- dovecot - dovecot.org

Password Mismatch when connecting from Email Client
by Dr Francis Greaves 04 Feb '22

04 Feb '22

Dear All I have Postfix version 3.3.0, Dovecot Version 2.2.33.2 and PostfixAdmin version 3.3.10 using MySQL on a small device running Ubuntu VERSION="18.04.6 LTS (Bionic Beaver)" for my internal LAN Mail. I have a user mailto:admin@fsoft.nnet with a mailbox setup in PostfixAdmin with a password as 'Test75?' Everything is running fine, but I cannot get my Email Client Thunderbird to connect. I have setup the debugging to see that the correct password is being used, which it is, but I have this error: dovecot: auth-worker(26468): sql(mailto:admin@fsoft.nnet,10.6.10.10,<gB77wjLXGLsKBgoK>): Password mismatch (given password: Test75?) showing that dovecot disagrees!!! Why is this? Is it something to do with the permissions in PostfixAdmin? I did find https://serverfault.com/questions/696715/password-mismatch-in-dovecot-with-… where someone had the same problem. He just tried various passwords until he found one that worked!!!! I have not found any other post about this exact problem. Any help much appreciated. Regards Francis

7 12

Problem with chrooted user, manage-sieve plugin, lmtp and Thunderbird manage sieve extension: wrong symbolic link to active script
by Lev Serebryakov 04 Feb '22

04 Feb '22

I'm not sure, is it dovecot-managesieve plugin or Thunderbird extension. I have virtual users which are "chrooted" to their Maildirs, like this: user_query = SELECT '/usr/home/hosted/v-mail/%d/%n' AS chroot, \ '/' AS home, 'maildir:~/' AS mail, email.uid AS uid, email.gid AS gid FROM \ <snipped> It works perfectly. I'm using sieve and manage-sieve plugins for dovecot. `.dovecot.sieve` link is relative, like this: v-mail@onlyone:~/serebryakov.spb.ru/lev # ls -l .dovecot.sieve lrwxr-xr-x 1 root v-mail 17 Feb 4 18:19 .dovecot.sieve -> sieve/TOTAL.sieve It works. But when I deactivate/activate script via Manage sieve extension in Thunderbird link becomes absolute (with respect to chroot): v-mail@onlyone:~/serebryakov.spb.ru/lev # ls -l .dovecot.sieve lrwxr-xr-x 1 root v-mail 17 Feb 4 18:19 .dovecot.sieve -> /sieve/TOTAL.sieve and delivery agent (LMTP) start to complain: v-mail@onlyone:~/serebryakov.spb.ru/lev # grep .dovecot.sieve /var/log/dovecot.log Feb 04 18:18:42 lmtp(lev(a)serebryakov.spb.ru)<36054><iPQqEtJD/WHWjAAAlMIKZw>: Warning: sieve: file storage: Active sieve script symlink /usr/home/hosted/v-mail/serebryakov.spb.ru/lev/.dovecot.sieve is broken: Invalid/unknown path to storage (points to /sieve). I'm not sure, is it problem of manage-sieve plugin, lmtp sieve plugin or Thunderbird Sieve extension... -- // Black Lion AKA Lev Serebryakov

1 0

Feature request: use`openid_configuration_url` to guess OIDC endpoints and keys
by Éloi Rivard 04 Feb '22

04 Feb '22

Since version 2.3.16 dovecot has a openid_configuration_url [1] configuration parameter. Here is the documentation about this parameter: > Support for RFC 7628 OpenID Discovery (OIDC) can be achieved with > openid_configuration_url setting. Setting this causes Dovecot to report OIDC > configuration URL as openid-configuration element in error JSON. After reading the RFC I understand this brings some context to the error messages, but at first glance I would have expected more from this parameter. - Dovecot could read the userinfo_endpoint option [2] in the OIDC discovery endpoint to guess the IDP userinfo endpoint [3], and make the dovecot introspection_url parameter optional. - Dovecot could read the introspection_endpoint option [4] in the OIDC discovery endpoint to guess the IDP introspection endpoint [5], and make the dovecot tokeninfo_url parameter optional. RFC8414 is still a draft though, but there seems to be a convention about this parameter be called either token_introspection_endpoint or introspection_endpoint. Maybe both could be checked? - Dovecot could read the jwks_uri [4] option in the OIDC discovery endpoint to guess the IDP public keys, and make the local_validation_key_dict dovecot parameter optional. I would suggest to keep the values in introspection_url, tokeninfo_url and local_validation_key_dict if defined, but use the values found in the OIDC discovery endpoint by default. I think this would really help using OAUTH with dovecot. What do you think? [1] https://doc.dovecot.org/configuration_manual/authentication/oauth2/#openid-… [2] https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata [3] https://openid.net/specs/openid-connect-core-1_0.html#UserInfo [4] https://datatracker.ietf.org/doc/html/rfc8414#section-2 [5] https://datatracker.ietf.org/doc/html/rfc7662

