with the following configuration: plugin { quota_rule = *:storage=1M quota_rule2 = INBOX.Trash:storage=+100M quota_grace = 10%% } The 1M limit works perfectly but I had to prefix Trash with "INBOX." to get it to stop complaining about an unknown namespace. But now the quota_rule2 is ignored. Once the mailbox reaches 1M, even if it is all in INBOX.Trash, it will fail to deliver due to quota limit. Dovecot: 2.3.13+dfsg1-2+deb11u1:amd64 Debian 11 auth_mechanisms = plain login disable_plaintext_auth = no mail_plugins = quota mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX. separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_plugins = quota quota quota = maildir:User quota quota_grace = 10%% quota_rule = *:storage=1M quota_rule2 = INBOX.Trash:storage=+100M } protocols = " imap pop3" service anvil { unix_listener anvil-auth-penalty { group = vmail mode = 0660 user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { mode = 0660 } } service imap-login { inet_listener imap { address = 172.16.0.1 } } service pop3-login { inet_listener pop3 { address = 172.16.0.1 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = no ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota quota postmaster_address = dkoski(a)sutinen.com } protocol lda { mail_plugins = quota quota } protocol imap { mail_max_userip_connections = 14 mail_plugins = quota quota imap_quota } protocol pop3 { mail_plugins = quota quota } Regards, David Koski dkoski(a)sutinen.com

3 7

Message searching in Dovecot
by John Gateley 21 Apr '23

21 Apr '23

Hello, For mobile clients (gmail on Android), I need a server side searching solution. A few months ago, I tried getting Solr to work with Dovecot, but failed. The instructions here https://doc.dovecot.org/configuration_manual/fts/solr/ are quite out of date, they reference Debian 8 and 9 (current version 11), and Solr 7.7 (current version 9.2) My Solr experience is pretty much zero. Questions/Requests: * Is there a different tool than Solr I should be using for this? * Does anyone have a recent version of Solr and Debian working? * If you do, would you be willing to help me? * I cannot afford much, this is a home mailserver for my wife and I, but I could pay a small consulting fee. I use ansible to deploy the server, I'd be willing to contribute the playbooks somewhere for documentation, or help with the docs. Thanks! John

5 6

Re: Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

From headers: Received: from BL0GCC02FT014.eop-gcc02.prod.protection.outlook.com (2a01:111:f400:7d05::209) by CYXPR09CA0010.outlook.office365.com (2603:10b6:930:d4::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6319.25 via Frontend Transport; Thu, 20 Apr 2023 11:49:06 +0000 Authentication-Results: spf=softfail (sender IP is 63.88.93.251) smtp.mailfrom=open-xchange.com; dkim=fail (signature did not verify) header.d=open-xchange.com;dmarc=fail action=oreject header.from=open-xchange.com;compauth=none reason=452 Received-SPF: SoftFail (protection.outlook.com: domain of transitioning open-xchange.com discourages use of 63.88.93.251 as permitted sender) From: Aki Tuomi <aki.tuomi(a)open-xchange.com> Date: Thursday, April 20, 2023 at 07:49 Subject: [EXTERNAL] Re: Mailing list is being Spam Filtered by O-365 On 20/04/2023 14:18 EEST White, Daniel E. (GSFC-770.0)[AEGIS] via dovecot <dovecot(a)dovecot.org<mailto:dovecot@dovecot.org>> wrote: Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security. Um? Those already are added? Or what do you mean? Aki

3 2

Mailing list is being Spam Filtered by O-365
by White, Daniel E. (GSFC-770.0)[AEGIS] 20 Apr '23

20 Apr '23

Is there any chance that SPF and DKIM records could be added to appear in the headers ? The gubba-mint folks are getting extremely medieval about email security.

2 1

Request - extra variable in passdb for logging
by Bogusław Juza 20 Apr '23

20 Apr '23

Hi Staff, I'm creating the dovecot configuration for multiple user passwords e-mail site. It's working well, but I've one problem - I can't log, which password was used. I'm using auth-sql, the query looks like: password_query = \ SELECT `users`.`email` AS `user`, \ `shadow`.`passwd` AS `password`, \ FROM `shadow` WHERE `shadow`.`email` = '%u' AND \ ( ('%r'='127.0.0.1' AND `shadow`.`webmail`<>0) OR \ ('%r'<>'127.0.0.1' AND `shadow`.`imap`<>0 AND \ `shadow`.`hash`='%{sha512;rounds=5000:password}') \ ) LIMIT 1 The hash from random generated application password works as the selector, which password should be checked. It works fine, but in the log I have got only the e-mail and both IP addresses. I need to log one more information - which password was used (`shadow`.`id` column). It would be a great feature to have one more extra variable, which I could set in this query and which goes directly to log and nowhere else. I have tried something like: password_query = \ SELECT CONCAT(`users`.`email`,'#',`shadow`.`id`) AS `user`, ... and then "repair it" in user_query: SELECT `email` AS `user` WHERE `email` = REGEXP_SUBSTR('%u','[^#]+') and it even works well, except postfix-auth, which received email with #number as the username and it was problematic. So I'm kindly asking for this extra variable in next versions of Dovecot ;) Bogusław Juza

