- dovecot - dovecot.org

doveadm sending invalid AUTHENTICATE to uw-imap
by Chris Candreva 23 Feb '23

23 Feb '23

I'm migrating a legacy uw-imap system to Dovecot, on a Rocky (RHEL) 8 server running Dovecot 2.3.16-3 from their repos. I am using a master user to import all users for an imaps connection from the old server to the new. On a trial run however, it worked for about half the users. Half are giving an error of the form: dsync(user): Error: imapc(host:993): Command '1 AUTHENTICATE PLAIN xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' failed with BAD: 1 Missing or invalid argument to AUTHENTICATE I can't seem to get the IMAP command for the users that did work. However, on the face of it, that is an invalid AUTHENTICATE command. If I take that string and brake it up into (what I've googled is) the proper form of multi-command form of 1 AUTHENTICATE PLAIN + xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx then the login succeeds. I have not been able to find anyone else with this problem in my search. Is this a known issue, is there a way to force the multi-line AUTHENTICATE, something else I'm missing ? Any help is appreciate on this! -Chris -- --- ======================================================================== Chris Candreva -- chris(a)westnet.com -- http://www.westnet.com/~chris

3 4

Redundant Database, Pgsql ?
by Paul Kudla 23 Feb '23

23 Feb '23

I am aware that there are provising for redundant database connections Basically i was working on my main db server (which is also a mail sever) I current have this in the dovecot-pgsql.conf ______________________________________________________________________ driver = pgsql connect = host=localhost port=5433 dbname=scom_billing user=pgsql password=xxxxxxxxx default_pass_scheme = PLAIN password_query = SELECT username as user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' user_query = SELECT home, uid, gid FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' #iterate_query = SELECT user, password FROM email_users WHERE username = '%u' and password <> 'alias' and status = True and destination = '%u' iterate_query = SELECT "username" as user, domain FROM email_users WHERE status = True and alias_flag = False _______________________________________________________________________ Basically I have replicaed servers all over the place but mail18 (because dovecot only knows of one db instance) went down as well. May I please get some guidance on what to add to talk to another postgresql server (i have 6 replicated servers so would probably want a couple worst case issue) -- Happy Sunday !!! Thanks - paul Paul Kudla Scom.ca Internet Services <http://www.scom.ca> 004-1009 Byron Street South Whitby, Ontario - Canada L1N 4S3 Toronto 416.642.7266 Main 1.866.411.7266 Fax 1.888.892.7266 Email paul(a)scom.ca

10 13

Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?
by mailinglist-subscriptions 23 Feb '23

23 Feb '23

Hi, I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for managing virtual accounts. I'd like to start using the mail-crypt plugin. However, I'm having a bit some difficulty understanding the documentation at https://doc.dovecot.org/configuration_manual/mail_crypt_plugin to reach my goal. I plan to ask questions about those issues by starting new threads in this mailing list. But before I even come to that, I'd like to investigate the following: The above documentation only addresses a clean install and doesn't seem to mention encrypting already existent unencrypted mails, like my server has. Is it possible to encrypt those before I start using the mail-crypt plugin, such that it will be able to decrypt those messages as well? If it is, I am assuming that how I would go about achieving that will be very dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). So I don't expect a full-fledged guide. However, if you could perhaps give a general overview of what would be needed to achieve this, I would very much appreciate that. Thank you.

4 4

Re: Auth-worker, unknown scheme ARGON2ID
by James Brown 22 Feb '23

22 Feb '23

On 21 Feb 2023, at 10:12 pm, James Brown <jlbrown(a)bordo.com.au> wrote: > > The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: > > Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) > Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID > > ./configure --with-ssl=openssl --with-mysql > > Was what I used to compile. > > Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. > > (Have also installed libsodium 1.0.18_1) > > Any help would be most appreciated. > > thanks, > > James. I’ve spent ages on this and am getting really desperate! :-( CPPFLAGS=-I/opt/homebrew/Cellar/openssl(a)3/3.0.8/include LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl --with-mysql ... Install prefix . : /usr/local File offsets ... : 64bit I/O polling .... : kqueue I/O notifys .... : kqueue SSL ............ : yes (OpenSSL) GSSAPI ......... : no passdbs ........ : static passwd passwd-file pam checkpassword sql : -shadow -bsdauth -ldap userdbs ........ : static prefetch passwd passwd-file checkpassword sql sudo doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 How do I get ARGON2I, ARGON2ID in that list? Has anybody got Dovecot to work on recent macOS with these password schemes? Any hints? Thanks, James.

2 8

Auth-worker, unknown scheme ARGON2ID
by James Brown 21 Feb '23

21 Feb '23

On my current mail server I was able to upgrade everyone’s password scheme to ARGON2ID with no issues, I just had to have: service auth { vsz_limit = 0 } This was an older version of macOS than the new server I’m trying to migrate to. The new one has Dovecot compiled with same configure options, same configuration files, but fails to authenticate: Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): auth-worker<1>: sql(jlbrown@bordo.com.au,::1,<bRgbkDP2udEBAAAAAAAAAAAAAAAAAAB>): Unknown scheme ARGON2ID ./configure --with-ssl=openssl --with-mysql Was what I used to compile. Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura. (Have also installed libsodium 1.0.18_1) Any help would be most appreciated. thanks, James.

1 0

service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument macOS
by James Brown 21 Feb '23

21 Feb '23

I fixed the issue with Dovecot not starting on macOS Ventura by adding this to 10-master.conf: service log { vsz_limit = 0 } But now when I try to login via Imap on port 143 I get the same error for imap-login: Feb 20 15:55:41 imap-login: Error: Feb 20 15:55:41 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 15:55:41 imap-login: Fatal: master: service(imap-login): child 11781 returned error 89 (Fatal failure) Feb 20 15:55:41 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Feb 20 16:13:04 imap-login: Error: Feb 20 16:13:04 service(imap-login): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 16:13:04 imap-login: Fatal: master: service(imap-login): child 20370 returned error 89 (Fatal failure) Feb 20 16:13:04 master: Error: service(imap-login): command startup failed, throttling for 60.000 secs Config: sudo /usr/local/sbin/dovecot -n # 2.3.20 (80a5ac675d): /usr/local/etc/dovecot/dovecot.conf # OS: Darwin 22.3.0 arm64 apfs # Hostname: mail-server-mac-studio.local auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes default_internal_group = mail default_internal_user = _dovecot default_login_user = _dovenull first_valid_gid = 0 first_valid_uid = 102 last_valid_gid = 501 last_valid_uid = 105 log_path = /var/log/dovecot.log mail_gid = 102 mail_location = maildir:/usr/local/virtual/%d/%u mail_uid = 102 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = _postfix mode = 0660 user = _postfix } unix_listener auth-userdb { mode = 0660 user = _vmail } } service imap-login { vsz_limit = 0 } service log { vsz_limit = 0 } ssl_cert = </etc/letsencrypt/live/mail.bordo.com.au/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 40 } Quitting Dovecot and restarting and I now get: Feb 20 17:01:11 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for imap, pop3 (core dumps disabled) Feb 20 17:01:11 master: Error: service(anvil): command startup failed, throttling for 2.000 secs Then trying to connect on port 143 log says: Feb 20 17:20:08 master: Error: service(config): command startup failed, throttling for 2.000 secs Feb 20 17:20:08 config: Error: Feb 20 17:20:08 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 anvil: Fatal: master: service(anvil): child 43250 returned error 89 (Fatal failure) Feb 20 17:20:08 config: Fatal: master: service(config): child 52530 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Fatal: master: service(stats): child 52531 returned error 89 (Fatal failure) Feb 20 17:20:08 stats: Error: Feb 20 17:20:08 service(stats): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:08 master: Error: service(stats): command startup failed, throttling for 2.000 secs Feb 20 17:20:10 config: Error: Feb 20 17:20:10 service(config): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Feb 20 17:20:10 config: Fatal: master: service(config): child 52532 returned error 89 (Fatal failure) Feb 20 17:20:10 master: Error: service(config): command startup failed, throttling for 4.000 secs Feb 20 17:20:10 imap-login: Fatal: Error reading configuration: read(/usr/local/var/run/dovecot/config) failed: EOF - Also failed to read config by executing doveconf: /usr/local/var/run/dovecot/config is a UNIX socket (path is from CONFIG_FILE environment) Feb 20 17:20:10 master: Error: service(imap-login): command startup failed, throttling for 2.000 secs Any suggestions? This is really driving me crazy! thanks, James.

2 1

Get correct subjects in summary but wrong article body after transitioning between servers
by Steinar Bang 19 Feb '23

19 Feb '23

I am transitioning between servers (both debian 11.6 with dovecot 2.3.13) and I'm seeing some strange behaviour after the transition: it seems like dovecot is listing the correct subject for the test messages I'm sending in what's shown in my MUA's summary. But the body of the message is an old message. Dovecot is serving messages from Maildir folders in the users' home directories. And I may have messed up some things here: I rsynced the maildirs and then still got some deliveries both places when the MX records were in transition, so I did a belated rsync, thinking that "Maildir can handle that". But I weren't thinking about the dovecot files, ie: drwx------ 2 sb sb 155648 Feb 11 06:43 cur -rw------- 1 sb sb 30 Nov 23 18:14 dovecot-keywords -rw------- 1 sb sb 116407 Feb 11 06:43 dovecot-uidlist -rw------- 1 sb sb 8 Feb 28 2022 dovecot-uidvalidity -rw------- 1 sb sb 0 Mar 17 2011 dovecot-uidvalidity.4d821095 -rw------- 1 sb sb 38016 Jan 31 15:38 dovecot.index -rw------- 1 sb sb 203852 Feb 5 21:37 dovecot.index.cache -rw------- 1 sb sb 15076 Feb 11 06:43 dovecot.index.log -rw------- 1 sb sb 6424 Feb 4 08:06 dovecot.list.index -rw------- 1 sb sb 7796 Feb 11 06:43 dovecot.list.index.log -rw------- 1 sb sb 3048 Mar 6 2022 dovecot.mailbox.log drwx------ 2 sb sb 4096 Feb 11 06:43 new -rw------- 1 sb sb 738 Mar 6 2022 subscriptions drwx------ 2 sb sb 4096 Feb 6 22:05 tmp Are there any of these that could have been adversely affected by the rsync? Will regenerating these files fix the behaviour where I get the wrong article when fetching them? What is the best way to regenerate them? Can these feil be safely deleted and will be autogenerated? (I also see that some of these files are quite old. I had another server transition in 2017, so the files from 2011 has been rsynced into that server and not touched since) Thanks! - Steinar

1 2

Roundcube <-> Dovecot timeouts under very moderate load on big Dovecot nodes
by Malte Schmidt 18 Feb '23

18 Feb '23

Due to a recent topic regarding the performance of the Roundcube webmailer with Dovecot as a backend, I set up imapproxy successfully, shrinking the response latency of the webmailer heavily, which is great. However, I still encounter strange timeouts on some requests when Roundcube tries to access Dovecot. Be it for authentication or to FETCH data. I run the tests/benchmarks via distributed JMeter from 4 nodes, they access the webmailer which in turn accesses the Dovecot via imapproxy. There are 16 different mailaccounts spread over two dovecot nodes with the first one acting as a proxy if the account resides on the second. The problems start at around 100 concurrent users and gets worse the more users are added. The timeouts make up for a small percentage of the requests (0.0something percent). The timeout is reached after 30 seconds of Dovecot not answering, due to the timeout set in the webserver the webmailer is running on. Now I am wondering how to further debug this and what could be the reason. Some requests towards Dovecot are certainly taking longer than 30 seconds, while the average request takes mostly less than 1. The Dovecot is running on two big hardware machines with 48 cores, 96G memory and SSD storage. The load on the Dovecot nodes while the test is running is minimal. Best regards, M. Schmidt