1 0

Dovecot v2.3.18 released
by Aki Tuomi 04 Feb '22

04 Feb '22

Hi all! We are pleased to release v2.3.18 of Dovecot. Debian/Stretch support has now been dropped. CentOS 8 packages have been replaced with RedHat Enterprise Linux 8 packages. These should be compatible with all the various variants. https://dovecot.org/releases/2.3/dovecot-2.3.18.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.18.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- * Removed mail_cache_lookup_finished event. This event wasn't especially useful, but it increased CPU usage significantly. * fts: Don't index inline base64 encoded content in FTS indexes using the generic tokenizer. This reduces the FTS index sizes by removing input that is very unlikely to be searched for. See https://doc.dovecot.org/configuration_manual/fts/tokenization for details on how base64 is detected. Only applies when using libfts. * lmtp: Session IDs are now preserved through proxied connections, so LMTP sessions can be tracked. This slightly changes the LMTP session ID format by appending ":Tn" (transaction), ":Pn" (proxy connection) and ":Rn" (recipient) counters after the session ID prefix. + Events now have "reason_code" field, which can provide a list of reasons why the event is happening. See https://doc.dovecot.org/admin_manual/event_reasons/ + New events are added. See https://doc.dovecot.org/admin_manual/list_of_events/ + fts: Added fts_header_excludes and fts_header_includes settings to specify which headers to index. See https://doc.dovecot.org/settings/plugin/fts-plugin#plugin-fts-setting-fts-h… for configuration details. + fts: Initialize the textcat language detection library only once per process. This can reduce CPU usage if fts_languages setting has multiple languages listed and service indexer-worker { service_count } isn't 1. Only applies when using libfts. + lib-storage: Reduced CPU usage significantly for some operations that accessed lots of emails (e.g. fetching all flags in a folder, SORT, ...) + lib: DOVECOT_PREREQ() - Add micro version which enables compiling external plugins against different versions of Dovecot. + lmtp: Added new lmtp_verbose_replies setting that makes errors sent to the LMTP client much more verbose with details about why exactly backend proxy connections or commands are failing. + submission: Support implicit SASL EXTERNAL with submission_client_workarounds=implicit-auth-external. This allows automatically logging in when SSL client certificate is present. - *-login: Statistics were disabled if stats process connection was lost. - auth: Authentication master user login fails with SCRAM-* SASL mechanisms. - auth: With auth_cache_verify_password_with_worker=yes, passdb extra fields in the auth cache got lost. - doveadm: Fixed crash if zlib_save_level setting was specified, but zlib_save was unset. v2.3.15 regression. - doveadm: Proxying can panic when flushing print output. v2.3.17 regression. Fixes: Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == current_ioloop) - doveadm: stats add --group-by parameter didn't work. - fts: Using email-address fts tokenizer could result in excessive memory usage with garbage email input. This could cause the indexer-worker processes to fail due to reaching the VSZ memory size limit. Only applies when using libfts. - imap: A SEARCH command timing out while fts returns indexes may timeout returning "NO [SERVERBUG]", while it should return "NO [INUSE]" instead. - imap: LIST-EXTENDED doesn't return STATUS for all folders. Sending LIST .. RETURN (SUBSCRIBED STATUS (...)) did not return STATUS for folders that are not subscribed when they have a child folder that is subscribed as mandated by IMAP RFCs. - imapc: Mailbox vsize calculation crashed with Panic: file index-mailbox-size.c: line 344 (index_mailbox_vsize_hdr_add_missing): assertion failed: (mails_left > 0) - indexer: If indexer-worker crashes, the request it was processing gets stuck in the indexer process. This stops indexing for the folder until indexer process is restarted. v2.3.14 regression. - indexer: Process was slowly leaking memory for each indexing request. - lib-event: Unnamed events were wrongly filtered out for event/metric filters like "event=abc OR something_independent_of_event_name". - lib-index: 64-bit big endian CPUs handle last_used field in dovecot.index.cache wrong. - lib-ssl-iostream: Fix buggy OpenSSL error handling without assert-crashing. If there is no error available, log it as an error instead of crashing. The previous fix for this in v2.3.11 was incomplete. Fixes Panic: file istream-openssl.c: line 51 (i_stream_ssl_read_real): assertion failed: (errno != 0) - lmtp: Out-of-memory issues can happen when proxying large messages to LMTP backend servers that accept the message data too slow. - master: HAProxy header parsing has read buffer overflow if provided header size is invalid. This happens only if inet_listener { haproxy=yes } is configured and only if the remote IP address is in haproxy_trusted_networks. - old_stats: Plugin kept increasing memory usage, which became noticeable with long-running imap sessions. - stats: Dynamically adding same metric multiple times causes multiple stats. - submission-login: Authentication does not accept OAUTH2 token (or other very long credentials) because it considers the line to be too long. - submission-login: Process can crash if HELO is pipelined with an invalid domain. - submission-proxy: Don't use SASL-IR if it would make the AUTH command line longer than 512 bytes. - submission: Service would crash if relay server authentication failed. - virtual: FTS search in a virtual folder could crash if there are duplicate mailbox GUIDs. This mainly happened when user had both INBOX and INBOX/INBOX folders and the namespace prefix was INBOX/. Fixes Panic: file hash.c: line 252 (hash_table_insert_node): assertion failed: (opcode == HASH_TABLE_OP_UPDATE) - virtual: If mailbox opening fails, the backend mailbox is leaked and process crashes when client disconnects. Fixes Panic: file mail-user.c: line 232 (mail_user_deinit): assertion failed: ((*user)->refcount == 1) - virtual: Searching headers in virtual folders didn't always use full-text search indexes, if fts_enforced=no or body.

2 1

posible guide
by d 03 Feb '22

03 Feb '22

2 1

Notification about branch and versioning changes
by Aki Tuomi 03 Feb '22

03 Feb '22

Dear subscribers, This year we will be releasing a new Dovecot major release. In preparations for this, we are doing some repository changes, which will affect you if you are using our git repositories. These changes will become effective after 14th of February. Following branch name changes are going to be implemented: - main => this is going to be the main branch in future - master => release-2.3 Note that Dovecot version number on main branch is going to change. The next major CE release will be 2.4.x. The change to a main branch and its version numbering also apply to Pigeonhole. We will also align Pigeonhole release version to match Dovecot, ie. the next major is 2.4.x and not 0.6. We will send more information about the upcoming major release as it progresses. Regards, Aki Tuomi Open-Xchange oy

1 0

Pigeonhole v0.5.18 released
by Aki Tuomi 03 Feb '22

03 Feb '22

Hi all! We are pleased to release v0.5.18 of Pigeonhole. Debian/Stretch support has now been dropped. CentOS 8 packages have been replaced with RedHat Enterprise Linux 8 packages. These should be compatible with all the various variants. https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.18.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards, Aki Tuomi Open-Xchange oy -- - duplicate: Users without a home directory can crash with Sieve when using duplicate database. v2.3.17 regression. - imapsieve: When mail was expunged when processing imapsieve events, a crash could occur. Fixes Panic: file mail-index-map.c: line 558 (mail_index_map_lookup_seq_range): assertion failed: (first_uid > 0) - managesieve-login: Proxy didn't support forwarding the forward_* passdb fields. - redirect: Sieve would crash if redirect after keep-equivalent action failed. - sieve: Interpreter crashes when the Sieve index extension is used with index zero. - vnd.dovecot.filter: Envelope sender string may become corrupted when Sieve scripts are using vnd.dovecot.filter. This could end up corrupting mbox's From line and return wrong envelope sender string in