2 1

mbox to maildir migration, same server?
by kjohnson＠eclypse.org 20 Apr '23

20 Apr '23

What is the recommended procedure to migrate from mbox to maildir on a server already running dovecot? Ideally, this procedure would convert messages in an existing mbox INBOX and in ~/mail mboxes (as defined in my dovecot configuration) to storage in a ~/Maildir. Some of the INBOXs are rather large -- 100's of MB (one of the reasons for migrating). What I have tried has not worked for me. Below, I describe what I tried, how I tested before I tried, what went wrong, and the current setup (pre-migration). What I tried: ============= stop exim4 service dovecot stop Make dovecot listen only locally, not to external connections. /etc/dovecot/local.conf protocol imap { listen = 127.0.0.1:143 ssl_listen = 127.0.0.1:993 } protocol pop3 { listen = 127.0.0.1:110 ssl_listen = 127.0.0.1:995 } Modify dovecot configuration for maildir: Watch capitalization! #in 10-mail.conf: mail_location = maildir:/home/%u/Maildir namespace inbox { separator = / } dovecot -n, to confirm results and perform limited syntax checking. service dovecot start for each user, in a bash script: dsync -v -u "$U" mirror "mbox:/home/$U/mail:INBOX=/var/mail/$U" (if the conversion worked for all users, then reconfigure exim to use maildir and restart it; reconfigure dovecot to listen to external interfaces and restart.) How I tested: ============= Before trying this on the real server, I set up a matching (same versions of Debian, Exim, and Dovecot) VM using mbox, with a couple of accounts. One using POP3, one using IMAP. The IMAP account was accessed from Claws and from Outlook. The test accounts had perhaps a dozen messages on the server. I tried the conversion procedure, and everything I tried worked flawlessly. (Yes, next time I will move some real inbox files from the live server). What went wrong: ================ I encountered two types of problems here. The first was several dsync warnings (username changed): dsync(example): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 21bfa11a81f11763ac150000d09efc50 (maybe it was just deleted?) As I understand it, this can result in some or all messages being downloaded again by clients. My understanding may be wrong. I also don't understand how the mailbox could have changed -- exim4 was stopped, dovecot is only listening on 127.0.0.1, and I am the only user who uses a local mail client on that system, and this was not my account. The second problem I encountered seems to match Debian Bug report logs - #1011238. In part of the discussion of that report, the reporter mentions adding -1 to the command, as shown: dsync -v -u "$U" mirror -1 "mbox:/home/$U/mail:INBOX=/var/mail/$U" While this seemed to eliminate the dsync panic of #1011238, as far as I can tell, no old messages were actually moved from the old mbox files to the new maildirs. At that point I restored the backup mbox files and undid the changes to dovecot and exim4. Current setup: ============== Debian 11.4 Exim 4.94.2-7 dovecot 1:2.3.13+dfsg1-2 The current setup with Dovecot was a successful migration from IMAP-UW in December 2020. Output from dovecot -n (the list of trusted networks has been removed) # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-16-686-pae i686 Debian 11.4 # Hostname: localhost auth_verbose = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } pop3_uidl_format = %08Xv%08Xu protocols = " imap pop3" ssl_cert = </etc/dovecot/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Thank you to anyone who read this far. Ken