1 0

dovecot_login accepts blank password for exim smtp auth
by Jeff Rogers 18 Feb '23

18 Feb '23

Hi all, I recently discovered a configuration issue on my system where a system user account had a blank rather than invalid or disabled password in the passwd/shadow database. The user could not be logged into through login/telnet/ssh because it was marked as a system account (uid < 100). Dovecot also would not authenticate the user for the same reason. However, I'm using exim using dovecot_login for authentication, and that would authenticate the user with a blank and allow me to be used as an open relay. This is clearly a config issue on my part (since fixed), but should dovecot_login guard against blank passwords or system users just as a normal login does? I'm running dovecot 2.2.36 (1f10bfa63) Exim version 4.96 I don't know which software supplies the dovecot_login connenector. The SMTP session would include AUTH LOGIN 334 VXNlcm5hbWU6 cG9zdGZpeA== 334 UGFzc3dvcmQ6 <-- nothing, just a return here 235 Authentication succeeded DONE

2 1

Special authentication use case
by Philippe MARASSE 17 Feb '23

17 Feb '23

Folks, I'm trying to configure dovecot SASL with two use cases : - First with XOAUTH2 : I've managed to get it working, pretty right out of the box, developers have done a great job :-) - Second with Client TLS Certificate with no luck. Let me explain, the certificate brought by the client does not have any clue of associated email, I have to check that username (=email) sent by the client is really related to some information included in the certificate (I have to extract the OU and then lookup into a table of authorized mails for that OU). Is it possible to do that with dovecot ? I think yes but I'm looking for direction to achieve that. Lua maybe ? Our configuration : - OS : Debian 11 $ /usr/sbin/dovecot --version 2.3.13 (89f716dc2) Regards. -- Philippe MARASSE Responsable pôle Infrastructures - DSIO Centre Hospitalier Henri Laborit CS 10587 - 370 avenue Jacques Cœur 86021 Poitiers Cedex Tel : 05.49.44.57.19

1 1

Re: SOLVED: Re: Dovecot does not start on MacOS 12.01, and now 13.2.1 - RLIMIT_DATA
by James Brown 17 Feb '23

17 Feb '23

Sorry, replying to an old thread found on mail-archive.com <http://mail-archive.com/>, so it’s not threaded email. https://www.mail-archive.com/dovecot@dovecot.org/msg84776.html I have just installed Dovecot onto Mac Studio running Ventura (macOS 13.2.1) and get the same error with Dovecot 2.3.20: service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): Invalid argument Adding the ’service log’ stanza to 10-master.conf fixed the issue. Is this still the correct way to handle it? If so it would be great to have it documented somewhere. Just lucky I found the above mail thread. Thanks, James. Hi! That solution is bit overly broad way to solve this, I would instead recommend service log { vsz_limit = 0 } so that only service log is affected. Aki > On 31/10/2021 20:36 Don Feliciano <don.felici...(a)icloud.com> wrote: > > > > A kind person who isn’t on the mailing list share the solution to this with > me: > > default_vsz_limit = 0 > > > > On Oct 28, 2021, at 12:12 PM, Don Feliciano <don.felici...(a)icloud.com> > > wrote: > > > > > > Warning: fd limit (ulimit -n) is lower than required under max. load (256 < > > 1000), because of default_client_limit > > Oct 28 12:08:48 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > Invalid argument > > > > > > > On Oct 27, 2021, at 11:08 AM, Don Feliciano <don.felici...(a)icloud.com> > > > wrote: > > > > > > I've been happily running Dovecot on my Mac for many years (installed via > > > Homebrew). After upgrading to Monterey (MacOS 12.01), it no longer starts: > > > > > > $ sw_vers > > > ProductName: macOS > > > ProductVersion: 12.0.1 > > > BuildVersion: 21A559 > > > > > > $ uname -a > > > Darwin dfelicia-mac 21.1.0 Darwin Kernel Version 21.1.0: Wed Oct 13 > > > 17:33:23 PDT 2021; root:xnu-8019.41.5~1/RELEASE_X86_64 x86_64 > > > > > > $ sudo dovecot -F > > > Oct 27 10:11:18 service(log): Fatal: setrlimit(RLIMIT_DATA, 268435456): > > > Invalid argument

1 0

Could not override "mail_location" with "userdb_mail" statment in "/etc/passwd"
by Xavier 17 Feb '23

17 Feb '23

Hi, ** Using Dovecot 2.2.22 and Postfix 3.1.0 ** I plan to migrate all accounts on my server from mbox to maildir storage but before i want to make some tests on dedicated accounts. To do so i want to overide the general "mail_location" ( mail_location = mbox:~/mail:INBOX=/var/mail/%u ) with "maildir:~/Maildir" only for some test accounts. To do so i modified my "/etc/passwd" file using something like that : testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false:userdb_mail=maildir:~/Maildir Also tried testm2m_mydomain.tld:x:2122:2122::/home/mail/testm2m_mydomain.tld:/bin/false::userdb_mail=maildir:~/Maildir And as mentioned in the doc (https://wiki.dovecot.org/LDA/Postfix) i added -d "$USER" in my Postfix "mailbox_command" but it don't seem to work (my new mail_location for this test user is is not taken into account). When i try to make an "doveadm user testm2m_mydomain.tld" i get this : 8<-------------------------------- field value uid 2122 gid 2122 home /home/mail/testm2m_mydomain.tld mail mbox:~/mail:INBOX=/var/mail/testm2m_mydomain.tld system_groups_user testm2m_mydomain.tld 8<-------------------------------- My modification is not taken into account ... Any help is welcome ! /Xavier

2 4

dovecot director how to obtain hashed
by tomate aceite 16 Feb '23

16 Feb '23

Morning again! Working with my directors node. Does anybody now how to obtain a list of all users hashes? I know how to obtain for one user example: *doveadm director status user@domain* I am looking to a way or command to take a list of hashed epired (1)#: doveadm director status manolito@mydomain > Current: 10.X.X.108 (expires 2023-02-17 12:17:59) > Hashed: 10.X.X.108 > Initial config: 10.X.X.108 > Where are stored the hashed ? To lock for the info , etc... Thanks in advance!!!

1 0

Error: Broken file dovecot-uidlist
by Sohin Vyacheslav 16 Feb '23

16 Feb '23

Hi All, In mail.log are exists error messages "Error: Broken file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot-uidlist line XX: Invalid data: for some email accounts. For example, dovecot-uidlist line 21197: Invalid data: When I open line 21197 in editor: # vim +21197 dovecot-uidlist 1750207 :1676454069.M698819P4439.mail-b,S=963716,W=976359 and then check this file size # ls -l /data/mail/vhosts/domain.com/user@domain.com/Maildir/cur/1676454069.M698819P4439.mail-b,S=963716,W=976359:2,S -rw------- 1 vmail vmail 963716 Feb 15 10:41 I see that size is the same: 963176 bytes. So what exactly mentioned in error message "dovecot-uidlist line 21197: Invalid data:"? -- Best wishes Sohin Vyacheslav

3 6

Corrupted sizes in cache once again
by Tim Evers 15 Feb '23

15 Feb '23

Hi, I run a fairly large Dovecot Installation (around 100k mailboxes) on several servers. gzip compression is on. Every once in a while I get the dreaded "cache corruption" messages in the log: Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3868: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674129792.M797543P21755.node2,S=8099,W=8276:2,)) failed: Cached message size smaller than expected (2877 < 8099, box=INBOX, UID=3868) Error: Corrupted record in index cache file /[redacted]/Maildir/dovecot.index.cache: UID 3875: Broken physical size in mailbox INBOX: read(zlib(/[redacted]/Maildir/cur/1674212201.M985809P29112.node2,S=13907,W=14121:2,)) failed: Cached message size smaller than expected (5533 < 8192, box=INBOX, UID=3875) The first entry shows 2877 (size on disk) vs. 8099 (real size unzipped, also in the filename: S=8099). The second entry shows 5533 (size on disk) vs. 8192 - this is not correct in any way. Size on disk is 13907 as noted in the filename. Both mails were delivered trough LMTP and retrieved by the POP3 service. Anyone with an idea what might be happening here? I've read all available info in the doc and in the previous discussions / bug reports, but nothing seems to match my case. And where does that 8192 come from - it looks suspicious? Version is 2.3.7.2 (Ubuntu 20.04) doveconf -n excerpt: protocol lmtp { mail_plugins = " old_stats mail_log notify zlib sieve quota" } protocol imap { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib imap_old_stats quota imap_quota imap_sieve" } protocol pop3 { mail_max_userip_connections = 50 mail_plugins = " old_stats mail_log notify zlib" } Tim

5 12

Error: Corrupted index cache file
by Sohin Vyacheslav 15 Feb '23

15 Feb '23

Hi All, In mail.log exists an error messages "Error: Corrupted index cache file /data/mail/vhosts/domain.com/user(a)domain.com/Maildir/dovecot.index.cache: invalid record size" for some accounts. I tried these steps to fix it: 1. Running commands # doveadm -D -v index -u user(a)domain.com INBOX # doveadm -v force-resync -u user(a)domain.com INBOX after this I saw that the following files are updated in ../Maildir/: dovecot.index.cache dovecot.index.log dovecot-uidlist But after some time error messages occurred again. 2. Added NFS mount option 'nordirplus' to /etc/fstab with remount /data partition, add 'mmap_disable = yes' and 'mail_fsync = always' to 10-mail.conf as advised on https://doc.dovecot.org/configuration_manual/nfs/ (because /data partition mounted via NFS); 3. Renaming 3 files with/without Dovecot service pre-stop. # mv dovecot.index old.dovecot.index # mv dovecot.index.cache old.dovecot.index.cache # mv dovecot.index.log old.dovecot.index.log Unfortunately, all done steps didn't fix issue. What is the proper way to fix corrupted index cache errors? dovecot package: 1:2.2.33.2-1ubuntu4.8 (Ubuntu-18.04). p.s. for some of email accounts also exists error messages "Error: Broken file ../Maildir/dovecot-uidlist line ###: Invalid data:" besides mentioned cache error. -- Best wishes Sohin Vyacheslav