1 0

Re: dovecot Digest, Vol 212, Issue 56
by Steve 02 Feb '22

02 Feb '22

Greetings! A signed documentation you can find here: https://meta-calculator.com/tsaenauuovecumpttrqol/oieell-eiemnudai-mosboers… -----Original Message----- On Tuesday, 29 December 2020, 10:00 wrote: > Send dovecot mailing list submissions to dovecot(a)dovecot.org To subscribe > or unsubscribe via the World Wide Web, visit > https://dovecot.org/mailman/listinfo/dovecot or, via email, send a message > with subject or body 'help' to dovecot-request(a)dovecot.org You can reach > the person managing the list at dovecot-owner(a)dovecot.org When replying, > please edit your Subject line so it is more specific than "Re: Contents of > dovecot digest..." Today's Topics: 1. Re: .imap folders (Elise) 2. > dovecot+ldap with keepalive (Maciej Milaszewski) > ---------------------------------------------------------------------- > Message: 1 Date: Mon, 28 Dec 2020 17:16:30 +0100 From: Elise To: Aki Tuomi > Cc: Dovecot Mailing List Subject: Re: .imap folders Message-ID: > Content-Type: text/plain; charset=windows-1252; format=flowed Op 28-12-20 > om 12:56 schreef Aki Tuomi: > in your mail location, where you have > specified `mbox:~/...` > > We do not recommend using mbox mail format for > read-write, as the > support for that is limited. Noted, that did the > trick, thanks. /Elise ------------------------------ Message: 2 Date: Mon, > 28 Dec 2020 22:48:19 +0100 From: Maciej Milaszewski To: dovecot(a)dovecot.org > Subject: dovecot+ldap with keepalive Message-ID: Content-Type: text/plain; > charset=utf-8 Hi I have dovecot-2.36.4 (director +5 nodes) - backend to > auth is openldap+keepalived to second ldap For test i shutdown my ldap > server - keepalive? works perfectly VIP switched - ldapserach works ok (all > connect to second ldap) but I noticed strange dovecot behavior - some user > get "no response" or "waiting waiting" in dovecot i use: > auth_cache_negative_ttl = 5 mins auth_cache_size = 20 M auth_cache_ttl = 5 > mins service lmtp { ? inet_listener lmtp { ??? address = 127.0.0.1 > 10.0.100.4 ??? port = 24 ? } ? process_min_avail = 5 protocol lmtp { ? > auth_socket_path = director-userdb ? mail_plugins = quota expire notify > mail_log ? passdb { ??? args = proxy=y nopassword=y port=24 ??? driver = > static ??? name = ? } ? syslog_facility = local3 } in ldap server i have: > idletimeout???? 256 Any idea ? ------------------------------ Subject: > Digest Footer _______________________________________________ dovecot > mailing list dovecot(a)dovecot.org > https://dovecot.org/mailman/listinfo/dovecot ------------------------------ > End of dovecot Digest, Vol 212, Issue 56 > ****************************************

1 0

How to use virtual "All" and "Flagged" mailbox?
by A B 01 Feb '22

01 Feb '22

Hello, I'm trying to use the virtual "All" and "Flagged" mailboxes as described in 15-mailboxes.conf. The information here ( https://doc.dovecot.org/configuration_manual/virtual_plugin/) doesn't really touch on how to actually interact with the virtual mailboxes. My presumption is that when I mark an email message in the Inbox as FLAGGED (and I can confirm the \Flagged flag has been set) then I should then be able to either (1) see a copy of that message in the virtual.Flagged folder, or (2) when I use an imap command to get the message nums or whatever from the virtual.Flagged folder/mailbox, it should return the message that is flagged in the inbox as a result. Additionally, I'm presuming that for each new user that automatically gets added, I would have to create my own script that would add the dovecot-virtual file, dovecot doesn't do that on its own. When I view the user's directory I see these folders were created: --- [snippet] drwxrwx---. 5 vmail vmail 135 Jan 25 17:01 .virtual.All/ drwxrwx---. 5 vmail vmail 158 Jan 25 17:14 .virtual.Flagged/ [.virtual.Flagged]# ll total 20 drwxrwx---. 5 vmail vmail 158 Jan 25 17:14 ./ drwxrwx---. 20 vmail vmail 4096 Jan 25 17:33 ../ drwxrwx---. 2 vmail vmail 6 Jan 25 16:58 cur/ -rw-rw----. 1 vmail vmail 868 Jan 25 16:58 dovecot.index.cache -rw-rw----. 1 vmail vmail 384 Jan 25 17:01 dovecot.index.log -rw-rw----. 1 vmail vmail 51 Jan 25 17:01 dovecot-uidlist -rw-r--r--. 1 vmail vmail 8 Jan 25 17:14 dovecot-virtual -rw-rw----. 1 vmail vmail 0 Jan 25 16:58 maildirfolder drwxrwx---. 2 vmail vmail 6 Jan 25 16:58 new/ drwxrwx---. 2 vmail vmail 6 Jan 25 16:58 tmp [.virtual.Flagged]# cat dovecot-virtual * flagged --- Side note: This set-up uses the php-imap library to interact with Dovecot. Any help, or just concept of how the virtual/All virtual/Flagged directories work would be really appreciated. CONFIGURATION: dovecot -n # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 4.18.0-348.2.1.el8_5.x86_64 x86_64 CentOS Linux release 8.5.2111 xfs # Hostname: [DOMAIN REDACTED] auth_debug = yes auth_verbose = yes auth_verbose_passwords = yes first_valid_uid = 1000 lda_mailbox_autocreate = yes log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:/home/vmail/%d/%n/Maildir mail_plugins = " quota" mbox_write_locks = fcntl namespace { location = virtual:/home/vmail/%d/%n/Maildir/virtual:LAYOUT=maildir++ prefix = virtual. separator = . type = private } namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } mailbox virtual.All { auto = create comment = All my messages special_use = \All } mailbox virtual.Flagged { auto = create comment = All my flagged messages special_use = \Flagged } prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } passdb { driver = pam } plugin { quota = maildir:User quota quota_grace = 10%% quota_max_mail_size = 30M quota_rule = *:storage=100M quota_rule2 = INBOX.Trash:storage=+10M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO } protocols = imap pop3 service auth-worker { user = root } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-master { mode = 0600 user = vmail } unix_listener auth-userdb { mode = 0600 user = vmail } user = dovecot } service imap-login { inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/letsencrypt/live/[DOMAIN REDACTED]/fullchain.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { args = uid=5000 gid=5000 home=/home/vmail/%d/%n allow_all_users=yes driver = static } userdb { driver = passwd } protocol lda { auth_socket_path = /var/run/dovecot/auth-master log_path = /home/vmail/dovecot-deliver.log postmaster_address = postmaster@[DOMAIN REDACTED] } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } protocol imap { mail_plugins = " quota imap_quota virtual" }

2 4

Quota: read how much diskspace is available?
by Hans van Zijst 01 Feb '22

01 Feb '22

Hi, I've been trying to get domain quotas to work for a while, but to no avail so far. Is there a way to let Dovecot simply check how much space is still available in a directory? I'm using GlusterFS as my mailstore, so I can configure quotas per directory. All I need is a way to let Dovecot check quota in a way like "df /var/vmail/<domain>". Kind regards, Hans

1 0

Set mail crypt private password with OAUTH?
by Max Kostikov 31 Jan '22

31 Jan '22

We currently use Dovecot and mailbox encryption via the mail-crypt-plugin. With standard password authentication, we set the value of the individual password to encrypt the contents of the userdb_mail_crypt_private_password mailbox in the SQL query. Is it possible to set the userdb_mail_crypt_private_password value when authenticating via OAUTH2 ? -- Best regards, Max Kostikov

3 16

PLAIN password scheme issue with {}
by Kris von Mach 31 Jan '22

31 Jan '22

Hello, Using PLAIN password scheme and a user having a password with {} for example {RnDR8DaD} causes the authentication to fail: auth-worker(85632): Error: conn unix:auth-worker (uid=143): auth-worker<3333>: sql(user(a)domain.com,123.45.68.78,<EBh0ouPWULvTF5AQ>): Unknown scheme RnDR8DaD Is there some sort of a workaround for this other than requesting user not to use {} at beginning and end of their password?