4 4

last_login plugin and $remote_ip
by Fabrizio Cuseo 19 Apr '23

19 Apr '23

Good morning. I am planning a dovecot system with: - 3 x glusterfs servers (with 2 volumes, 1 ssd for short term mail, and 1 with bigger hdd for long term archive mail) - 1 x mysql server (another server with active replica will be added) - 3 x mbox servers (with dovecot pop/imap/lmpt/sieve/postfix) - 3 x dovecot proxy/directors for pop3/imap/smtp - 4 x proxmox mail gateway for antispam/antivirus in front of smtp servers - 1 x centralized syslog server All have private ip addresses, and in front there is a firewall with HA_proxy to make high availability and load balancing. My only problem now is using last_login plugin; i have configured on the mailbox servers on pop3/imap, but the ip address that is written on mysql is the proxy/director address, not the real client ip address. No results using real_remote_ip. Apr 19 09:14:31 mailbox-01 dovecot: pop3-login: Login: user=<username(a)domain.it>, method=PLAIN, rip=172.16.27.31, lip=172.16.27.21, mpid=19723, session=<42nHLKv5JsqsEBsf> Apr 19 09:14:31 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Started proxying to 172.16.27.21 (1.978 secs): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> Apr 19 09:14:34 mailbox-01 dovecot: pop3(username(a)domain.it)<19723><42nHLKv5JsqsEBsf>: Disconnected: Logged out top=0/0, retr=0/0, del=0/37, size=115779706 Apr 19 09:14:34 mailproxy-01 dovecot: pop3-login: proxy(username@domain.it,172.16.27.21:110): Disconnected by server (0s idle, in=45, out=82): user=<username(a)domain.it>, method=PLAIN, rip=212.66.96.188, lip=172.16.27.31, session=<u4+wLKv5ZUjUQmC8> in db I have last_ip: 172.16.27.31, not 212.66.96.188 ------------- dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-69-generic x86_64 Ubuntu 22.04.2 LTS # Hostname: mailbox-01 auth_default_realm = XXXXXXXX.it default_client_limit = 2500 dict { mysql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sieve = mysql:/etc/dovecot/dict-sieve-sql.conf sql = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = tb-extra-mailbox-sep delay-newmail login_greeting = Welcome to mail server mail_fsync = always mail_gid = 89 mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_plugins = quota mail_privileged_group = mail mail_uid = 89 mailbox_list_index_very_dirty_syncs = yes mdbox_rotate_size = 128 M mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { last_login_dict = proxy::sql last_login_key = # hidden, use -P to show it last_login_precision = ms quota = count:User quota quota_clone_dict = proxy::mysql quota_grace = 50M quota_rule2 = Trash:storage=+100M quota_vsizes = yes quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = dict:proxy::sieve;name=active sieve_extensions = +vacation-seconds sieve_vacation_default_period = 7d sieve_vacation_max_period = 30d sieve_vacation_min_period = 1h } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = " imap lmtp pop3" service dict { unix_listener dict { group = mail2023 mode = 0660 user = mail2023 } } service doveadm { inet_listener { port = 2425 } inet_listener http { port = 8080 } unix_listener doveadm-server { user = mail2023 } } service imap { process_limit = 1024 } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = mail2023 mode = 0666 user = mail2023 } } service pop3 { process_limit = 250 } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { mode = 0666 user = mail2023 } user = mail2023 } service stats { unix_listener stats-reader { group = mail2023 mode = 0660 user = mail2023 } unix_listener stats-writer { group = mail2023 mode = 0660 user = mail2023 } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = quota sieve quota quota_clone } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } protocol lda { mail_plugins = quota sieve quota quota_clone } protocol imap { mail_max_userip_connections = 10 mail_plugins = quota quota imap_quota quota_clone last_login } protocol pop3 { mail_max_userip_connections = 2 mail_plugins = quota quota quota_clone last_login } in dovecot-dict-sql.conf.ext there is: map { pattern = shared/last-login/$service/$user/$remote_ip table = mail_last_login value_field = last_access value_type = uint fields { userid = $user service = $service last_ip = $remote_ip } } -- --- Fabrizio Cuseo - mailto:f.cuseo@panservice.it

2 2

Re: Mailing list update
by Peter Wienemann 19 Apr '23

19 Apr '23

Dear Aki, On 12.04.23 13:31, Aki Tuomi via dovecot wrote: > We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. thanks for this. > Please let us know if you have face any issues with the mailing list and we'll look into it. Is there a way to keep old links to archived messages (such as https://dovecot.org/pipermail/dovecot/<year>-<month>/<message-id>.html) intact? Best regards, Peter

3 3

Custom SASL authentication
by David Koski 19 Apr '23

19 Apr '23

Hello, I'm looking for a good way to apply a custom hash to passwords. My hope is to add passwords to a (MySQL) database: INSERT INTO users (user='joblo', pass=MYHASH('plain-password').. For SASL authentication, my thought first was to apply the same hash to the issued password and compare it with the hashed password in the database. I soon discovered the sql driver supplied by Dovecot doesn't provide that ability, unless I'm missing something. I'm looking for documentation on how to implement a custom authentication script if needed. Regards, David Koski dkoski(a)sutinen.com

4 6

imap Error: rename failed: Too many links
by Andrey Repin 18 Apr '23

18 Apr '23

Greetings, All! I'm facing a problem with one particular directory in a mailbox. The exact error line is: Apr 7 12:00:21 mxs dovecot: imap(vera): Error: rename(/home/vera/.mail/INBOX/Майя Николаевна/new/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST, /home/vera/.mail/INBOX/Майя Николаевна/cur/1678353168.M710968P25673.mxs.ads.ccenter.lan,S=5442,W=5513:2,ST) failed: Too many links The rest of the mailbox behave correctly, as I can tell, but this specific subdir fails to report unread mail correctly. What are the options to fix it? # dovecot --version 2.2.22 (fe789d2) Config is in attachment, but I doubt it is of any interest. -- With best regards, Andrey Repin Friday, April 7, 2023 16:37:09 Sorry for my terrible english...

4 6

Maildir compression
by Jose David Bravo A 18 Apr '23

18 Apr '23

Hello, I would like to compress the maildir of some of our users, I'm thinking to use this script: [ https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… | https://github.com/George-NG/dovecot-maildir-compress/blob/master/dovecot-m… ] My question is, how dovecot will calculate the quota for that user after the compression? will dovecot calculate the quota of that user using the real size of the message file after compression, or the plain size before compression? Is it necessary to recreate the index of that maildir after the compression is made? If so, what command should I use? Thank you! Jose Bravo

2 1

Confusion re doveadm pw and protected private keys
by Paul Kroitor 18 Apr '23

18 Apr '23

Hello, It seems from this thread at letsencrypt : https://community.letsencrypt.org/t/changing-permissions-for-pem-files/19656 1 (see especially second post from _az) that doveadm pw now parses all files in the config, even ones not relevant to the pw aspect of the request. If it's not able to access all the files, it terminates prematurely with exit code 89. The result, at least for anyone using letsencrypt / certbot, is that doveadm pw fatally fails unless run as root, because the config includes the private key, which has permissions 600 root root. This makes the dovecot pw functionality unusable for web apps that want to calculate a password hash using it (e.g. RoundCube's password change feature). My understanding is that dovecot only really needs the private key for its main functionality, when it's running as root, and that there's no reason doveadm pw, which should (presumably) often be run as a regular user, needs access to it. Is this the intended behavior, or have I got something wrong? Thanks for all help, Paul