4 7

NFS and performances
by tomate aceite 15 Feb '23

15 Feb '23

Hello, i have some question about NFS, dovecot director, and imap settings. I was reading all dovecot documentation ad mail lists, but some aspect are not clear to me. I am looking for performance / tunning my infra to work in a more efficient way because we experiences some issues some days ago. This is my infra: I got an infra with 2 dovecot-directors and 3 imap backend. I got all the emails stored in a common NFS share filer to all the imap nodes. ( Index are locally stored in each imap node.) My NFS mount options: (0)#: nfsstat -m /data/mail from myipaddress:/export/mail/maildirs > Flags: > rw,nosuid,noexec,noatime,vers=3,rsize=1048576,wsize=1048576,namlen=255,hard,nordirplus,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=10.0.0.205,mountvers=3,mountport=20048,mountproto=tcp,local_lock=none,addr=10.0.0.205 > *Questions*: ( https://wiki.dovecot.org/PerformanceTuning , https://doc.dovecot.org/configuration_manual/nfs/ >> i am following these steps ) 1) Is my NFS correct setup with the mount options well optimized ? Not sure if someone is using the same flags that me or got a better recomendation to used. 2) Set *mmap_disable = yes ??? * >> This must be set to yes if you store indexes to shared filesystems. In my case i got them locally in each imap node not in NFS share folder. I got setup mmap_disable = no , is this correct? I think no is the correct option here with indexes locally. because i can read here: https://wiki1.dovecot.org/NFS > > >> High performance NFS setup with indexes on local disk (see below for > benefits): > > mmap_disable = no > 3) Set* mail_fsync = always ???* Documentation: https://wiki.dovecot.org/PerformanceTuning always > > Use fsync after all disk writes. > > Recommended for NFS to make sure there aren’t any delayed write()s. > 3.a) where i can setup this option *mail_fsync = always , *because i run doveconf -n in director, and imap nodes, and they are not showing nothing. 3.b) *In which node ? *Do i need to add the setting in dovecot.conf in *director node or in imap node or in both ?* Not sure if this is the correct way: This is an attemp of setup, not sure if is correct? 0)#: doveconf -n > # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.5.13 (cdd19fe3) > # OS: Linux 5.10.0-20-amd64 x86_64 Debian 11.6 > > mail_debug = yes > mail_fsync = always > mail_max_userip_connections = 20 > mail_nfs_storage = yes > mail_plugins = " notify mail_log" > mail_privileged_group = mail > > > > protocol lmtp { > mail_fsync = always > mail_plugins = " notify mail_log sieve mail_lua push_notification > push_notification_lua" > plugin { > ... > } > 4) Do not set *mail_nfs_index *or *mail_nfs_storage* (i.e. keep them as no) ????? First option make sense but the second one not. https://doc.dovecot.org/settings/core/#core_setting-mail_nfs_storage mail_nfs_storage >>> >>> Default: no >>> >>> Values: Boolean >>> >>> Flush NFS caches whenever it is necessary to do so. >>> >> > This setting should only be enabled if you are using multiple servers > on NFS. > So should be possible to enable this option *mail_nfs_storage = yes ?????* 4) I got this setting in *dovecot-sql.conf ( director ) * driver = mysql > connect = host=myserver.X dbname=maildb user=dovecot > password=XXXXXXXXXXXXXXXX > default_pass_scheme = SHA > password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > user_query = select home, maildir as mail, uid, gid from mailbox left join > aliases on aliases.systemid = aliasid where login = '%u' and inactive = 0; > iterate_query = select distinct login as user from mailbox; > I would like to implement * ITERINDEX* and probably *VOLATILEDIR *but not sure if this is the correct change or if i need to change something into the database. from: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login) as userdb_mail from mailbox > left join aliases on aliases.systemid = aliasid where login = '%u' and > inactive = 0; > to: password_query = select login as user, crypt_sha1 as password, home as > userdb_home, uid AS userdb_uid, gid AS userdb_gid, > concat(maildir,':INDEX=/data/indexes/',login,':ITERINDEX',':VOLATILEDIR=/tmp/%2.256Nu/%u',login) > as userdb_mail from mailbox left join aliases on aliases.systemid = aliasid > where login = '%u' and inactive = 0; > But not sure if is working correctly, * i checked debuging* in my imap node in this way: auth_verbose = yes > auth_verbose_passwords = no > auth_debug = yes > auth_debug_passwords = yes > mail_debug = yes > verbose_ssl = yes > This is the output log: Feb 15 09:32:53 my-imap-server dovecot: auth: Debug: sql(manolo1(a)mydomain,10.X.X.109,<eWEh7bj09N4KAjxt>): cache hit: {SHA}8376922a27e83b9eadcdec3596a70bf6c4db5730#011user=manolo1@mydomain #011userdb_home=/data/mail/tmydomain/users/manolo1#011userdb_uid=700#011userdb_gid=700#011userdb_mail=/data/mail/mydomain/users/manolo1/Maildir/:INDEX=/data/indexes/manolo1@mydomain :ITERINDEX:VOLATILEDIR=/tmp/3a/manolo1@mydomain *Not sure if is correct the output or should i need to change something into the database or this change only afect locally?* 5) *mailbox_list_index = yes ???* Mailbox list indexes can be used to optimize IMAP STATUS commands. They are > also required for IMAP NOTIFY extension to be enabled. > *It is this option necesary to add? in order to work with ITERINDEX option ?* https://www.mail-archive.com/dovecot@dovecot.org/msg75035.html ( i see your answer to this post ) 6) *What is the best way to do a maintenance in a backend?* The last time i flushed all the user in a director from a backend node to do a maintenance, after the maintenance done i rebalanced the director cluster, but the next day when user started tp connect we got high peak I/O , etc with a lot of problems, because new users in this backend node were re-indexes o creating new indexes. *Are there any way to do in a safer way? *Without loosing the hashed for the directors nodes. Thanks in advance!!!!!!!

3 2

Hide local IP from non delivery notifications
by Claudio Corvino 15 Feb '23

15 Feb '23

Hi everyone, I have an external MTA configured with Postfix that delivers email to an internal IMAP/LMTP Dovecot server configured to bind an LDAP to check if users exist. If the user does not exist, my MX sends a non delivery notification, and into the e-mail there's the local IP address of the Dovecot server. I can't find a way to remove or hide that IP, here is an example of line that contains the IP (with X) that I would like to hide/remove: *"The mail system<user@domain>: host hostname.domain.com <http://hostname.domain.com>[XXX.XXX.XXX.XXX] said: 550"* Thanks in advance! Cheers -- Claudio

5 6

crash when trying to upgrade from 2.0.x to 2.3.x
by Eugene M. Zheganin 15 Feb '23

15 Feb '23

Hello, I'm trying to migrate dovecot mail database from 2.0.9 on Linux to 2.3.20 on FreeBSD. I've rsync'd the entire database, grabbed all the configs, changed the paths and permission, but when trying to access the mail from Thunderbird I have reproducible crash in the logs: ===Cut=== Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: mysql(localhost): Finished query 'SELECT maildir, 1143 AS uid, 1143 AS gid FROM mailbox WHERE username = 'zheganin-em(a)alamics.ru' AND active = '1'' in 0 msecs Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth-worker(6378): Debug: conn unix:auth-worker (uid=143): auth-worker<16>: Finished Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: sql(zheganin-em(a)alamics.ru,192.168.57.177,<oE2zjKn0FTXAqDmx>): Finished userdb lookup Feb 14 17:12:10 it-r-support dovecot[5888]: auth: Debug: master userdb out: USER 1282408449zheganin-em(a)alamics.ru maildir=alamics.ru/zheganin-em/ uid=1143 gid=1143 auth_mech=PLAIN auth_token=15cceab95e1251ea97a8e5ff62c70d1b7a76c96f Feb 14 17:12:10 it-r-support dovecot[5888]: imap-login: Login: user=<zheganin-em(a)alamics.ru>, method=PLAIN, rip=192.168.57.177, lip=172.16.11.13, mpid=6405, session=<oE2zjKn0FTXAqDmx> Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Feb 14 17:12:10 it-r-support dovecot[5888]: imap(zheganin-em(a)alamics.ru)<6405><oE2zjKn0FTXAqDmx>: Fatal: master: service(imap): child 6405 killed with signal 6 (core dumped) ===Cut=== There's an older thread here mentioning that probably doveadm force-resync would help, but it doesn't fix this. Is there something that could be done here ? I've also reported this in the FreeBSD bugtracker, but just in case decided to ask here too. Backtrace: ===Cut=== # lldb /usr/local/libexec/dovecot/imap --core imap-6404.core (lldb) target create "/usr/local/libexec/dovecot/imap" --core "imap-6404.core" Core file '/var/cores/imap-6404.core' (x86_64) was loaded. (lldb) bt * thread #1, name = 'imap', stop reason = signal SIGABRT * frame #0: 0x000000001151133a libc.so.7`__sys_thr_kill + 10 frame #1: 0x0000000011489c74 libc.so.7`__raise + 52 frame #2: 0x000000001153b109 libc.so.7`abort + 73 frame #3: 0x000000001137a336 libdovecot.so.0`___lldb_unnamed_symbol5855 + 150 frame #4: 0x0000000011378ad1 libdovecot.so.0`___lldb_unnamed_symbol5844 + 49 frame #5: 0x0000000011379881 libdovecot.so.0`___lldb_unnamed_symbol5846 + 33 frame #6: 0x0000000011378ceb libdovecot.so.0`i_panic + 187 frame #7: 0x000000001136a514 libdovecot.so.0`array_idx_modifiable_i + 100 frame #8: 0x0000000012054a78 lib20_fts_plugin.so`fts_user_autoindex_exclude + 72 frame #9: 0x0000000012051b3b lib20_fts_plugin.so`fts_mailbox_allocated + 267 frame #10: 0x000000001113ad0b libdovecot-storage.so.0`hook_mailbox_allocated + 155 frame #11: 0x0000000011134491 libdovecot-storage.so.0`mailbox_alloc + 449 frame #12: 0x0000000001044311 imap`cmd_select_full + 353 frame #13: 0x000000000104cd92 imap`command_exec + 178 frame #14: 0x000000000104b64a imap`___lldb_unnamed_symbol1265 + 58 frame #15: 0x000000000104b7b6 imap`___lldb_unnamed_symbol1265 + 422 frame #16: 0x000000000104a151 imap`client_handle_input + 465 frame #17: 0x00000000010488a8 imap`client_input + 120 frame #18: 0x00000000113936df libdovecot.so.0`io_loop_call_io + 111 frame #19: 0x0000000011396214 libdovecot.so.0`io_loop_handler_run_internal + 388 frame #20: 0x0000000011393dea libdovecot.so.0`io_loop_handler_run + 378 frame #21: 0x0000000011393c28 libdovecot.so.0`io_loop_run + 88 frame #22: 0x00000000112f6208 libdovecot.so.0`master_service_run + 24 frame #23: 0x000000000105af67 imap`main + 1383 frame #24: 0x000000000103c11d imap`_start + 269 (lldb) ===Cut=== Same backtrace in GDB: ===Cut=== # gdb /usr/local/libexec/dovecot/imap --core imap-6404.core GNU gdb (GDB) 12.1 [GDB v12.1 for FreeBSD] Copyright (C) 2022 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-portbld-freebsd13.1". Type "show configuration" for configuration details. For bug reporting instructions, please see: <https://www.gnu.org/software/gdb/bugs/>. Find the GDB manual and other documentation resources online at: <http://www.gnu.org/software/gdb/documentation/>. For help, type "help". Type "apropos word" to search for commands related to "word"... Reading symbols from /usr/local/libexec/dovecot/imap... (No debugging symbols found in /usr/local/libexec/dovecot/imap) [New LWP 100485] warning: Could not load shared library symbols for [vdso]. Do you need "set solib-search-path" or "set sysroot"? Core was generated by `dovecot/imap'. Program terminated with signal SIGABRT, Aborted. Sent by thr_kill() from pid 6404 and user 1143. #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 (gdb) bt full #0 0x000000001151133a in thr_kill () from /lib/libc.so.7 No symbol table info available. #1 0x0000000011489c74 in raise () from /lib/libc.so.7 No symbol table info available. #2 0x000000001153b109 in abort () from /lib/libc.so.7 No symbol table info available. #3 0x000000001137a336 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #4 0x0000000011378ad1 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #5 0x0000000011379881 in ?? () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #6 0x0000000011378ceb in i_panic () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #7 0x000000001136a514 in array_idx_modifiable_i () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #8 0x0000000012054a78 in fts_user_autoindex_exclude () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #9 0x0000000012051b3b in fts_mailbox_allocated () from /usr/local/lib/dovecot/lib20_fts_plugin.so No symbol table info available. #10 0x000000001113ad0b in hook_mailbox_allocated () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #11 0x0000000011134491 in mailbox_alloc () from /usr/local/lib/dovecot/libdovecot-storage.so.0 No symbol table info available. #12 0x0000000001044311 in cmd_select_full () No symbol table info available. #13 0x000000000104cd92 in command_exec () No symbol table info available. #14 0x000000000104b64a in ?? () No symbol table info available. #15 0x000000000104b7b6 in ?? () No symbol table info available. #16 0x000000000104a151 in client_handle_input () No symbol table info available. #17 0x00000000010488a8 in client_input () No symbol table info available. #18 0x00000000113936df in io_loop_call_io () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #19 0x0000000011396214 in io_loop_handler_run_internal () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #20 0x0000000011393dea in io_loop_handler_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #21 0x0000000011393c28 in io_loop_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. --Type <RET> for more, q to quit, c to continue without paging-- #22 0x00000000112f6208 in master_service_run () from /usr/local/lib/dovecot/libdovecot.so.0 No symbol table info available. #23 0x000000000105af67 in main () No symbol table info available. (gdb) ===Cut=== Thanks. Eugene.