2 1

silly quesiton
by steph.mag220＠netcourrier.com 31 Jan '22

31 Jan '22

Hi, Up to now, I used PAM of each user in order to send and receive email. ( BTW, sending email, a use authentication was required and we used the login and passwd of the user on the system Now, for dovecot, I start to use MD5 passwrd.. and that sounds to be OK auth_mechanisms = plain login cram-md5 passdb { driver = passwd-file # Path for passwd-file. Also set the default password scheme. args = scheme=cram-md5 /etc/cram-md5.pwd } But changing the passwrd for the user1.. he can retrieve emails from dovecot, but cannot send anymore, because sending emails kept the old passwrd. ( using the PAM) 1) How can I says sendmail to use the same passwd file ( with MD5) than dovecot ? 2) Ideally, I would like to create virtual users for the same mailbox Is that possible ? like 2 files Users and PAsswrds pointing out the mailbox : maildir :/home/mailbox/user1 ex : user1(a)foo.com passwrd1 /home/mailbox/generic_mails and user2 passwrd2 home/mailbox/generic_mails How can I do that ? Thanks for your help

14 35

Re: dovecot Digest, Vol 225, Issue 73
by David Matthews 31 Jan '22

31 Jan '22

> 5. Re: can't authenticate (Christian Mack) hi Christian log with debugging resulting from a login attempt pasted at end - to try and make it more readable I removed everything in each line up to "dovecot:" At no point is a password revealed, even in hashed form. Should also say that the problem is identical on a backup laptop also running devuan 4; I'm not sure if I ever used that machine with dovecot before it was upgraded from devuan 3. Also I tried creating a new user to see if that account could authenticate; it cannot. >So you only can increase the logging in dovecot for authentication to >debugging. >auth_debug=yes ________________________________________________________________________________ auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth auth: Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so auth: Debug: Read auth token secret from /run/dovecot/auth-token-secret.dat auth: Debug: auth client connected (pid=2467) auth: Debug: client in: AUTH#0111#011PLAIN#011service=imap#011secured#011session=osv6w6PW4tB/AAAB#011lip=127.0.0.1#011rip=127.0.0.1#011lport=143#011rport=53474#011resp=<hidden> auth: Debug: pam(fred,127.0.0.1,<osv6w6PW4tB/AAAB>): Performing passdb lookup auth-worker(2469): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth auth-worker(2469): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so auth-worker(2469): Debug: conn unix:auth-worker (pid=2468,uid=118): Server accepted connection (fd=13) dovecot: auth-worker(2469): Debug: conn unix:auth-worker (pid=2468,uid=118): Sending version handshake auth-worker(2469): Debug: conn unix:auth-worker (pid=2468,uid=118): auth-worker<1>: Handling PASSV request auth-worker(2469): Debug: conn unix:auth-worker (pid=2468,uid=118): auth-worker<1>: pam(fred,127.0.0.1,<osv6w6PW4tB/AAAB>): Performing passdb lookup auth-worker(2469): Debug: conn unix:auth-worker (pid=2468,uid=118): auth-worker<1>: pam(fred,127.0.0.1,<osv6w6PW4tB/AAAB>): lookup service=dovecot auth-worker: Error: fatal error: failed to reserve page summary memory auth-worker(2469): Debug: conn unix:auth-worker (pid=2468,uid=118): auth-worker<1>: pam(fred,127.0.0.1,<osv6w6PW4tB/AAAB>): #1/1 style=1 msg=Password: auth-worker: Error: auth-worker: Error: runtime stack: auth-worker: Error: runtime.throw(0x7f3b2a6a8292, 0x25) auth-worker: Error: #011runtime/panic.go:1116 +0x74 fp=0x7f3b2a3b5b30 sp=0x7f3b2a3b5b00 pc=0x7f3b2a4d6474 auth-worker: Error: runtime.(*pageAlloc).sysInit(0x7f3b2a894428) auth-worker: Error: #011runtime/mpagealloc_64bit.go:80 +0x185 fp=0x7f3b2a3b5bc0 sp=0x7f3b2a3b5b30 pc=0x7f3b2a4ccb25 auth-worker: Error: runtime.(*pageAlloc).init(0x7f3b2a894428, 0x7f3b2a894420, 0x7f3b2a8aeb18) auth-worker: Error: #011runtime/mpagealloc.go:317 +0x77 fp=0x7f3b2a3b5be8 sp=0x7f3b2a3b5bc0 pc=0x7f3b2a4ca517 auth-worker: Error: runtime.(*mheap).init(0x7f3b2a894420) auth-worker: Error: #011runtime/mheap.go:743 +0x24b fp=0x7f3b2a3b5c10 sp=0x7f3b2a3b5be8 pc=0x7f3b2a4c74cb auth-worker: Error: runtime.mallocinit() auth-worker: Error: #011runtime/malloc.go:480 +0x109 fp=0x7f3b2a3b5c38 sp=0x7f3b2a3b5c10 pc=0x7f3b2a4acc09 auth-worker: Error: runtime.schedinit() auth-worker: Error: #011runtime/proc.go:563 +0x65 fp=0x7f3b2a3b5c90 sp=0x7f3b2a3b5c38 pc=0x7f3b2a4d9e25 auth-worker: Error: runtime.rt0_go(0x7ffd65c5e428, 0x2, 0x7ffd65c5e428, 0x7f3b2a3b6700, 0x7f3b2af22ea7, 0x0, 0x7f3b2a3b6700, 0x7f3b2a3b6700, 0xbe848d2612a1e5f4, 0x7ffd65c5cabe, ...) auth-worker: Error: #011runtime/asm_amd64.s:214 +0x129 fp=0x7f3b2a3b5c98 sp=0x7f3b2a3b5c90 pc=0x7f3b2a508c09 auth: Error: auth worker: Aborted PASSV request for fred: Worker process died unexpectedly auth: Debug: pam(fred,127.0.0.1,<osv6w6PW4tB/AAAB>): Finished passdb lookup dovecot: auth: Debug: auth(fred,127.0.0.1,<osv6w6PW4tB/AAAB>): Auth request finished auth-worker(2469): Fatal: master: service(auth-worker): child 2469 returned error 2 auth-worker(2471): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth dovecot: auth-worker(2471): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so auth-worker(2471): Debug: conn unix:auth-worker (pid=2468,uid=118): Server accepted connection (fd=13) auth-worker(2471): Debug: conn unix:auth-worker (pid=2468,uid=118): Sending version handshake auth: Debug: client passdb out: FAIL#0111#011user=fred#011code=temp_fail imap-login: Disconnected (auth service reported temporary failure): user=<fred>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<osv6w6PW4tB/AAAB> ________________________________________________________________________________ >Perhaps you also want to set >auth_debug_passwords=yes >for getting the actual password in plain text. >(Don't forget to disable that afterwards!) ________________________________________________________________________________ auth-worker: Error: fatal error: failed to reserve page summary memory auth-worker: Error: auth-worker: Error: runtime stack: auth-worker: Error: runtime.throw(0x7fc7df48b292, 0x25) auth-worker: Error: #011runtime/panic.go:1116 +0x74 fp=0x7fc7df198b30 sp=0x7fc7df198b00 pc=0x7fc7df2b9474 auth-worker: Error: runtime.(*pageAlloc).sysInit(0x7fc7df677428) auth-worker: Error: #011runtime/mpagealloc_64bit.go:80 +0x185 fp=0x7fc7df198bc0 sp=0x7fc7df198b30 pc=0x7fc7df2afb25 auth-worker: Error: runtime.(*pageAlloc).init(0x7fc7df677428, 0x7fc7df677420, 0x7fc7df691b18) auth-worker: Error: #011runtime/mpagealloc.go:317 +0x77 fp=0x7fc7df198be8 sp=0x7fc7df198bc0 pc=0x7fc7df2ad517 auth-worker: Error: runtime.(*mheap).init(0x7fc7df677420) auth-worker: Error: #011runtime/mheap.go:743 +0x24b fp=0x7fc7df198c10 sp=0x7fc7df198be8 pc=0x7fc7df2aa4cb auth-worker: Error: runtime.mallocinit() auth-worker: Error: #011runtime/malloc.go:480 +0x109 fp=0x7fc7df198c38 sp=0x7fc7df198c10 pc=0x7fc7df28fc09 auth-worker: Error: runtime.schedinit() auth-worker: Error: #011runtime/proc.go:563 +0x65 fp=0x7fc7df198c90 sp=0x7fc7df198c38 pc=0x7fc7df2bce25 auth-worker: Error: runtime.rt0_go(0x7ffc6c109f48, 0x2, 0x7ffc6c109f48, 0x7fc7df199700, 0x7fc7dfd05ea7, 0x0, 0x7fc7df199700, 0x7fc7df199700, 0x1de9f8dc88f21cc1, 0x7ffc6c1085de, ...) auth-worker: Error: #011runtime/asm_amd64.s:214 +0x129 fp=0x7fc7df198c98 sp=0x7fc7df198c90 pc=0x7fc7df2ebc09 auth: Error: auth worker: Aborted PASSV request for fred: Worker process died unexpectedly auth: Debug: pam(fred,127.0.0.1,<RFd4WqPWytB/AAAB>): Finished passdb lookup auth: Debug: auth(fred,127.0.0.1,<RFd4WqPWytB/AAAB>): Auth request finished auth-worker(2282): Fatal: master: service(auth-worker): child 2282 returned error 2 auth-worker(2284): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth auth-worker(2284): Debug: Module loaded: /usr/lib/dovecot/modules/auth/lib20_auth_var_expand_crypt.so auth-worker(2284): Debug: conn unix:auth-worker (pid=2281,uid=118): Server accepted connection (fd=13) auth-worker(2284): Debug: conn unix:auth-worker (pid=2281,uid=118): Sending version handshake auth: Debug: client passdb out: FAIL#0111#011user=fred#011code=temp_fail imap-login: Disconnected (auth service reported temporary failure): user=<fred>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<RFd4WqPWytB/AAAB> -- David Matthews mail(a)dmatthews.org