2 1

Shared / Public mailbox
by Stephane MAGNIER 15 Apr '23

15 Apr '23

Hi I wish to create a share mailbox ( well.. Apparently, this is a public mailbox). Let's say I have 2 users : user1 & user2 and the need to share a mailbox for "general inquiries" emails.. Despite of the 2 users' account creation ( user1 & user2) , should I create a third email account ( info1) for general inquiries for instance and instruct Dovecot that this mail box has to be shared ? In that case, logically, I have to declare into: "15-Mailboxes.conf" |namespace { type = public separator = / prefix = Public/ location = maildir:|||/var/spool2/mail|/info1/:CONTROL=/var/spool2/mail/Maildir/info1:INDEX=|||/var/spool2/mail|/info1 # Allow users to subscribe to the public folders. subscriptions = yes } | |and add a file : /etc/dovecot/dovecot-acl| || ||||/var/spool2/mail|/info1/| user=user1,user2 lrwstipekxa ||/var/spool2/mail|/info1|/* user=user1,user2 lrwstipekxa and add the plugin : plugin { acl = vfile }|| Is that the way to do it ? 2) Now what is the difference between a shared and Public mailbox ? I can see that the plugin is slightly different : |acl_shared_dict| <https://doc.dovecot.org/settings/plugin/acl-plugin/#plugin_setting-acl-acl_…> For me a "public"email folder is for sharing emails.. My understanding is: general email account can be shared ( like info1 in my example).. this is called a public mailbox.( specific email account, shared between users). So what is called a "Shared mailbox" ????? Thanks for your help ?

4 5

Mailing list update
by Aki Tuomi 13 Apr '23

13 Apr '23

Hi all! We finally managed to move from mailman2 to mailman3, and mail archives are now at https://dovecot.org/mailman3/archives and they can be now searched, too. Please let us know if you have face any issues with the mailing list and we'll look into it. Regards, Aki Tuomi Open-Xchange oy

4 9

Mailing list changes.
by dovecot＠ptld.com 13 Apr '23

13 Apr '23

I noticed starting today the Sender: header is no longer included on the mailing list. I used to use the Sender: header in sieve rules for sorting. Now the list emails only come From: rando email addresses. On the postfix mailing list it replaces the From: header with the list address instead of keeping the original email author. Is this the future intended behavior? Or can we get a Sender: or From: header to contain the list address for sorting?

3 3

Dovecot restoration.... problem
by Stephane Magnier 13 Apr '23

13 Apr '23

Hi, In the past, I've done a Dovecot Backup with a Rsync cmd... every day Today I need to get back these mailboxes.. and doesn't work out 1) first of all, I tried to make a simple copy... Now way . Couldn't access the INBOX Do you think that it could work that way ? I don't need to synchronized every minute. once a day is OK for me. 2) I did use the instruction doveadm --import -u user1 maildir:/home/user1/mail/ "" ALL It did start copying but apparently cannot got until the end... but noting visible onto Thunderbird... I didn't do any synchro between 2 dovecot servers. I just need to make a copy some times to times and rsync seemed to be a good option. But now, How can I get back online ??? Thanks

2 1

decrypt.rb
by Dave 11 Apr '23

11 Apr '23

Per the Dovecot site here: https://wiki.dovecot.org/Plugins/MailCrypt ... the "decrypt.rb" ruby script can be used to decrypt a Dovecot-encrypted message file from the command line. The script sort of runs successfully for me, in the sense that it doesn't error out, but it doesn't show the decrypted message. I've called it like so: decrypt.rb -k <PATH_TO_DOVECOT_KEYFILE> -f ./encrypted_message But when I do it just displays the info below and exits (I've subbed <DATA> tags for the actual data): ------------------[OUTPUT]----------------------- Key(s) (total: 1) - Key type : EC - Key digest: <DATA1> - Peer key : <DATA2> - Encrypted : <DATA3> - Kd hash : <DATA4> ------------------------------------------------------- I've tried specifying an output file as well, per the script's command line options, but the output file is 0 bytes. Does anyone have any suggestions? I *think* I'm using it the way it's intended to be used, but maybe I'm not?! -Dave

5 14

None
by None 11 Apr '23

11 Apr '23

... - maildir: change it to use '/' as hierarchy separator to allow '.' characters (for usernames in shared folders) ... Now changing the separator in the maildir-storage.c is trivial (even though it "can't" be changed :-), but fixing the resultant breakage in maildir-list.c needs a little more understanding. Timo, could you give me some pointers? I can see that I need to work out what imap_match_init() does. My motivation is to follow up on an earlier thread about reusing .mailboxlist files as .subscription files, preferably without rewriting them to replace the slashes with something else. Thanks -- Charlie