2 3

Feature Request: login_trusted_networks to take FQDN
by Sean Gallagher 15 Feb '23

15 Feb '23

In a previous post to this list I described a problem I was having validating client certificates on inet_listener lmtp connections. Subject: "Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working." The problem there was that Dovecot does not "inspect" the subject name on the client certificate on LMTP connections. As such Any valid certificate will pass. In this context "valid" means the same as OpenSSL SSL_set_verify( ,SSL_VERIFY_PEER, ). I.e. the certificate chain is well formed and can be traced back to a trusted root. It does not say anything about the peer's identity. I propose here, that the "login_trusted_networks" setting be allowed to take a domain name - possibly with wildcards. Then the name on the client certificate could be checked against login_trusted_networks in much the same way that web browsers work. If you tell your web browser that you want to connect to www.example.com, the browser will check that the server's certificate matches "www.example.com". In the present case, if you tell Dovecot (through the login_trusted_networks setting) to allow connections from "smtp.example.com", then Dovecot could check the name on the client's certificate matches "smtp.example.com". More generally, example.com could issue client certificates with names matching "*.mua.example.com". Then you could tell Dovecot to allow connections from "*.mua.example.com" through the login_trusted_networks setting. These usages could largely replace the IP host and CIDR subnet usages currently allowed in the login_trusted_networks setting but both could exist side by side. Of course, more elaborate schemes could be devised involving database lookups, but the outlined proposal would be relatively easy to implement and cover a good majority of use cases. The alternative is to force the use of application-specific certificate authorities, or just ignore it and hope that no one knows how to spoof network traffic. That's My two cents... Sean. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 0

IMAP folder subscription on Apple/Mac Mail
by Alex 13 Feb '23

13 Feb '23

Hi, We have a user with an iPhone who can't see their maildir mailboxes on dovecot-2.3.20 on fedora37. I've created a "subscriptions" file with all maildir mailboxes with the proper format (converted from mboxes using mb2md), but the user can only see their inbox. It appears this may be a known problem? https://wiki.dovecot.org/Clients Perhaps it's a problem with my "subscriptions" file, despite being able to see all mailboxes using K-9 on my android? Ideas for troubleshooting would be greatly appreciated.

1 1

Re: Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 11 Feb '23

11 Feb '23

> Am 08.02.2023 um 20:03 schrieb Michael Peddemors <michael(a)linuxmagic.com>: > > Dovecot vacation message issues.. > Tough for any system to do correctly. > >> The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. > > We addressed this by NOT returning vacation messages to systems that don't use 'proper' values in the MAIL FROM.. Eg Mailing Lists, Sender Rewrite schemes, and a slurry of other rules. Who is we? Your organization or the Pigeonhole developers? Actually, the question is, whether this is addressed somewhere in Pigeonhole’s code already? > But the problem is that if you are using the header From, or Reply-To etc, it's too easy to be sending to forged email addresses. > > Vacation bombing attacks for instance.. You got a point here, and of course I want to prevent this. > Now, there are legitimate cases of the MAIL FROM and header from not aligning, so it is best to send to the MAIL FROM addresses.. IF you don't send it to certain MAIL FROM formats, usually by not responding to anything with mailing list identifiers, auto-suppress headers, and a few others, you only end up with clean MAIL FROM to respond to. From the point of the view of our industrial customers, who are operating processes with our chemicals, this consideration is irrelevant. If they inform a production issue by mail to the responsible service technician, they expect an immediate response, since a production stop is unacceptable. OoO notices play a role here, because we would inform alternative addresses and fone numbers for attending the support case. That said, with Pigeonhole, we are almost there. > But if you have an example that is particularly bothering you, and represents your problem, we can walk through that as an example. I send an email from an account of a mail server (Postfix/Dovecot - outbound relay SES) running on an AWS-EC2 instance in São Paulo (Brazil) to another mail address of mine of a mail server (Postfix/Dovecot direct MX) on an AWS-EC2 instance in Frankfurt Germany, and here the Pigeonhole’s vacation reply is activated. In the following I changed my real mail address in Brazil to rolf(a)example.br and the real one in Germany to rolf(a)example.de: The Point of view of the both involved Postfixes of said transactions are: Sender (Brazil): postfix/submission/smtpd[29165]: 97006638E8: client=201-68-62-42.dsl.telesp.net.br[201.68.62.42], sasl_method=CRAM-MD5, sasl_username=rolf(a)example.br postfix/cleanup[29182]: 97006638E8: message-id=<707A1777-8F09-4335-99BA-70C0367C129A(a)example.br> postfix/qmgr[2058]: 97006638E8: from=<rolf(a)example.br>, size=39626, nrcpt=1 (queue active) postfix/smtp[29183]: 97006638E8: to=<rolf(a)example.de>, relay=email-smtp.sa-east-1.amazonaws.com[52.67.192.29]:587, delay=0.37, delays=0.05/0.01/0.13/0.18, dsn=2.0.0, status=sent (250 Ok 010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000) Receiver (Germany): postfix/smtpd[86956]: connect from d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/smtpd[86956]: A44AB676E3: client=d215-2.smtp-out.sa-east-1.amazonses.com[23.249.215.2] postfix/cleanup[86957]: A44AB676E3: message-id=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> postfix/qmgr[915]: A44AB676E3: from=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, size=40862, nrcpt=1 (queue active) postfix/local[86958]: A44AB676E3: passing <rolf(a)example.de> to transport=lmtp postfix/lmtp[86959]: A44AB676E3: to=<rolf(a)example.de>, relay=mail.example.de[private/dovecot-lmtp], delay=0.94, delays=0.83/0.01/0.04/0.07, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.de> +/goFGgl5mOwUwEAEYr/fg Saved) Sender of the OoO (Germany): postfix/qmgr[915]: 60242676F0: from=<rolf(a)example.de>, size=1177, nrcpt=1 (queue active) postfix/cleanup[86957]: 60242676F0: message-id=<dovecot-sieve-1676027240-343352-0(a)example.de> postfix/pickup[62932]: 60242676F0: uid=xxxx from=<rolf(a)example.de> postfix/smtp[86963]: 60242676F0: to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com>, relay=email-smtp.eu-central-1.amazonaws.com[3.74.180.161]:587, delay=0.31, delays=0.01/0.02/0.13/0.15, dsn=2.0.0, status=sent (250 Ok 010701863b022070-bb3e4541-8306-4438-b649-8879ec8ff666-000000) Receiver of the OoO notice (Brazil): postfix/smtpd[29184]: connect from d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/smtpd[29184]: 5F1346394E: client=d215-244.smtp-out.sa-east-1.amazonses.com[23.249.215.244] postfix/cleanup[29182]: 5F1346394E: message-id=<010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> postfix/qmgr[2058]: 5F1346394E: from=<>, size=3150, nrcpt=1 (queue active) postfix/local[29185]: 5F1346394E: passing <rolf(a)example.br> to transport=lmtp postfix/lmtp[29186]: 5F1346394E: to=<rolf(a)example.br>, relay=mail.example.br[private/dovecot-lmtp], delay=0.05, delays=0.01/0.01/0.02/0.01, dsn=2.0.0, status=sent (250 2.0.0 <rolf(a)example.br> RRZHGWwl5mMDcgAAjZNhtw Saved) The headers of the received OoO message (I removed the DKIM stuff for clarity) are: Return-Path: <> Delivered-To: rolf(a)example.br Received: from mail.example.br by example.br with LMTP id RRZHGWwl5mMDcgAAjZNhtw (envelope-from <>) for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 Received: from d215-244.smtp-out.sa-east-1.amazonses.com (d215-244.smtp-out.sa-east-1.amazonses.com [23.249.215.244]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.example.br (Postfix) with ESMTPS id 5F1346394E for <rolf(a)example.br>; Fri, 10 Feb 2023 08:07:24 -0300 (-03) DKIM-Signature: ... X-Sieve: Pigeonhole Sieve 0.5.20 (149edcf2) Message-ID: <010301863b022c93-9842f45a-85ec-419f-8199-00e027888394-000000(a)sa-east-1.amazonses.com> Date: Fri, 10 Feb 2023 11:07:23 +0000 From: MAILER-DAEMON(a)sa-east-1.amazonses.com To: rolf(a)example.br Subject: Out of Office - automatic notice In-Reply-To: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> References: <010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> Auto-Submitted: auto-replied (vacation) Precedence: bulk X-Auto-Response-Suppress: All MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Feedback-ID: 1.sa-east-1.E7DnIghDRHBvwjrx2QL73gyWAj+NYISxiq7bqOVD27E=:AmazonSES X-SES-Outgoing: 2023.02.10-23.249.215.244 Note how there is not a single reference of the real origin of the OoO message, rolf(a)example.de. Instead we see From: MAILER-DAEMON(a)sa-east-1.amazonses.com. The receiver of this message need to guess the real address from the outside context. The actual problem is that Pigeonhole responds to to=<010301863b0211fe-9416f5b2-7e18-4c03-a5e5-2204dd7946f8-000000(a)sa-east-1.amazonses.com> instead of to=<rolf(a)example.de>. Amazon SES of the original sender (not our relay) takes this as a bounce and changes the relevant headers. This is not under our control. Perhaps this could be mitigated by adding a Reply-To: header which informs the original sender. Then the receiver of the OoO noice would at least have a reference to what and whom this is about. Best regards Rolf > On 2023-02-08 13:21, Dr. Rolf Jansen wrote: >> Am 08.02.2023 um 12:57 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>> On 2023-02-08 07:47, Dr. Rolf Jansen wrote: >>>> Am 08.02.2023 um 12:23 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>> On 2023-02-07 14:57, Dr. Rolf Jansen wrote: >>>>>> Am 07.02.2023 um 19:49 schrieb Michael Peddemors <michael(a)linuxmagic.com>: >>>>>>> On 2023-02-07 13:33, jeremy ardley wrote: >>>>>>>> On 8/2/23 05:08, Dr. Rolf Jansen wrote: >>>>>>>>> Am 07.02.2023 um 17:54 schrieb jeremy ardley<jeremy(a)ardley.org>: >>>>>>>>>> On 7/2/23 22:01, Dr. Rolf Jansen wrote: >>>>>>>>>> To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. >>>>>>>>>> I run AWS-EC2 instances using postfix to send a receive mail. They can send direct assuming I set up suitable SPF, but they typically forward mail to another host under my control that is not on AWS to use as the outgoing server. >>>>>>>>> OK, that’s another use case. Many do use a full fledged Postfix/Dovecot installation. However the outgoing port 25 into the internet is blocked by AWS, and therefore we may either use a third party relay for our outgoing emails or may use SES, which is not that bad - except some unusual peculiarities. >>>>>>>>> >>>>>>>> This is off topic, but to be precise: >>>>>>>> - AWS throttles but does not block traffic to a *destination* port 25. >>>>>>>> - The *origin* port on the EC2 instance is an unprivilged port, not port 25 >>>>>>>> - If you use a relayhost you typically send from an unprivilged EC2 port to port 587 on the relay host >>>>>>>> Jeremy >>>>>>> >>>>>>> And if you DO intend to send out to port 25, remember to update the PTR on your EC2 instance. >>>>>> I respond off-list. Generally a good hint but it’s like trying to bath salts (https://en.wikipedia.org/wiki/Bath_salts) when you are taking a shower. >>>>>> https://aws.amazon.com/premiumsupport/knowledge-center/ec2-port-25-throttle/ >>>>>> Although the link text (ec2-port-25-throttle) suggests throttling, it is actually blocking - read the text. This cannot be removed from standard EC2 instances. >>>>>> This also corresponds to my experience. On the console of an AWS-EC2 instance, I entered just now: >>>>>> telnet cyclaero.com 25 >>>>>> This hangs until timeout. At the same time cyclaero.com received emails from the internet on port 25. >>>>>> Trying 3.126.110.101... >>>>>> telnet: connect to address 3.126.110.101: Operation timed out >>>>>> telnet: Unable to connect to remote host >>>>> >>>>> There are a lot of malicous or compromised EC2 instances..It is good they block port by default, and the one day delay before unblocking (you can request it) helps stop those short term spam instances. >>>>> >>>>> Now, wish they blocked port 587 by default ;) >>>>> >>>>> Or at least tracked the attacks. >>>>> >>>>> Strange though, that people still try to set up email on EC2, doesn't make sense, and it isn't the cheapest alternative.