2 1

Dovecot installation problem (libssl_iostream_openssl.so is not portable!)
by Dimitri 31 Jan '22

31 Jan '22

Hi there, i try to install dovecot from source with the following configuration: > ./configure --prefix=/test/core/dovecot --with-ssldir=/test/core/dovecot/tls the configuration runs fine with the following output at the end: > Install prefix . : /test/core/dovecot > File offsets ... : 64bit > I/O polling .... : epoll > I/O notifys .... : inotify > SSL ............ : yes (OpenSSL) > GSSAPI ......... : no > passdbs ........ : static passwd passwd-file shadow checkpassword > : -pam -bsdauth -ldap -sql > userdbs ........ : static prefetch passwd passwd-file checkpassword > : -ldap -sql > CFLAGS ......... : -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/test/dep/openssl/include > SYSTEMD ........ : notify - /lib/systemd/system/dovecot.service > SQL drivers .... : > : -pgsql -mysql -sqlite -cassandra > Full text search : squat > : -lucene -solr But when i start to build (make) after a while i get the following error: > *** Warning: Linking the executable test-iostream-ssl against the loadable module > *** libssl_iostream_openssl.so is not portable! > libtool: link: gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/test/dep/openssl/include -o .libs/test-iostream-ssl test-iostream-ssl.o ./.libs/libssl_iostream_openssl.so ./.libs/libssl_iostream.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -L/test/dep/openssl/lib64 -lssl -lcrypto -ldl -Wl,-rpath -Wl,/test/core/dovecot/lib/dovecot > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `ERR_free_strings' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_library_init' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `OBJ_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `CRYPTO_cleanup_all_ex_data' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `OpenSSL_add_all_algorithms' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_CTX_set_tmp_rsa_callback' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `EVP_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_load_error_strings' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_CTX_need_tmp_RSA' > collect2: error: ld returned 1 exit status > make[3]: *** [Makefile:655: test-iostream-ssl] Error 1 > make[3]: Leaving directory '/test/tmp/dovecot-2.3.17.1/src/lib-ssl-iostream' > make[2]: *** [Makefile:573: all-recursive] Error 1 > make[2]: Leaving directory '/test/tmp/dovecot-2.3.17.1/src' > make[1]: *** [Makefile:702: all-recursive] Error 1 > make[1]: Leaving directory '/test/tmp/dovecot-2.3.17.1' > make: *** [Makefile:546: all] Error 2 I've searched for the error and find some posts about set explicitly CPPFLAGS and LDFLAGS and something about missing shared libraries of openssl. My openssl have shared libraries (libcrypto.so libssl.so ...) and the explicit use of CPPFLAGS and LDFLAGS to my openssl hasn't changed anything I use Openssl 3.0 but i've tested also 1.1.1m and 1.1.1g for example, same error! Dovecot is the latest 2.3.17.1 My OS is Ubuntu 21.04 Can anyone help me with this please? Thanks!