1 0

None
by None 11 Apr '23

11 Apr '23

checking IMAP connection. Based on that experimentation, it seems that when I try to verify certificate files with openssl, all checks out, but when I try to check thing through IMAPS, things go ugly (see log below). If I try same openssl s_client command on my web server, it gets everything correctly. As result from this one, I've even tried to use certificate from my web server with IMAP and even then openssl keeps on saying that there is bad record mac. Is this bug in dovecot's SSL handling or have I managed to mess something in my setup? URLS: CA cert: http://jylitalo.homeip.net/ca/ca.crt IMAPD cert: http://jylitalo.homeip.net/ca/imapd.crt [log starts] bash-2.05a$ openssl verify -CAfile /usr/local/www/data/ca/ca.crt /etc/ssl/certs/imapd.crt /etc/ssl/certs/imapd.crt: OK bash-2.05a$ openssl s_client -host localhost -port 993 -CAfile /usr/local/www/data/ca/ca.crt -verify -debug verify depth is 0 CONNECTED(00000003) depth=1 /C=FI/ST=Finland/L=Helsinki/O=Juha Ylitalo/CN=Juha Ylitalo/Email=jylitalo(a)iki.fi verify return:1 depth=0 /C=FI/ST=Finland/O=Juha Ylitalo/CN=coat.st-paul/Email=jylitalo(a)iki.fi verify return:1 47169:error:140943FC:SSL routines:SSL3_READ_BYTES:sslv3 alert bad record mac:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s3_pkt.c:1046:SSL alert number 20 47169:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:/usr/src/secure/lib/libssl/../../../crypto/openssl/crypto/../ssl/s23_lib.c:226: bash-2.05a$ [log ends] -- Juha Ylitalo juha.o.ylitalo(a)nokia.com <work e-mail> +358 40 562 6152 http://linux.nokia.com/~jylitalo/ <work www>

1 0

None
by None 11 Apr '23

11 Apr '23

while (rename(src, dest) < 0 && count < 2) { if (errno != EEXIST) { rename can never return EEXIST in errno. maildir-save.c, line 124. /* move the file into new/ directory - syncing will pick it up from there */ if (rename(tmp_path, new_path) == 0) failed = FALSE; Here you can lose emails if the new/ folder contains a message whose base name is equal. The only way to avoid this is: 1) use link and unlink, not rename 2) leave messages that have a time_t part equal to or higher than time(NULL). Anyway, Maildir has a strict consistency criteria which says that all messages that are linked from tmp/ into new/ _must_ use time(NULL) plus a number that is guaranteed not to lapse within one second, and which does not collide with other messages in new/. new/ is the single entry point into cur/, and messages in new/ can not be "older" than the messages in cur/. The simple reasoning for this is that you can never guarantee that there is no message in cur/ that has the same base name, but perhaps different flags. It follows that when moving a message from new/ to cur/, it is required that the server only picks messages that are older than one second. Andy -- Andreas Aardal Hanssen http://www.andreas.hanssen.name/gpg