5 8

Please Help: Dovecot ssl_ca selection based on remote IP address filtering not working.
by Sean Gallagher 11 Feb '23

11 Feb '23

Hi All, I hope this is the correct place to post this. If not, apologies. I am in the process of updating my company's email servers and am trying to put Dovecot into an Alpine Linux container, hosted on ProxMox. In my setup, local mail deliveries via LMTP can come from the MSA (for intra-company mail) and an MTA (for inbound mail). The LMTP data is sent over IPv4 and is protected by TLS. Client certificates are used to authenticate sources. I wanted to prevent Dovecot from accepting LMTP from any other source and the method I came up with to do this was to use filtering on the "remote" address. I would create a "Fake" CA that had never signed a certificate and use that to evaluate the certificate presented by incoming connections from addresses other than the two legitimate sources. This would cause all connections from "bad" addresses to be rejected. This seemed simple enough on paper but Dovecot just isn't playing along. It seems that no matter what I do, I cannot get "remote" filtering to switch the "ssl_ca" parameter. I have put together a test bed to demonstrate. I then use openssl s_client to attempt to connect to the test bed container. I've attached the instructions to build the test bed from scratch. In all cases s_client reports "Acceptable client certificate CA names" "CN = Fake CA" I.e. it want's a certificate from the CA that has never signed a certificate and never will. Why not do the obvious thing? I use LDAP to authenticate individual users and the user name will be reported over LMTP. So to use the normal authentication mechanisms to authenticate the connection source, I would need to do two LDAP lookups, one for the connecting machine and one for the mail recipient. It is not clear if this is possible from the documentation.. *Questions:* Is config file filtering broken or am I doing it wrong? Is it possible to provide a different "ssl_ca" based on the remote IP address? Is there an easier way to restrict LMTP connections to specific remote IP addresses? p.s. Filtering just doesn't work like it's supposed to. Someone should look at that (especially multi-level) .. See this: https://dovecot.org/pipermail/dovecot/2016-June/104770.html Any help would be greatly appreciated. I am at my wits' end with this. -- This email has been checked for viruses by AVG antivirus software. www.avg.com

1 1

Why does creating a mailbox create it in all namespaces?
by e 10 Feb '23

10 Feb '23

When I create a mailbox using CREATE, it creates it in all namespaces? Is that supposed to happen? Look: ``` a namespace * NAMESPACE (("" "/")("Other/" "/")) NIL NIL a OK Namespace completed (0.001 + 0.000 secs). a list "" * * LIST (\HasNoChildren) "/" Other * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). a create Other/Drafts a OK Create completed (0.003 + 0.000 + 0.002 secs). a list "" * * LIST (\HasNoChildren) "/" Drafts * LIST (\HasChildren) "/" Other * LIST (\HasNoChildren) "/" Other/Drafts * LIST (\HasNoChildren) "/" INBOX a OK List completed (0.001 + 0.000 secs). ``` This is my namespace configuration ``` namespace { prefix = inbox = yes separator = / } namespace { prefix = Other/ separator = / } ``` And dovecot version is 2.3.7.2

2 1

doveadm: Error: Mailbox INBOX: Deleting corrupted cache: Cache file too large
by Ralf Hildebrandt 09 Feb '23

09 Feb '23

Hi! Upon issuing a % doveadm import -u restore(a)backup.invalid mdbox:/home/storage/mdbox I'm getting a: doveadm(restore(a)backup.invalid): Error: Mailbox INBOX: Deleting corrupted cache: Cache file too largea doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.7 (around offset=41602004): msg header has bad magic value doveadm(restore(a)backup.invalid): Error: Corrupted dbox file /home/restore/mdbox/storage/m.8 (around offset=17193748): msg header has bad magic value message -- but the process keeps running! Should I worry? dovecot packages: 2.3.20-3+ubuntu20.04 -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

1 0

Pigeonhole Sieve Vacation Reply-To peculiarity with inbound AWS-SES
by Dr. Rolf Jansen 08 Feb '23

08 Feb '23

To begin with, usage of Amazons Simple Email Service (SES) is mandatory for outgoing mails from AWS-EC2 instances. The Pro is, it does work and we may utilize email relays with high reputation for our outgoing mails at no additional costs. The Con's are that (A) SES does not relay mails with empty <> MAIL FROM addresses and (B) it fiddles with the envelope addresses of the relayed mails. Anyway this is out of our control, and while I could avoid (A) by switching the e-mail service provider, I still have no control over (B) because this affects replying to emails from others using AWS-SES. Problem A) The empty-MAIL-FROM may be effectively addressed by setting Pigeonhole’s sieve_vacation_send_from_recipient to ‚yes‘. Problem B) Pigeonhole Vacation utilizes the senders envelope address of the inbound message as the reply-address. The problem here is that inbound mails from third parties utilizing AWS-SES come in with an unpersonalized envelope address and SES takes returns to this as bounce messages and changes the body's From: to „MAILER-DAEMON(a)xx-zzzz-1.amazonses.xn--com-5o0a, which is not even our MAILER-DAEMON but the one of the receiver of our reply. So the receiver gets no chance to know from the headers the identity of whom replied - he may assume it from the context the actual message, though. I found the setting sieve_vacation_to_header_ignore_envelope, which was introduced in 2017 (https://dovecot.org/list/dovecot-cvs/2017-August/028917.html) My finding is, that this resolves the problem only half way. For a local workaround, I changed Line 1119 of cmd-vacation.c https://github.com/dovecot/pigeonhole/blob/34431d7a67474c00d5b0554f5d45b867… to: struct smtp_address real_to; if (smtp_address_init_from_msg(&real_to, &reply_to) >= 0) sctx = sieve_smtp_start_single(senv, &real_to, smtp_from, &output); else sctx = sieve_smtp_start_single(senv, smtp_to, smtp_from, &output); That in place and setting sieve_vacation_to_header_ignore_envelope to ‚yes‘, effectively resolves problem B as well. Best regards Rolf Jansen

6 10

Ubuntu packages for 22.04 LTS?
by Ralf Hildebrandt 06 Feb '23

06 Feb '23

Hi! I recently updated from 20.04 -> 22.04 and wondered if packages specifically for 22.04 were available. https://doc.dovecot.org/installation_guide/dovecot_community_repositories/u… doesn't seem list any... Neiter does https://repo.dovecot.org -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt(a)charite.de | https://www.charite.de

2 2

problem converting mailbox to maildir with doveadm
by Kenneth Irving 05 Feb '23

05 Feb '23

Hello. I have an email server for testing purposes, using postfix 3.5.17 and dovecot 2.3.13. Initially, I configured postfix to use mailboxes, but now I've changed it to maildir. Emails arrive fine, and dovecot manages them well by pop3 or imap. No problems there. But I still have a lot of emails in different mailboxes which I'd like to convert to maildir. I found mb2md, which seems to do a pretty good job. Once the mailbox is converted, dovecot manages the emails without a problem. But I also wanted to learn how to use doveadm to convert mailboxes to maildir format. I read all the documentation I could find and tried to learn how this command works. I tried different combinations, but couldn't convert mailboxes to maildir. I always get error messages. I've been unable to understand why. I tried to sync, backup, and import, to no avail. I also tried dsync, which seems to have a different syntax, with the same result. Sorry for bothering you, but if you could explain to me how this command works, I'd be very grateful. Example: I have a user, let's say joe, who has a mailbox in /var/mail/joe and I'd like to transfer those emails to /home/joe/Maildir How do I use doveadm in this situation? Best regards Kenneth

3 4

IMAP tuning for Outlook 365
by Artur Pydo 02 Feb '23

02 Feb '23

Hello, I'm looking for advices on IMAP config tuning for best user experience with Outlook 365. I'm currently using dovecot 2.3.4.1 (f79e8e7e4) provided with Debian 10. One of my users has Outlook 365 and an IMAP mailbox of large size with several folders (more than 3GB). From time to time as his main inbox folder is growing he can see some problems with its Outlook application. Sometimes it freezes during mailbox synchronisation, sometimes he can't see new incoming emails. I wonder if there is some specific workarounds for an up-to-date Outlook in Dovecot or if you can suggests some config setup adjustments (timeouts, idleing ...) to avoid problems in his Outlook. Most of the config are defaults. But I can provide relevant parts of the config if needed. I have this workaround activated for a long time: imap_client_workarounds = delay-newmail By the way, I also have a big IMAP mailbox. Can't see any server specific problem while connecting with Thunderbird to this Dovecot server. -- Best regards, Artur

4 3

Dovecot gzip u.files on sdboxes
by Jose Celestino 01 Feb '23

01 Feb '23

Hi, I was wondering if it's possible to lighten the process of converting sdbox mailboxes to zlib by, instead of using dsync (that brings much more io, copying from alt - and copying of unneeded data as we have many mails already compressed from activating zlib a couble of years ago) just compressing each of the u files. By compression of the u files I mean opening the uncompressed u file for reading, a u.temp file for writting and: 1. copy the dbox message header from u to u.tmp 2. compress the plain message and write it to u.tmp 3. fix the message_size_hex on the u.tmp dbox message header to the new, compressed size 4. copy the dbox metadata from u to u.tmp with Zphysical_size added 5. copy the u stat times to u.tmp 6. replace u with u.tmp Is the message_size_hex stored anywhere else (indexes) that may cause this to not work? Thank you.