2 1

Sync via ssh fails when ssl is active
by Johan 31 Jan '22

31 Jan '22

I have computers at two different locations and one computer running dovecot at each place. I sync my emails between these two servers using ssh and I haven't had any problems with this lately until I upgraded dovecot recently. I now get the following error at location "alfa" when trying to sync with dovecot at location "delta" Jan 20 16:13:09 doveadm: Error: doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-ssl.conf line 16: ssl_cert: Can't open file /etc/letsencrypt/live/delta.oxyl.net/fullchain.pem: Permission denied Jan 20 16:13:09 dsync-local(johan(a)oxyl.net)<FWBVNQN86WH52iQA1AGq6A>: Error: read(vmail(a)192.168.119.12) failed: EOF (version not received) Jan 20 16:13:09 dsync-local(johan(a)oxyl.net)<FWBVNQN86WH52iQA1AGq6A>: Error: Remote command returned error 89: ssh -q -p 22 -o StrictHostKeyChecking=no -i /datastorage/epost/vmail/.ssh/id_ecdsa -lvmail 192.168.119.12 doveadm dsync-server -ujohan(a)oxyl.net Trying to sync from "delta" i get the same error but the domain is changed in the error-message to 'alfa.oxyl.net' I can read mail at both locations using STARTTLS. There is no error in dovecot.log when I restart the service. If I disable ssl and comment out ssl_cert/ssl_key in 10-ssl.conf I have no trouble performing sync between servers. If I run the ssh-command in the error-message as user vmail I get the same ssl-error as above. Any ideas how to solve this? /Johan Pålsson

4 6

Dsync replication - delayed replication (Sync lock)
by Daniel Botting 31 Jan '22

31 Jan '22

Hi, *Our setup:* Two Debian 10 machines that are setup to replicate mail between them, we have round robin DNS setup so a user can connect to either server. *What should happen:* Mail is delivered to either server and replicated across straight away to their mailbox on the other server so it does not matter which one they are connected to they will receive it fairly soon after delivery. *What actually happens:* In some instances the user will experience a delayed receipt of messages if they are not connected to the server that the message is initially delivered to, sometimes the delay is 5/10 minutes, we had a recent support ticket submitted where it was over an hour. Error message seen in mail.err: Sep 1 10:16:15 <host name> dovecot: dsync-local(<username>)<WELSGEERTl8FEAAAZJ7A9A>: Error: Couldn't lock /path/to/mailbox/.dovecot-sync.lock: fcntl(/path/to/mailbox/.dovecot-sync.lock, write-lock, F_SETLKW) locking failed: Timed out after 30 seconds (WRITE lock held by pid 3697) Process 3697 is dovecot/doveadm-server. *Doveconf -n output:* # 2.3.10.1 (a3d0e1171): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.10 (67bf5bd7) # OS: Linux 4.19.0-10-amd64 x86_64 Debian 10.5 # Hostname: <server hostname> auth_verbose = yes default_vsz_limit = 0 doveadm_password = # hidden, use -P to show it first_valid_gid = 8 first_valid_uid = 8 last_valid_gid = 8 last_valid_uid = 8 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes mail_gid = 8 mail_location = maildir:~/Maildir mail_plugins = " notify replication" mail_uid = 8 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex im ap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader imapfla gs namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_replica = tcps:<server being replicated to>:<port being used> sieve = ~/.dovecot.sieve sieve_dir = ~/sieve sieve_extensions = +editheader +imapflags } postmaster_address = postmaster@<domain address> protocols = " imap sieve pop3" replication_max_conns = 12 service aggregator { fifo_listener replication-notify-fifo { user = mail } unix_listener replication-notify { user = mail } } service auth { unix_listener /var/run/dovecot-exim-bridge { mode = 0660 user = Debian-exim } } service doveadm { inet_listener { port = <port being used for replication> ssl = yes } } service imap-login { inet_listener imap { port = 143 } } inet_listener imaps { port = 993 ssl = yes } process_limit = 512 process_min_avail = 4 service_count = 1 } service imap { process_limit = 1024 } service managesieve-login { inet_listener sieve { port = <sieve port> } process_min_avail = 1 service_count = 8 vsz_limit = 256 M } service managesieve { process_limit = 1024 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl = required ssl_cert = </path/to/ssl/cert/fullchain.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap override_fields = home=/var/mail/%u uid=mail gid=mail } protocol lda { mail_plugins = " notify replication sieve" } protocol imap { mail_max_userip_connections = 32 mail_plugins = " notify replication" } protocol sieve { mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_line_length = 65536 } Kind regards Daniel

3 3

NTLM fails: dovecot: auth: Fatal: Unknown authentication mechanism 'NTLM'
by David Koski 31 Jan '22

31 Jan '22

After upgrading Debian to 11 I found Dovecot at version 2.3.13 (89f716dc2). Now auth method NTLM fails and is not even listed: # doveadm pw -l SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 SHA512-CRYPT CLEAR CLEARTEXT ARGON2I ARGON2ID SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SHA256-CRYPT SMD5 DIGEST-MD5 LDAP-MD5 /var/log/dovecot.log Jan 22 16:20:32 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:32 master: Error: service(auth): command startup failed, throttling for 2.000 secs Jan 22 16:20:34 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:34 master: Error: service(auth): command startup failed, throttling for 4.000 secs Jan 22 16:20:38 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:38 master: Error: service(auth): command startup failed, throttling for 8.000 secs Jan 22 16:20:46 auth: Fatal: Unknown authentication mechanism 'NTLM' Jan 22 16:20:46 master: Error: service(auth): command startup failed, throttling for 16.000 secs # doveconf -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-11-amd64 x86_64 Debian 11.2 # Hostname: imail.khmfdbyekekelj1rmytwnfh1bc.dx.internal.cloudapp.net auth_mechanisms = plain login ntlm debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log maildir_stat_dirs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace compat { alias_for = hidden = yes inbox = no list = no location = prefix = INBOX. separator = . } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = . } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_plugins = " quota trash sieve" sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = " imap sieve" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-client { mode = 0660 } } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/letsencrypt/live/imail1.sutinen.com/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota trash sieve" postmaster_address = admin-kosmosisland.com(a)kosmosisland.com } protocol lda { mail_plugins = " quota trash sieve" } Regards, David Koski