1 0

auth-worker fatal signal 11 core dump
by Anthony Carrico 07 Apr '23

07 Apr '23

I'm testing out dovecot/tls/openldap(via portunus). It seems to work fine. I can access Maildir with Thunderbird as expected. However according to the logs, auth-worker crashes when slapd closes: Apr 04 22:11:56 silver slapd[1745983]: conn=1054 op=1 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1054 fd=14 closed Apr 04 22:11:56 silver slapd[1745983]: conn=1053 op=2 UNBIND Apr 04 22:11:56 silver slapd[1745983]: conn=1053 fd=13 closed Apr 04 22:11:56 silver dovecot[2083465]: auth-worker: Fatal: master: service(auth-worker): child 2084984 killed with signal 11 (core dumped) Apr 04 22:11:56 silver dovecot[2083465]: auth: Fatal: master: service(auth): child 2084981 killed with signal 11 (core dumped) Here is the configuration. It is a minimal setup, just testing ldap for passdb: # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # OS: Linux 6.1.7 x86_64 NixOS 22.11 (Raccoon) btrfs # Hostname: silver auth_mechanisms = plain login base_dir = /run/dovecot2 default_internal_group = dovecot2 default_internal_user = dovecot2 mail_location = maildir:/home/%n/Maildir:INBOX=/var/spool/mail/%n:INDEX=/var/lib/dovecot/indexes/%n:LAYOUT=Maildir++ passdb { args = /var/lib/dovecot/etc/dovecot-ldap.conf.ext driver = ldap } pop3_uidl_format = %08Xv%08Xu protocols = imap sendmail_path = /run/wrappers/bin/sendmail service auth { user = root } ssl_ca = </var/certs/.minica/cert.pem ssl_cert = </var/certs/silver/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } Here is the ldap config: uris = ldaps://silver tls_ca_cert_file = "/var/certs/.minica/cert.pem" auth_bind = yes auth_bind_userdn = uid=%u,ou=users,dc=silver base = dc=silver Here is the stack trace: PID: 2084981 (auth) UID: 0 (root) GID: 0 (root) Signal: 11 (SEGV) Timestamp: Tue 2023-04-04 22:11:56 EDT (11h ago) Command Line: dovecot/auth Executable: /nix/store/s72dc8pc6g70dscya8ggsvn61rnfhixy-dovecot-2.3.19.1/libexec/dovecot/auth Control Group: /system.slice/dovecot2.service Unit: dovecot2.service Slice: system.slice Hostname: silver Storage: /var/lib/systemd/coredump/core.auth.0.9fed479ad6ac4f0e8c2d5f290d9ea3f5.2084981.1680660716000000.zst (present) Disk Size: 324.7K Message: Process 2084981 (auth) of user 0 dumped core. Module linux-vdso.so.1 with build-id 7aefd45ed44b5302cf82d7b5093cd9b882b8bc8a Module legacy.so with build-id fdd26faf7ff15c8fa78ef2091d38c5fb886da146 Module libscram.so.3 without build-id. Module libdb-5.3.so without build-id. Module libsasldb.so.3 without build-id. Module libplain.so.3 without build-id. Module libotp.so.3 without build-id. Module liblogin.so.3 without build-id. Module libgssapiv2.so.3 without build-id. Module libkeyutils.so.1 without build-id. Module libkrb5support.so.0 without build-id. Module libcom_err.so.3 without build-id. Module libk5crypto.so.3 without build-id. Module libkrb5.so.3 without build-id. Module libgssapi_krb5.so.2 without build-id. Module libgs2.so.3 without build-id. Module libdigestmd5.so.3 without build-id. Module libcrammd5.so.3 without build-id. Module libanonymous.so.3 without build-id. Module libresolv.so.2 with build-id 6bcddb1dd1be5b345df903815f364e5d967ae0ef Module libdl.so.2 with build-id 2e86539e324ffb14e185718fd284d3f3f2568f06 Module libm.so.6 with build-id 5cc630080219b350d8f9e4573c65d2dd931ea978 Module libz.so.1 without build-id. Module ld-linux-x86-64.so.2 with build-id 3be2bc3749163683f612e0fb8169ce51f75742fe Module libcrypto.so.3 with build-id ca321413716a256baa08042cb3f3c07a90cc82ce Module libssl.so.3 with build-id 4bf2aae91a0d91b0ca0a6fe1ab29b2b7653a17f6 Module libsasl2.so.3 without build-id. Module libaudit.so.1 without build-id. Module libc.so.6 with build-id 3d6884d200ead572b7b89a4133f645c7a3c039ed Module libpthread.so.0 with build-id 0f7050f6ef81222c7290351dfa67e5e062c797bf Module libsqlite3.so.0 with build-id 174a69054606e27a1c555838b07035346e83bfb0 Module libsodium.so.23 with build-id 1c1e5b232aa14bf5c942b3568bf70713da9ad11f Module liblber.so.2 without build-id. Module libldap.so.2 without build-id. Module libpam.so.0 without build-id. Module libcrypt.so.1 without build-id. Module libdovecot.so.0 without build-id. Module libstats_auth.so without build-id. Module auth without build-id. Stack trace of thread 2084981: #0 0x00007f824e28e824 pthread_rwlock_rdlock(a)GLIBC_2.2.5 (libc.so.6 + 0x8e824) #1 0x00007f824de312d9 CRYPTO_THREAD_read_lock (libcrypto.so.3 + 0x2312d9) #2 0x00007f824de1ea57 ossl_lib_ctx_get_data (libcrypto.so.3 + 0x21ea57) #3 0x00007f824de2d460 ossl_provider_deregister_child_cb (libcrypto.so.3 + 0x22d460) #4 0x00007f824de1e960 OSSL_LIB_CTX_free (libcrypto.so.3 + 0x21e960) #5 0x00007f824d8d4801 legacy_teardown (legacy.so + 0x7801) #6 0x00007f824de2ebfd ossl_provider_free (libcrypto.so.3 + 0x22ebfd) #7 0x00007f824ddf535b evp_cipher_free_int (libcrypto.so.3 + 0x1f535b) #8 0x00007f824e4cd46c SSL_CTX_free (libssl.so.3 + 0x3d46c) #9 0x00007f824e7852f5 ldap_int_tls_destroy (libldap.so.2 + 0x3d2f5) #10 0x00007f824e9ddbde _dl_fini (ld-linux-x86-64.so.2 + 0x5bde) #11 0x00007f824e2400c5 __run_exit_handlers (libc.so.6 + 0x400c5) #12 0x00007f824e24024e exit (libc.so.6 + 0x4024e) #13 0x00007f824e229255 __libc_start_call_main (libc.so.6 + 0x29255) #14 0x00007f824e229309 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x29309) #15 0x000055b07d5c7675 _start (auth + 0x18675) ELF object binary architecture: AMD x86-64 As you can see, it seems to be crashing in the exit-handlers. Anyway, I thought I should report the crash I was observing. Thank you -- Anthony Carrico

2 4

Error: /proc/self/status is larger than expected
by Elisamuel Resto Donate 06 Apr '23