2 1

Add Userdb extra field to existing configuration settings, not overriding them
by Stefano Cecconello 27 Jan '23

27 Jan '23

Hi, If i understood correctly the extra field feature ( https://doc.dovecot.org/configuration_manual/authentication/user_database_ex tra_fields/ ), any extra field that is passed from a SQL query will overwrite any existing settings on the dovecot.conf configuration file ( if present ) . For example, if i want to enable a plugin ( ex: acl ) on a per user basis, i would add a column\field ( ex: "acl_enabled" = 1 ) into my auth DB , then add into the dovecot password\user queries : . IF(acl_enabled = 0, NULL, 'acl imap_acl') AS mail_plugins . While having in the dovecot.conf this setting : . mail_plugins = quota notify protocol imap mail_plugins = $mail_plugins imap_quota . >From my test, this combination will lead to having the logging users with acl_enabled=1, a mail_plugins list of acl and imap_acl only, without the quota and notify plugins . If i change the acl_value to 0, the returned mail_plugins list is empty and it will not overrive\overwrite the dovecot.conf mail_plugins configuration . If it's correct, there is a way to merge both settings, like having in the dovecot.conf a minimal\base subset of settings and adding any additional values via SQL queries ? Thanks and best regards Stefano

2 1

sieve_extprograms plugin calling bash script
by Tom 27 Jan '23

27 Jan '23

I receive an email a few times a week containing a URL for a live stream which starts within a minute after receiving the email. I want to automate capturing the whole stream. I've been trying to write a sieve script which uses the sieve extprograms plugin to call a bash script that parses the URL from the email and passes it to a capture program. So far I've had no luck getting the bash script to call _any_ external programs. I can't even write a file to /tmp/, so it's not a filesystem permissions issue. The sieve script has no issues finding and executing the bash script, it just does nothing other than return an exit code. Does sieve put the extprogram script in some kind of sandbox where it has no access to the system? This may not be the best place to find answers to sieve plugin info. If so, can someone point me in the right direction?

3 2

How do you scale dovecot for good performance with Roundcube webmailer in front? (hitting limits without exhausting resources)
by Malte Schmidt 27 Jan '23

27 Jan '23

Good day, I am currently setting up/debugging a webmailer-only setup using Roundcube (latest version) with Dovecot (2.3.20, latest as of now). Generally speaking the setup performs OK, I wrote a JMeter Roundcube script to test the Roundcube. This includes actions like listing mails and fetching them. I am hitting a somehow dubious limit of 600 req/s though. (This includes all kinds of HTTP calls to Roundcube, not only the ones triggering IMAP). When the dovecot becomes unavailable, the performance without mails jumps to 7700 req/s. Testing is done with 4 JMeter-servers and one client. My setup is a Dovecot with MySQL (Percona XtraDB) backend. Mails are encrypted with mail_crypt and EC keys. Authentication is done in parallel (auth_cache_verify_with_workers=yes). Where possible min_available_processes have been set equal to the threads available on the Dovecot machine (64). Hardware is a 64 thread Xeon CPU at 2.10 GHz, 96 GB RAM, SSDs as backing storage IOPS read 40000/write 13000. What settings do you recommend and how was your experience with Roundcube and its performance in general (what should be possible with that kind of HW?)? Best regards and thanks in advance!

3 3

[REVISIONS] How to install SSL Certificate on Dovecot and Postfix
by Turritopsis Dohrnii Teo En Ming 27 Jan '23

27 Jan '23

Subject: [REVISIONS] How to install SSL Certificate on Dovecot and Postfix Good day from Singapore, Author: Mr. Turritopsis Dohrnii Teo En Ming (TARGETED INDIVIDUAL) Country: Singapore Date of Implementation: 6 Jan 2023 Friday SECTION ON DOVECOT =================== # cd /etc/dovecot/conf.d # nano 10-ssl.conf ssl = yes ssl_cert = </home/teo-en-ming-corp/2023.crt ssl_key = </home/teo-en-ming-corp/2023.key ssl_ca = </home/teo-en-ming-corp/inter2023.crt # nano /etc/dovecot/dovecot.conf protocols = imap pop3 !include conf.d/*.conf SECTION ON POSTFIX =================== # nano /etc/postfix/main.cf smtpd_use_tls = yes smtpd_tls_auth_only = yes smtpd_tls_key_file = /etc/postfix/2023.key smtpd_tls_cert_file = /etc/postfix/chain2023.crt smtpd_tls_CAfile = /etc/postfix/inter2023.crt Note: chain2023.crt is made by combining 2023.crt and inter2023.crt # nano /etc/postfix/master.cf submission inet n - n - - smtpd smtps inet n - n - - smtpd tlsmgr unix - - n 1000? 1 tlsmgr That's all. Regards, Mr. Turritopsis Dohrnii Teo En Ming Targeted Individual in Singapore Blogs: https://tdtemcerts.blogspot.com https://tdtemcerts.wordpress.com

1 0

LDAP scheme for Dovecot
by Daniel Betschart 24 Jan '23

24 Jan '23

I use an LDAP server for user administration, the users can manage themselves with the LDAP Account Manager (LAM). I would like to give the possibility to be able to define the quota per user. LAM provides support for certain schemes, but the qmail scheme is missing in the free variant. So I used the Courier scheme. Now, while LAM correctly stores the value in bytes, it appends the letter S. Unfortunately, the mail server Dovecot cannot do anything with this letter S. Is there a better scheme for Dovecot? I haven't found any until now. Or can I remove the letter S at the end in the Dovecot configuration file via regex?

1 0

Why does doveadm always run doveconf?
by Bert Van de Poel 21 Jan '23

21 Jan '23

Dear fellow Dovecot users, I've recently been aiding in the fixing up of the old dovecot_stats_ munin plugin. Currently, it still parses the output of doveadm oldstats, as it is quite an old script. Regardless of any feelings we may all have about oldstats, I was quite surprised to find that doveadm requires quite broad privileges (in my case root privileges) to function properly. It seems that any call to doveadm, even for "doveadm oldstats dump domain" runs doveconf and will attempt to fully parse my configuration including trying to read SSL/TLS certificates. Due to this choice, the fact the FIFO of oldstats can be given low privileges, doveadm still has to be invoked with high privileges or it will fail at the stage of verifying configuration. Now I'm wondering why it's the case that a command such as "doveadm oldstats dump domain" is invoking doveconf and therefore has these kinds of limitations. While for basically all non-stats functions of doveadm, running as root (or similar) makes a lot of sense, I'd argue it doesn't for oldstats (and maybe also the new stats?), which simply talk to a socket. Is there a certain reasoning behind this, or is this accidental behaviour because of the standard operations doveadm always performs? Any elaboration would be more than welcome! Kind regards, Bert

2 3

Different username for passdb and userdb
by support+dovecot＠shellworld.net 21 Jan '23

21 Jan '23

Hello I am attempting to use an external IMAP server for authentication, on Dovecot 2.3.16 (7e2e900c1a), running on Ubuntu 22.04. The external server requires usernames of the format: user@domain However, my local users, where the mail is actually drawn from, are of the format: user (passwd file driven). I was able to log in with just "user", and have it both authenticate remotely, and access local mail, using: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 user=%n@%d ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no } However, the remote SMTP server, which I will not be proxying, requires the same user@domain format for usernames. I would rather not ask users to use "user@domain" for SMTP, and "user" for IMAP. They should only have to use "user@domain" for login everywhere. Is there a way to do this? The docs suggest so (AuthDatabase.PasswdFile.txt), but if so I must be botching it. Things I have tried: passdb { driver = imap args = host=remotehost.com ssl=imaps port=993 ssl_ca_dir=/etc/ssl/certs } userdb { driver = passwd args = blocking=no override_fields = username_format=%n } I also tried: override_fields = user=%n Or, alternatively to any override_fields: args = blocking=no username_format=%n Lastly, I even tried this whole different approach: userdb { driver = passwd-file args = blocking=no username_format=%n /etc/passwd } The following is logged no matter which of those I try: auth: imapc(remotehost.com:993): Connected to #.#.#.#:993 (local #.#.#.#:35088) auth: Error: passwd(user(a)domain,#.#.#.#,<...>): user not found from userdb imap(274049): Error: auth-master: login: request [...]: Login auth request failed: Authenticated user not found from userdb, auth lookup id=... (auth connected 10 msecs ago, request took 1 msecs, client-pid=274038 client-id=1) imap-login: Disconnected: Internal login failure (pid=274038 id=1): user=<user@domain>, method=PLAIN, rip=#.#.#.#, lip=#.#.#.#, mpid=274049, TLS, session=<...> (The last attempt got a slightly varied log message, but quite similar: auth: Error: passwd-file(user(a)domain#.#.#.#,<...>): user not found from userdb ) Any help with this would be much appreciated. Thanks! Luke

1 1

submission_host auth
by k v 18 Jan '23

18 Jan '23

When using dovecot container with sieve plugin there is no sendmail to use for sending email for sieve redirect action for example. We can use submission_host instead https://doc.dovecot.org/settings/core/#core_setting-submission_host but there is no way to specify credentials for auth in remote MTA. Submission_relay_* settings e.g. submission_relay_master_user relate to dovecot submission service. Using something like permit_mynetworks in remote MTA is not acceptable for security reasons. Is it possible to add authorization in the remote MTA using submission_host?

2 4

dovecot replication - new and cur folders on mx1 and mx2
by Tomaz Kavcic 17 Jan '23

17 Jan '23

Hello, I have a question in regards to specific dovecot replication behaviour and I'm just wondering if this is actually an expected/normal behaviour, or just a version issue. I'm using dovecot 2.3.16 which is packed by default with latest Ubuntu 22.04.1 LTS server release. I setup dovecot replication pair (mx1 - mx2) which is working ok. MX1 has priority 10, MX2 has priority 20. I use maildir (postfix + dovecot lmtp). The "strange" behaviour is this. When new mail arrives, it's by default delivered into "new" folder inside user directory. This email is then replicated to both servers (mx1 and mx2). When I login to mx1 via IMAP client (roundcube, outlook, etc.) that specific email is moved from "new" to "cur" folder on server mx1 and it's flagged also with "S", which probably means read flag. On server mx2, that email filename is also flagged with "S", but the email stays inside the "new" folder and it's not moved to "cur". If I want this email to be moved to "cur" on mx2 server, I have to login to that IMAP server as well, click on that email (which is already flagged as read), and after click, the email is also moved to "cur" on server mx2. Simply said, all new mails on mx1 server are moved to "cur" when accessed, but the stay in "new" folder on server mx2 until they're physically accessed there as well. Is this normal behaviour? I tried setup with TCP and SSH replication, and the situation is the same in all cases. Lastly, I tried TCPS (with SSL) as well, but that option has issues in 2.3.16, which is probably known already as I found multiple posts about these issues in this version. Thank you in advance for your answer and kind regards, Tomaz Kavcic. --- As suggested by mr. Timo Sarainen, this should be synced, so I'm posting doveconf -n as attachment for both servers as well.