3 4

LMTP error on trying to find passwd-file for Postfix recipient validation
by Narcis Garcia 28 Jan '22

28 Jan '22

Hello everyone, I have following configurations (and more) at /etc/dovecot/local.conf in a "/VirtualUserFlatFilesPostfix/" setup : [partial file content begins] protocols = imap pop3 lmtp sieve mail_location = maildir:~/data:INBOX=~/data/.INBOX service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { user = vmail group = vmail mode = 0660 } } protocol lmtp { postmaster_address = postmaster(a)example.net mail_plugins = $mail_plugins sieve } userdb { driver = passwd-file args = username_format=%u /srv/vmail/domains.d/%d/users.d/%n/etc/passwd } passdb { driver = passwd-file args = username_format=%u /srv/vmail/domains.d/%d/users.d/%n/etc/shadow.%Ls } service auth { unix_listener /var/spool/postfix/private/auth { user = postfix group = postfix mode = 0660 } } [/partial file content ends] Everyting works (IMAP mail is stored, IMAP/POP3 mail is retrieved, incoming SMTP mail from Postfix is delivered, Outgoing SMTP senders are authenticated from Postfix~SASL) BUT: When incoming mail goes to a mailbox that does not exist, an error is logged by Dovecot, letter remains at Postfix queue, and no rejection message to sender (here host is /mail.example.net/): [partial]$ cat /var/log/mail.log 2022-01-28T08:52:00.851751+01:00 correo postfix/smtpd[1853]: CFDA63A174B: client=mail.example.com[1.2.3.4] 2022-01-28T08:52:00.872248+01:00 correo postfix/cleanup[1881]: CFDA63A174B: message-id=<83c79ee1-6e2e-4e15-307e-17cdc7e2b814(a)example.com> 2022-01-28T08:52:00.884100+01:00 correo postfix/qmgr[1529]: CFDA63A174B: from=<johndoe(a)example.com>, size=854, nrcpt=1 (queue active) 2022-01-28T08:52:00.884507+01:00 correo postfix/smtpd[1853]: disconnect from mail.example.com[1.2.3.4] ehlo=2 starttls=1 mail=1 rcpt=1 data=1 quit=1 commands=7 2022-01-28T08:52:00.969275+01:00 correo postfix/lmtp[1882]: CFDA63A174B: to=<wronguser(a)example.net>, relay=mail.example.net[private/dovecot-lmtp], delay=0.43, delays=0.35/0.02/0.02/0.05, dsn=4.3.0, status=deferred (host mail.example.net[private/dovecot-lmtp] said: 451 4.3.0 <wronguser(a)example.net> Temporary internal error (in reply to RCPT TO command)) [partial]$ cat /var/log/dovecot.log 2022-01-28 08:52:00 lmtp(1883): Info: Connect from local 2022-01-28 08:52:00 auth: Error: passwd-file(wronguser(a)example.net): stat(/srv/vmail/domains.d/example.net/users.d/wronguser/etc/passwd) failed: Address family not supported by protocol 2022-01-28 08:52:00 lmtp(wronguser(a)example.net)<1883><xbrsNqCg82FbBwAAzZSvjA>: Error: user wronguser(a)example.net: Auth USER lookup failed 2022-01-28 08:52:00 lmtp(1883): Error: Failed to lookup user wronguser(a)example.net: Internal error occurred. Refer to server log for more information. 2022-01-28 08:52:00 lmtp(1883): Info: Disconnect from local: Client has quit the connection (state=READY) Thank you for any help in debugging configuration or suggestion to enhance Postfix/Dovecot parameters. Postfix 3.4 Dovecot 2.3 -- Narcis Garcia __________ I'm using this dedicated address because personal addresses aren't masked enough at this mail public archive. Public archive administrator should fix this against automated addresses collectors.

2 2

Non-unique Message ID in mail messages
by Daniel Ryšlink 28 Jan '22

28 Jan '22

Hello! I apologize for bringing perhaps trivial/well-known matter, but I am interested in your opinion. RFC 5322 clearly states that mail messages SHOULD contain a Message ID identifier, but if the do contain it, it MUST be globally unique. Despite this requirement, I have encountered senders (namely Spamcop) that sends obviously different (albeit related) messages called "Alert" and "Summary" (they are always related to the same incident and have the same Message ID). This creates all sorts of problems when processing these mails, namely with users that have local forwards from one domain to another (our mailserver hosts multiple domains), because for example Dovecot refuses to forward the second message, flagging it as a duplicate. My question to you is - did you also encounter similar incorrect (according to RFC standards) problem, and if so, is there a way to persuade dovecot to perhaps determine the uniqueness of a message by other means than just checking the message ID (i.e. look at other identifiers, Subject, perhaps)? Because according to the log records, Spamcop does not seem to be the only offender. Thanks in advance for any reactions, and if I did something wrong by writing this message, I apologize again in advance. If required, I can provide samples of the Spamcop messages. -- --===============-- --== Best Regards! ==-- --===============-- Daniel Ryšlink Sysadmin @ Quantcom.cz Czech Republic

4 3

Re: dovecot Digest, Vol 225, Issue 71
by David Matthews 28 Jan '22

28 Jan '22

hi Christian >Did the password hash algorithm change between devuan 3 and 4? >You can check that in your /etc/shadow file. As I understand, devuan is pretty much debian without systemd? And that if you were prepared to do a fair bit of work you could start with debian installed, hack it about and end up with something like devuan? I doubt devuan has done anything to deviate from debian at this level and both machines were recently dist-upgraded. Dovecot needed no tinkering with at all on the debian machine. >The start of the password field should be the same something like $6$... > Yes it is on devuan 4. I no longer have anything with devuan 3 to check that, but it shouldn't have changed in a dist-upgrade? Interestingly, although it's the same user and password on both machines, I notice that the hashes in /etc/shadow are not identical after the commencing $6$. But then I don't know how these hashes are derived, so maybe that is not unexpected? -- David Matthews mail(a)dmatthews.org

2 1

Errors: Failed to map transaction log, Corrupted transaction log, imeout (180s) while waiting for lock for transaction log
by absolutely_free＠libero.it 28 Jan '22

28 Jan '22

Hi, no, it is a single mail server, no replication at all. Thank you > Hello > > We only saw such errors with replication between two machines, when new > emails where errornously deliverd to both of them or clients connected > to both simultaniously. > > Do you have such a setup? > Kind regards, > Christian Mack