06 Apr '23

Hello, Writing to get some insight as to how I might rid myself of a the pesky error message on the subject. Every binary throws out that error, every LMTP delivery... basically every time any dovecot binary is executed. I am unsure if this is configuration related or not, but intuition says it is an issue with a kernel feature or compiler issue. I saw the error message in the source code (file ), but I don't understand enough of the dovecot architecture or what the code itself is doing in this case. Below and excerpt of a few lines of logs. Since I don't know what specifically this would relate to (and I don't quite remember the command to send the "safe" version of the configuration), I am sending this message in hopes that whatever is needed can be asked and I will provide it. Regards, -Sam [... postfix and rspamd output...] Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: from=<list(a)someml.tld>, size=12064, nrcpt=1 (queue active) Mar 20 22:17:02 gaia postfix/smtpd[18941]: disconnect from some.list.server[1.2.3.4] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: lmtp(18954): Connect from local Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: message repeated 2 times: [ lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected] Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: sieve: msgid=<84cf4a75-db54-f33c-cea2-f4772cd182d8(a)samresto.dev>: fileinto action: stored mail into mailbox 'Lists/Folder' Mar 20 22:17:02 gaia dovecot: lmtp(sam(a)samresto.dev)<18954><vbRKLa4hGWQKSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia dovecot: indexer-worker(sam(a)samresto.dev)<18956><vbRKLa4hGWQKSgAAw1YR2w:RtkiMa4hGWQMSgAAw1YR2w>: Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/lmtp[18943]: 4PgcGQ33LfzdT4h: to=<sam(a)samresto.dev>, relay=wyvern.samresto.dev[private/dovecot-lmtp], delay=0.4, delays=0.31/0/0.01/0.07, dsn=2.0.0, status=sent (250 2.0.0 <sam(a)samresto.dev> vbRKLa4hGWQKSgAAw1YR2w Saved) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Disconnect from local: Logged out (state=READY) Mar 20 22:17:02 gaia dovecot: lmtp(18954): Error: /proc/self/status is larger than expected Mar 20 22:17:02 gaia postfix/qmgr[21403]: 4PgcGQ33LfzdT4h: removed

6 11

Email not working
by Michael Hooker 05 Apr '23

05 Apr '23

Hi, First of all may I say I am not an expert on Dovecot so please forgive me if the answer to my query is obvious. After upgrading from Ubuntu 20.04 to 22.04 my email is not working. root@mail:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-60-generic x86_64 Ubuntu 22.04.1 LTS # Hostname: mail.odysseytours.nz auth_debug = yes auth_mechanisms = plain login auth_username_format = %{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} listen = *, :: mail_debug = yes mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap lmtp sieve pop3" service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = blocking=no driver = passwd } root@mail:~# doveadm user -f 'username' '*' nobody mike systemd-coredump sogo vmail mlmmj iredadmin iredapd snapd-range-524288-root snap_daemon Error: auth-master: userdb list: User listing returned failure Fatal: user listing failed root@mail:~# doveadm index -A -q \* doveadm(nobody): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=65534(nobody) egid=65534(nogroup)) doveadm(systemd-coredump): Error: mkdir(//mail/.imap) failed: Permission denied (euid=999(systemd-coredump) egid=999(systemd-coredump) missing +w perm: /, dir owned by 0:0 mode=0755) doveadm(snapd-range-524288-root): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=524288(snapd-range-524288-root) egid=524288(snapd-range-524288-root)) doveadm(snap_daemon): Error: mkdir(/nonexistent/mail/.imap) failed: Permission denied (euid=584788(snap_daemon) egid=584788(snap_daemon)) doveadm(3015804): Error: auth-master: userdb list: User listing returned failure doveadm: Error: Failed to iterate through some use Contents of /etc/dovecot/conf.d/10-auth.conf with all comments removed: auth_username_format=%{if;%d;eq;mail.odysseytours.nz;%Ln;%Lu} #https://serverfault.com/questions/260488/dovecot-user-lookup-fails-when-using-usernamedomain-format auth_mechanisms = plain login !include auth-system.conf.ext Contents of /etc/dovecot/conf.d/auth-system.conf.ext with all comments removed: passdb { driver = pam } userdb { driver = passwd ##https://doc.dovecot.org/configuration_manual/authentication/passwd/#authentication-passwd args = blocking=no } It says "Authentication failure (Password mismatch?)" but its definitely the correct password. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address Don't know what this error means. root@mail:/home/mike# doveadm log errors Feb 22 02:43:48 Error: auth: passwd(postmaster(a)odysseytours.nz): getpwnam() failed: Address family not supported by protocol Don't know what this error means. Any help would be greatly appreciated.

2 1

Wildcard delivery from Postfix to Dovecot LDA issues
by EML 01 Apr '23

01 Apr '23

[apologies for postfix/dovecot cross-post] How, exactly, do postfix and dovecot communicate when postfix attempts to determine whether to deliver a message to the dovecot LDA, or to bounce it? In other words, how does postfix decide to bounce foo, and deliver bar, in these log messages: postfix/pipe[11857]: 933BCA071A: to=<foo(a)example.com>, relay=dovecot, ... status=bounced (user unknown) postfix/pipe[12266]: 8AD51A071A: to=<bar(a)example.com>, relay=dovecot, ... status=sent (delivered via dovecot service) The reason I ask is that the obvious answer with the main.cf setup doesn't appear to be sufficient, and dovecot appears to check whether or not the recipient exists in the userdb passwd file before allowing delivery. I have postfix set up for virtual hosts, as follows: virtual_mailbox_domains = example.com, sub.example.com virtual_mailbox_maps = hash:/var/www1/vdomains virtual_transport = dovecot where vdomains contains: bar(a)sub.example.com example.com/test/ bar(a)example.com example.com/test/ @sub.example.com example.com/test/ @example.com example.com/test/ postfix will deliver to bar(a)example.com, but not foo(a)example.com. I can't deliver anything to the subdomain. The interesting thing is that 'bar' already has a dovecot mailbox (the 'test' mailbox), but 'foo' doesn't. If this is correct, how do I do wildcard deliveries to dovecot, particularly for the subdomain?