3 3

Quota Clone Plugin
by MK 17 Jan '23

17 Jan '23

Hello Everybody, just a short question, maybe someone used this plugin and can give me a short answer. I have configured dovecot Quota Clone Plugin to copy quota information into a MySQL Database. Works finde, but dovecot writes the quota information only to the database if the quota is triggert by new email or something else like this. So I don't have all my user in the MySQL Database. Is there any command I can use that can trigger dovecot to write the quota information of all the users to the database one time, so that I have all my user quota information copied in the database? I have tried "doveadm quota recalc -A" but it took quite a long time and there is a very high I/O Load on the server, so I stopped it. I don't think this is what I want to do. Maybe there is another way. For all of you who don't know this plugin. https://doc.dovecot.org/configuration_manual/quota_clone_plugin/ Greetings, Oliver

3 3

hostname in director_mail_servers setting
by k v 16 Jan '23

16 Jan '23

director_mail_servers setting uses IP Adresses as values https://doc.dovecot.org/settings/core/#core_setting-director_mail_servers As described in the documentation, hostnames are converted to addresses when the configuration is read https://doc.dovecot.org/settings/types/#ip-addresses This is acceptable in host or virtual machine environment, but becomes a problem in a containerized environment. When any backend container is restarted, its address will change and users related to this backend can no longer connect, but backend (available with new IP address) can process request for example, director_mail_servers = dovecot-1 dovecot-2 dovecot-3 becomes in runtime (with one successfully connectetd user foo(a)example.com) doveadm director status mail server ip tag vhosts state state changed users 10.0.71.3 100 up - 0 10.0.71.4 100 up - 1 10.0.71.5 100 up - 0 where dovecot-1 10.0.71.3, dovecot-2 10.0.71.4, dovecot-3 10.0.71.5 When dovevecot-2 backend container restarts, and becomes new IP address, user can't connect to related backend: imap-login: Info: proxy(foo@example.com,10.0.71.4:143): Started proxying to <10.0.71.4> (<dovecot-2>) (0.009 secs) imap-login: Error: proxy(foo@example.com,10.0.71.4:143): connect(10.0.71.4, 143) failed: No route to host (after 28 secs, 3 reconnects, local=10.0.71.13:41066) My suggestion to developers: resolve backend hostnames to IP address on every request to director_mail_servers It's not about dovemon service with active health checks from dovecot pro, just dynamic hostname resolve

2 1

Error: Mailbox INBOX: file_dotlock_create in directory /var/mail failed: Permission denied
by manmatha 16 Jan '23

16 Jan '23

Hi All, We are running Round cube on top of dovecot and postfix as our email echo system. Main problem we are facing is that, roundcube loads really slow for big inboxes (~5000 emails). I found that, while it loads, imap process goes high in terms of CPU utilization(~90%). I asked it in some roundcube support group, They believe that it is related to dovecot not roundcube. Can you shed any light on this issue. Thanks in advance. Here is $dovecot -n$ output xyz@roundcube-internal-server-1:/etc/dovecot$ dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.15.0-1024-kvm x86_64 Ubuntu 22.04.1 LTS # Hostname: roundcube-internal-server-1 auth_mechanisms = plain login disable_plaintext_auth = no listen = * lock_method = dotlock mail_always_cache_fields = date.received mail_cache_min_mail_count = 5000 mail_location = mbox:~/mail:INBOX=/var/mail/%u:INDEX=/var/indexes/isical.ac.in/%n mail_privileged_group = mail mail_sort_max_read_count = 100 mailbox_list_index_include_inbox = yes mailbox_list_index_very_dirty_syncs = yes maildir_very_dirty_syncs = yes mbox_dotlock_change_timeout = 1 mins mbox_lazy_writes = no mbox_write_locks = dotlock fcntl namespace inbox { inbox = yes location = prefix = } passdb { driver = pam } protocols = imap pop3 ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol !indexer-worker { mail_vsize_bg_after_count = 100 } On a different note we are getting error occasionally of the following type. I dont know if they are related. Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(/var/mail/xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: unlink(xyz.lock) failed: Permission denied (in file-dotlock.c:195) Jan 16 15:36:13 roundcube-internal-server-1 dovecot: imap(xyz)<361270><aqauu17ycsvAqL8/>: Error: Mailbox INBOX: file_dotlock_create(xyz) in directory /var/mail failed: Permission denied (euid=10865(xyz) egid=8(mail) missing +w perm: /var/mail, UNIX perms appear ok (ACL/MAC wrong?), dir owned by 0:8 mode=0771)

2 1

Up to date dovecot packages on Ubuntu 22.4LTS
by Gerben Wierda 12 Jan '23

12 Jan '23

I just found out that Ubuntu Linux 22.04 LTS has a dovecot apt package that is 2.3.16. Debian 11 (stable) is at dovecot 2.3.13 with apt. if I looked correctly. Dovecot itself is at 2.3.20. That surprised me (I am new to the Linux distro and package management world) as Ubuntu 22.04 is a Long-Time Support version, and I was expecting packages to be updated as well (as many users will want updated packages. How does that work in the dovecot world? How come macOS MacPorts (2.3.19) has more recent packages than any of the large Debian-based Linuxes? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

3 2

director: pass different username to proxy than the one that is used for hashing
by alex 12 Jan '23

12 Jan '23

dovecot 2.3.13 Hi, I'm looking for a way to make director use a user@domain that is returned by the database for hashing but actually send the original user@domain in the proxied request. I cannot seem to find a way. I can change the name used for hashing by just returning a different user from the db. but that user is also the one that is send in the proxied request. this is what I have so far: director_username_hash = %L{user} # relevant sql: password_query = SELECT \ username as user, \ # -> this is used for hashing if destuser is not present. = OK NULL as password, \ 'y' as proxy, \ 'y' as nopassword, \ '%n@%d' as destuser \ # -> but as soon as I add this, this is used for hashing = !OK FROM dovecot_data('%n', '%d') Anyone know any clever tricks to accomplish this? Thanks! Alex (background: I've inherited a mail setup where mailboxes have multiple logins. (those all share the same 'home' for their maildirs). I need all of these to go to the same server. Most ideal would be hashing on home '%h' instead of %u :)).

1 0

Living without fdpass / SCM_RIGHTS
by Dengler, Gabriel 10 Jan '23

10 Jan '23

Hello everyone, I wanted to run Dovecot inside Gramine [1]. Gramine is a tool to let normal Linux binaries run with the help of the Intel Software Guard Extensions (SGX) technology [2] in a secure enclave to which the operating system doesn't have an access to. Most parts of Dovecot now run fine, however, Dovecot uses the SCM_RIGHTS flag for the sendmsg system call to exchange file descriptors over Unix sockets [3]. Normally, this feature is available in every Unix, but in Gramine, this is currently not supported [4]. So, according to the logs, the authentication works, but after that, the imap-login process cannot exchange the file descriptor with the imap process. Therefore I wanted to ask if there is a possibility to make Dovecot work without this feature or if this would need fundamental changes in the code structure. Thanks for your help in advance! Best regards, Gabriel References: [1] https://gramineproject.io/ [2] https://de.wikipedia.org/wiki/Software_Guard_Extensions [3] https://github.com/dovecot/core/blob/main/src/lib/fdpass.c#L128 [4] https://github.com/gramineproject/gramine/discussions/1013#discussioncommen…

1 0

Dovecot - mail_crypt - lmtp-server - no password to decrypt the key
by Baljeet Bhinder 09 Jan '23

09 Jan '23

I have been using postfix+dovecot successfully for a while now until I tried mail crypt plugin lately. I tried what is describe here https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/ and I went for global-keys as described here: https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/#global-keys /"A good solution for environments where no user folder sharing is needed is to generate per-user EC key pair and encrypt that with something derived from user’s password."/ I am setting mail_crypt_global_private_key, mail_crypt_global_public_key, mail_crypt_save_version from user_query and userdb_mail_crypt_global_private_key_password from password_query. mail_crypt seems to work fine in imap (I saved a message as draft and it is stored encrypted on the disk), but lmtp complains about "mail_crypt_global_private_key_password unset, no password to decrypt the key" As you can see below in logs that it was able to set all other mail_crypt_ configurations successfully from user_query. However, the password is provided via password_query and I assume lmtp does not read password_query. How else can I provide a password in lmtp? Is my approach correct to begin with? -- Dovecot Configurations -- # using doveconf -n # 2.3.19.1 (9b53102964): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.19 (4eae2f79) # OS: Linux 5.15.0-57-generic x86_64 Ubuntu 20.04.5 LTS # Hostname: mailserver-dovecot-7c9ff7b94b-8ldrr auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = yes debug_log_path = /dev/stdout haproxy_trusted_networks = 192.168.0.0/16 10.10.10.0/24 10.10.30.0/24 172.17.0.1/16 hostname = imap.mailserver.k8s.local pop.mailserver.k8s.local info_log_path = /dev/stdout listen = * log_path = /dev/stdout mail_debug = yes mail_gid = 1000 mail_home = /var/vmail/mailboxes/%d/%n mail_location = maildir:~/:LAYOUT=fs mail_plugins = quota mail_crypt mail_privileged_group = mail mail_uid = 1000 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Trash { auto = subscribe autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { imapsieve_mailbox1_before = file:/var/vmail/sieve/global/learn-spam.sieve imapsieve_mailbox1_causes = COPY APPEND FLAG imapsieve_mailbox1_name = Spam imapsieve_mailbox2_before = file:/var/vmail/sieve/global/learn-ham.sieve imapsieve_mailbox2_causes = COPY APPEND FLAG imapsieve_mailbox2_from = Spam imapsieve_mailbox2_name = * mail_crypt_save_version = 0 quota = maildir:User quota quota_exceeded_message = User %u has exhausted allowed storage space. quota_rule = Junk:ignore quota_rule2 = Trash:storage=+100M quota_warning = storage=90%% quota-warning 90 %u %d quota_warning2 = storage=80%% quota-warning 80 %u %d sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = /var/vmail/sieve/global/spam-global.sieve sieve_global = /var/vmail/sieve/global/ sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.debug sieve_pipe_bin_dir = /var/vmail/sieve/global sieve_plugins = sieve_imapsieve sieve_extprograms } protocols = " imap lmtp sieve pop3" service auth { inet_listener { port = 25252 } } service imap-login { inet_listener imap { haproxy = yes } inet_listener imaps { haproxy = yes ssl = yes } } service lmtp { executable = lmtp -L inet_listener lmtp { address = 0.0.0.0 port = 24 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { haproxy = yes } inet_listener pop3s { haproxy = yes } } ssl = required ssl_cert = </etc/dovecot/certs/tls.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { info_log_path = /dev/stdout log_path = /dev/stdout mail_plugins = quota mail_crypt sieve postmaster_address = <hidden> } protocol imap { mail_plugins = quota mail_crypt quota imap_quota imap_sieve } -- Dovecot Configurations Ends -- -- Password Query -- password_query = \ SELECT username, domain, password, \ '%{sha256:password}' AS userdb_mail_crypt_global_private_key_password \ FROM mailbox \ WHERE username='%u'; -- Password Query Ends-- -- User Query -- user_query = SELECT CONCAT('*:bytes=', 1024) as quota_rule, \ private_key AS mail_crypt_global_private_key, \ public_key AS mail_crypt_global_public_key, \ mail_crypt_save_version AS mail_crypt_save_version \ FROM mailbox \ WHERE username='%u'; -- User Query Ends -- -- Debug Logs -- --- Load Inbox --- imap-login: Info: Login: user=<someone(a)example.com>, method=PLAIN, rip=192.168.49.1, lip=192.168.49.2, mpid=241, TLS, session=<oaoI9sLxVKXAqDEB> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Loading modules from directory: /usr/lib/dovecot/modules imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_mail_crypt_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib11_imap_quota_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Module loaded: /usr/lib/dovecot/modules/lib95_imap_sieve_plugin.so imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_private_key_password=<hidden> imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/mail_crypt_save_version=2 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota root: name=User quota backend=maildir args= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Quota grace: root=User quota bytes=102400000 (10%) imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: open(/proc/self/io) failed: Permission denied imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:~/:LAYOUT=fs imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: fs: root=/var/vmail/mailboxes/example.com/someone, index=, indexpvt=, control=, inbox=/var/vmail/mailboxes/example.com/someone, alt= imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: quota: quota_over_flag check: quota_over_script unset - skipping imap(someone(a)example.com)<241><oaoI9sLxVKXAqDEB>: Debug: Mailbox INBOX: Mailbox opened --- Load Inbox Ends --- --- Lmtp --- lmtp(248): Info: Connect from 172.17.0.1 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Started userdb lookup lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=143,uid=0): Client connected (fd=18) imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging (new file_seq=1673195172): creating cache imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: Mailbox Sent: Purging finished, file_seq changed 0 -> 1673195172, size=0 -> 388, max_uid=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): auth USER input: someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: auth-master: userdb lookup(someone(a)example.com): Finished userdb lookup (username=someone(a)example.com quota_rule=*:bytes=1024000000 mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== mail_crypt_save_version=2) lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_private_key=LS0tLS1CRUd.....LS0tLS0K imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: duplicate db: Initialize lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_global_public_key=LS0tLS1CRUd.....LS0tCg== imap(someone(a)example.com)<247><WlggG8PxEOvAqDEB>: Debug: sieve: Pigeonhole version 0.5.19 (4eae2f79) initializing lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/mail_crypt_save_version=2 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Added userdb setting: plugin/quota_rule=*:bytes=1024000000 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Effective uid=1000, gid=1000, home=/var/vmail/mailboxes/example.com/someone lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: mail_crypt_plugin: mail_crypt_curve setting missing - generating EC keys disabled lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota root: name=User quota backend=maildir args= lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=* bytes=1024000000 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota rule: root=User quota mailbox=Trash bytes=+104857600 messages=0 lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=921600000 (90%) messages=0 reverse=no command=quota-warning 90 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota warning: bytes=819200000 (80%) messages=0 reverse=no command=quota-warning 80 someone(a)example.com example.com lmtp(someone(a)example.com)<248><e2dcD6TuumP4AAAALzF/Qw>: Debug: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Quota grace: root=User quota bytes=102400000 (10%) lmtp(248): Error: lmtp-server: conn 172.17.0.1:6376 [1]: rcpt someone(a)example.com: Failed to initialize user: mail_crypt_plugin: mail_crypt_global_private_key: mail_crypt_global_private_key_password unset, no password to decrypt the key lmtp(248): Info: Disconnect from 172.17.0.1: Logged out (state=READY) --- Lmtp Ends --- -- Debug Logs Ends -- Thanks Baljeet Bhinder