2 2

Dovecot error invalid service_fd
by Michel Verdier 30 Mar '23

30 Mar '23

Hi all On debian stable, dovecot 2.3.13+dfsg1-2+deb11u1 and postfix 3.5.17-0+deb11u1 I set postfix sending mails to dovecot for mailbox storage: mailbox_transport = lmtp:unix:private/dovecot-lmtp dovecot listen with lmtp: service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { mode = 0666 user = postfix group = postfix } } passdb { driver = pam args = session=yes cache_key=%u%r%l dovecot } userdb { driver = passwd } # ls -l /var/spool/postfix/private/dovecot-lmtp srw-rw-rw- 1 postfix postfix 0 27 mars 11:24 /var/spool/postfix/private/dovecot-lmtp I get logs like this: postfix/lmtp[271076]: 6DB551008B3C1: to=..., relay=...[private/dovecot-lmtp], delay=0.7, delays=0.29/0.04/0.11/0.26, dsn=2.0.0, status=sent (250 2.0.0 ... postfix/qmgr[197419]: 6DB551008B3C1: removed dovecot: lmtp(271077): Disconnect from local: Client has quit the connection (state=READY) dovecot: log(253615): Error: Received master input for invalid service_fd 27: 27 271079 BYE I identify 271079 as the pid for dovecot auth worker process. If I add a timeout in dovecot: service auth-worker { idle_kill = 10s } Then I see error log coming 10 seconds after the end of every lmtp connexion from postfix. There is no other log messages around even with debug enable in dovecot. And mails are correctly delivered. Am I missing something or is this to be ignored? Cheers

1 0

Dovecot submission proxy constraints
by Peter Wienemann 29 Mar '23

29 Mar '23

Dear Dovecot experts, in 2017 Stephan Bosch mentioned in an email about the Dovecot submission proxy [0]: "The current implementation does require that the proxy has direct access to the user's mailbox for BURL (e.g. by running it on the same host as imap), but that restriction should be resolved soon, allowing for more complex setups." Is the mentioned restriction (access to mailbox) still valid in 2023 or has this constraint been lifted in the meantime? Best regards, Peter [0] https://dovecot.org/pipermail/dovecot/2017-December/110282.html

1 0

How to use dovecot with more recent versions of solr (8x, 9x)?
by jkdv＠w3.org 27 Mar '23

27 Mar '23

Hello, dovecot version 2.3.13 (89f716dc2) The dovecot solr installation guide [1] gives links and configuration info for sorl 7.7.0. However, sorl was deprecated some time ago. Those links to 7.7.0 don't work anymore. Sorl is currently available in versions 8.11.2 and 9.1.1 [3]. Specifically, one section in the guide states [2]: [[ Install schema.xml and solrconfig.xml Copy doc/solr-config-7.7.0.xml and doc/solr-schema-7.7.0.xml (Since Dovecot 2.3.6+) to /var/solr/data/dovecot/conf/ as solrconfig.xml and schema.xml. The managed-schema file is generated based on schema.xml. ]] Could someone confirm me if those 7.7.0 configuration files are compatible with 8.11.2? A diff between those files and the ones from the 8.11.2 dist reveal some changes, starting from the LuceneVersion. If they are not compatible, could someone tell me what changes were done in the doc/solr files that need to be replicated in the 8.x and 9.x versions? The doc is very opaque there as it only states that you should replace those files but doesn't go into details as to why, making it confusing on how to upgrade to a new version of solr. It would be great if the dovecot/solr doc page could be upgraded to reflect the new versions of solr. Thanks in advance for your help, --jose [1] https://doc.dovecot.org/configuration_manual/fts/solr/ [2] https://doc.dovecot.org/configuration_manual/fts/solr/#solr-configuration [3] https://downloads.apache.org/lucene/solr/

2 1

doveadm expunge unnecessarily tries to access TLS key
by Jesper Dybdal 27 Mar '23

27 Mar '23

I have just upgraded my Debian Buster (Dovecot 2.3.4, I think it was) to Bullseye (Dovecot 2.3.13). The Dovecot server works fine, which of course is the really important thing. But I have a cron job that cleans up all old mail from the mailbox that I use for my mobile phone by running "doveadm expunge" every night. That worked fine in 2.3.4, but now it fails: > jdmobile@nuser:~$ doveadm expunge mailbox '*' before 25d > doveconf: Fatal: Error in configuration file > /etc/dovecot/conf.d/10-ssl.conf line 23: ssl_cert: Can't open file > /etc/letsencrypt/live/nuser.dybdal.dk/fullchain.pem: Permission denied Of course, doveadm cannot access the TLS key when running as a normal user. But why should it try to access that key at all when I have just asked it to clean up my own files in my own Maildir? Is there a way to make it not try to access that key and do its job anyway? Or another way to delete old mail? (I could give it a "-u jdmobile" option and run it as root - but I really like to run things like that as a non-privileged user, so I won't make a stupid mistake that destroys the wrong mailbox.) Thanks, Jesper -- Jesper Dybdal https://www.dybdal.dk

2 2