3 3

Keycloak Authorization Code Flow
by Gary Horchem 08 Jan '23

08 Jan '23

Can dovecot use Keycloak Authorization Code Flow? I would like to use it instead of Password Resource Grant Flow for better security. Sent from my iPhone

1 0

How to set otp one time password
by weihao.chen＠artisantechnologies.cn 07 Jan '23

07 Jan '23

Dear Everybody: May I ask how to configure dovecot otp one-time verification login, that is, after the user logs in to the mailbox with the password + otp, he can send and receive emails without entering the password + otp again? # This is my settings: # /etc/dovecot/conf.d/10-auth.conf disable_plaintext_auth = yes auth_cache_size = 10M auth_failure_delay = 5 secs auth_ssl_username_from_cert = yes auth_mechanisms = otp !include auth-ldap.conf.ext error logs: ------------------------------- 6952-Jan 06 18:03:01 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6953-Jan 06 18:03:02 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6954-Jan 06 18:03:02 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6955:Jan 06 18:03:02 auth: Fatal: OTP mechanism can't be supported with given passdbs 6956-Jan 06 18:03:02 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6957-Jan 06 18:03:02 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<OiDkhZXx7fasHhQz> 6958-Jan 06 18:03:07 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6959-Jan 06 18:03:07 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6960:Jan 06 18:03:07 auth: Fatal: OTP mechanism can't be supported with given passdbs 6961-Jan 06 18:03:07 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6962-Jan 06 18:03:07 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<qgIyhpXx8PasHhQz> 6963-Jan 06 18:03:11 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6964-Jan 06 18:03:11 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6965:Jan 06 18:03:11 auth: Fatal: OTP mechanism can't be supported with given passdbs 6966-Jan 06 18:03:11 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6967-Jan 06 18:03:11 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 3 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<gDdvhpXx8/asHhQz> 6968-Jan 06 18:03:19 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6969-Jan 06 18:03:19 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6970:Jan 06 18:03:19 auth: Fatal: OTP mechanism can't be supported with given passdbs 6971-Jan 06 18:03:19 master: Error: service(auth): command startup failed, throttling for 16.000 secs 6972-Jan 06 18:03:19 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 8 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<qp7phpXx9PasHhQz> 6973-Jan 06 18:03:29 imap-login: Info: Disconnected: Connection closed (disconnected before auth was ready, waited 5 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS, session=<N1qAh5Xx/PasHhQz> 6974-Jan 06 18:03:35 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6975-Jan 06 18:03:35 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6976:Jan 06 18:03:35 auth: Fatal: OTP mechanism can't be supported with given passdbs 6977-Jan 06 18:03:35 master: Error: service(auth): command startup failed, throttling for 32.000 secs 6978-Jan 06 18:04:01 master: Warning: Killed with signal 15 (by pid=2692494 uid=0 code=kill) 6979-Jan 06 18:04:02 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6980-Jan 06 18:04:09 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6981-Jan 06 18:04:09 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6982:Jan 06 18:04:09 auth: Fatal: OTP mechanism can't be supported with given passdbs 6983-Jan 06 18:04:09 master: Error: service(auth): command startup failed, throttling for 2.000 secs 6984-Jan 06 18:04:09 imap-login: Info: Disconnected: Auth process broken (disconnected before auth was ready, waited 0 secs): user=<>, rip=172.30.20.51, lip=172.16.5.111, TLS handshaking, session=<8VrsiZXxFfesHhQz> 6985-Jan 06 18:04:56 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6986-Jan 06 18:04:56 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6987:Jan 06 18:04:56 auth: Fatal: OTP mechanism can't be supported with given passdbs 6988-Jan 06 18:04:56 master: Error: service(auth): command startup failed, throttling for 4.000 secs 6989-Jan 06 18:05:57 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6990-Jan 06 18:05:57 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6991:Jan 06 18:05:57 auth: Fatal: OTP mechanism can't be supported with given passdbs 6992-Jan 06 18:05:57 master: Error: service(auth): command startup failed, throttling for 8.000 secs 6993-Jan 06 18:06:26 master: Warning: Killed with signal 15 (by pid=2692680 uid=0 code=kill) 6994-Jan 06 18:06:27 log(2692602): Warning: Killed with signal 15 (by pid=1 uid=0 code=kill) 6995-Jan 06 18:06:27 master: Info: Dovecot v2.3.19.1 (9b53102964) starting up for imap, lmtp (core dumps disabled) 6996-Jan 06 18:06:47 auth: Debug: Loading modules from directory: /usr/lib/dovecot/auth 6997-Jan 06 18:06:47 auth: Debug: Module loaded: /usr/lib/dovecot/auth/lib20_auth_var_expand_crypt.so 6998-Jan 06 18:06:47 auth: Debug: Read auth token secret from /var/run/dovecot//auth-token-secret.dat 6999-Jan 06 18:06:47 auth: Error: ldap_bind 7000-Jan 06 18:06:47 auth: Error: ldap_simple_bind 7001-Jan 06 18:06:47 auth: Error: ldap_sasl_bind ------------------------------- if option: auth_mechanisms = plain login Can send and receive emails successfully, but when the otp time expires, you need to re-enter the password + otp, which is unacceptable to the user Looking forward to your reply, Tanks -- nick(Weihao) weihao.chen(a)artisantechnologies.cn

2 1

postfix connects to dovecot lmtp socket, but nothing is delivered
by Gerben Wierda 05 Jan '23

05 Jan '23

I am setting up a new server combination (postfix + dovecot). dovecot's auth service works for postfix. Just lmtp does not and I need to find out why. I don't see anything in the dovecot logging, but I see this on the postfix side (debug) Jan 05 16:11:59 snape postfix/lmtp[127]: connection established Jan 05 16:11:59 snape postfix/lmtp[127]: master_notify: status 0 Jan 05 16:11:59 snape postfix/lmtp[127]: deliver_request_initial: send initial response Jan 05 16:11:59 snape postfix/lmtp[127]: send attr protocol = delivery_request_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: smtp_get: timeout Jan 05 16:16:59 snape postfix/lmtp[126]: connect to subsystem private/defer Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: protocol Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: delivery_status_protocol Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: send attr nrequest = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr queue_id = C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr original_recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr recipient = sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr offset = 18446744073709551615 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr dsn_orig_rcpt = rfc822;sysbh(a)rna.nl Jan 05 16:16:59 snape postfix/lmtp[126]: send attr notify_flags = 0 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = delayed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: status Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute value: 0 Jan 05 16:16:59 snape postfix/lmtp[126]: private/defer socket: wanted attribute: (list terminator) Jan 05 16:16:59 snape postfix/lmtp[126]: input attribute name: (end) Jan 05 16:16:59 snape postfix/lmtp[126]: C71B3D1262: to=<sysbh(a)rna.nl>, relay=snape.rna.nl[private/lmtp], delay=300, delays=0.02/0/300/0, dsn=4.4.2, status=deferred (conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting) Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 Jan 05 16:16:59 snape postfix/lmtp[126]: match_list_match: rna.nl: no match Jan 05 16:16:59 snape postfix/lmtp[126]: flush_add: site rna.nl id C71B3D1262 status 4 Jan 05 16:16:59 snape postfix/lmtp[126]: deliver_request_final: send: "conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting" -1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4.4.2 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_type = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr diag_text = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_type = Jan 05 16:16:59 snape postfix/lmtp[127]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: send attr mta_mname = Jan 05 16:16:59 snape postfix/lmtp[127]: connection closed Jan 05 16:16:59 snape postfix/lmtp[126]: send attr action = Jan 05 16:16:59 snape postfix/lmtp[126]: send attr reason = conversation with snape.rna.nl[private/lmtp] timed out while receiving the initial server greeting Jan 05 16:16:59 snape postfix/lmtp[126]: send attr status = 4294967295 Jan 05 16:16:59 snape postfix/lmtp[126]: master_notify: status 1 Jan 05 16:16:59 snape postfix/lmtp[126]: connection closed It seems dovecot doesn't react to whatever postfix is doing on the socket. Another possibility is that the socket doesn't really work and dovecot never gets a connection request. How can I debug this? Might I test if the socket is the problem by running lmtp on the dovecot side on TCP on 127.0.0.1 and have postfix use that? Just to see if it works? If so, how do I tell postfix to do that? In dovecot I have added the tcp: service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } unix_listener /var/spool/postfix/private/lmtp { mode = 0660 user = postfix group = postfix } } service lmtp { executable = lmtp -L } protocol lmtp { info_log_path = /var/log/mail/dovecot-lmtp.log } Any other tips? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 8

Migrating, syncing, maybe load-balancing/failover two dovecot servers?
by Gerben Wierda 05 Jan '23

05 Jan '23

I am in the process of migrating from dovecot on one OS (macOS/darwin) to a new server running dovecot with another OS (Ubuntu Linux 22.4). I have mostly copied/adapted the setup of the old server to the new. I am in the process of finishing that and adding some stuff that still needs to be added/migrated, like rspamd. And the data of course before the new one takes over from the old. I have done a migration before (MacOS X Server dovecot to MacPorts dovecot on macOS), many years ago, I recall that I used dovecot syncing but also rsync and I don't really recall (and anyway, the software has changed since) I have been thinking about keeping them both alive, with one as a failover for the other. They will not share their storage (e.g. NFS), So, I was wondering if I can do something with syncing between instances and dovecot director. I have been looking at the documentation, but a quick scan reveals I cannot locate some sort of tutorial and I am uncertain what will work and what not. If keeping both alive in parallel is too problematic, it is OK to have regular syncing in one direction (old to new) at first and then switch over and have syncing in the other direction (new to old) Can someone enlighten me? Gerben Wierda (LinkedIn <https://www.linkedin.com/in/gerbenwierda>) R&A IT Strategy <https://ea.rna.nl/> (main site) Book: Chess and the Art of Enterprise Architecture <https://ea.rna.nl/the-book/> Book: Mastering ArchiMate <https://ea.rna.nl/the-book-edition-iii/>

4 5