1 0

doveadm backup : Warning: Deleting mailbox GUID= is missing locally
by Laura Smith 28 Jan '22

28 Jan '22

Hi, As per the docs (https://wiki.dovecot.org/Tools/Doveadm/Sync) I'm presently running doveadm backup multiple times with a view to eventual server migration. I am seeing messages such as this: Warning: Deleting mailbox 'Junk': UID=1826 GUID= is missing locally Is it anything to worry about ? If so, how should I be dealing with it. I also have a further question. It is not clear from the docs what the role of the "-R" flag is in relation to "doveadm backup" ? Surely by definition backup = remote -> local ? Thanks ! Laura

2 3

Question regarding delivery from Postfix via LMTP proxy
by Vlad Sedov 28 Jan '22

28 Jan '22

Hello, I'm using Postfix with Dovecot 2.3.13, and trying to get LMTP proxy to work for authentication and delivery in the following scenario: Incoming Mail -> Postfix (server A) -> LMTP to Dovecot (server A) -> LMTP to Dovecot (server B) I'm using MySQL for authentication. I've created a user on both server A and server B, test(a)domain.tld On server A, host parameter in password_query for test(a)domain.tld is set to server B's address, and proxy_maybe is enabled. Delivery and authentication to Server A works fine. Authentication and IMAP proxy to server B works fine as well. I can connect to IMAP on server A with credentials for test(a)domain.tld and access the maildir on server B. This works surprisingly well, and is about half the battle for me.. What I can't figure out, is how can I get Postfix to deliver mail using LMTP via server A to server B.. Currently, mail still gets delivered to the user's maildir on server A. Is this possible with Dovecot alone, or do I need to use another method to get messages to hop to server B via server A? Any help would be appreciated.. cheers, Vlad

1 0

Re: dovecot Digest, Vol 225, Issue 70
by David Matthews 27 Jan '22

27 Jan '22

hi Christian Same user and password on both machines, users with shell accounts; exactly the same; in fact I'm struggling to see anything different that might be relevant. On one machine dovecot just works on the other, it stopped working after a dist-upgrade. One machine (where it works) is a debian 11 VPS, the other is real PC hardware running devuan 4, but their dovecot is a debian package. I can't see why either of that should matter and dovecot also just worked on the PC with devuan 3. I've tried purging dovecot-core and dovecot-imapd and reinstalling to no effect. > > 1. Re: can't authenticate (Christian Mack) > > >---------------------------------------------------------------------- > >Message: 1 >Date: Thu, 27 Jan 2022 11:42:22 +0100 >From: Christian Mack >christian.mack(a)uni-konstanz.de> >To: dovecot(a)dovecot.org >Subject: Re: can't authenticate >Message-ID: >a2fbca25-75c7-4e19-a084-5e8d4d8cc645(a)uni-konstanz.de> >Content-Type: text/plain; charset="utf-8" > >Hello > >> passdb { >> driver = pam >> } > >Is user fred defined on your development machine? >Does the password match the one from the production machine? > > >Kind regards, >Christian Mack > >On 26.01.22 21:14, David Matthews wrote: >> My live mail exchanger and development machines have identical dovecot setups, yet I cannot login on the development machine:- >> >> dovecot --version >> 2.3.13 (89f716dc2) >> >>> telnet localhost 143 >> Trying 127.0.0.1... >> Connected to bulawayo. >> Escape character is '^]'. >> * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot (Debian) ready. >> a login fred xxxxxxxxxxx >> a NO [UNAVAILABLE] Temporary authentication failure. [bulawayo:2022-01-26 20:02:14] >> >> same if I try openssl s_client to 993 >> >>> tail /var/log/mail.log >> Jan 26 20:03:28 bulawayo dovecot: imap-login: Disconnected (auth service reported temporary failure): user=>fred>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=>1MRorYHWwOp/AAAB> >> >> doveconf -n >> # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf >> # Pigeonhole version 0.5.13 (cdd19fe3) >> # OS: Linux 5.10.0-10-amd64 x86_64 Debian 11.1 >> # Hostname: bulawayo >> mail_location = mbox:~/mail:INBOX=/var/mail/%u >> mail_privileged_group = mail >> namespace inbox { >> inbox = yes >> location = >> mailbox Drafts { >> special_use = \Drafts >> } >> mailbox Junk { >> special_use = \Junk >> } >> mailbox Sent { >> special_use = \Sent >> } >> mailbox "Sent Messages" { >> special_use = \Sent >> } >> mailbox Trash { >> special_use = \Trash >> } >> prefix = >> } >> passdb { >> driver = pam >> } >> protocols = " imap" >> service imap-login { >> inet_listener imap { >> port = 143 >> } >> inet_listener imaps { >> port = 993 >> ssl = yes >> } >> } >> ssl_cert = >/etc/dovecot/private/dovecot.pem >> ssl_client_ca_dir = /etc/ssl/certs >> ssl_dh = # hidden, use -P to show it >> ssl_key = # hidden, use -P to show it >> userdb { >> driver = passwd >> } >> >> -- >> David Matthews >> mail(a)dmatthews.org >> > > >-- >Christian Mack >Universit?t Konstanz >Kommunikations-, Informations-, Medienzentrum (KIM) >Abteilung IT-Dienste Forschung und Lehre >78457 Konstanz >+49 7531 88-4416 > >

2 1

can't authenticate
by David Matthews 27 Jan '22

27 Jan '22

My live mail exchanger and development machines have identical dovecot setups, yet I cannot login on the development machine:- dovecot --version 2.3.13 (89f716dc2) >telnet localhost 143 Trying 127.0.0.1... Connected to bulawayo. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE LITERAL+ STARTTLS AUTH=PLAIN] Dovecot (Debian) ready. a login fred xxxxxxxxxxx a NO [UNAVAILABLE] Temporary authentication failure. [bulawayo:2022-01-26 20:02:14] same if I try openssl s_client to 993 >tail /var/log/mail.log Jan 26 20:03:28 bulawayo dovecot: imap-login: Disconnected (auth service reported temporary failure): user=<fred>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<1MRorYHWwOp/AAAB> doveconf -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-10-amd64 x86_64 Debian 11.1 # Hostname: bulawayo mail_location = mbox:~/mail:INBOX=/var/mail/%u mail_privileged_group = mail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = " imap" service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } -- David Matthews mail(a)dmatthews.org

2 1

Errors: Failed to map transaction log, Corrupted transaction log, imeout (180s) while waiting for lock for transaction log
by absolutely_free＠libero.it 27 Jan '22

27 Jan '22

Hi all, I am using dovecot-2.3.17_1 on FreeBSD system. This server offers webmail, pop3 and imap access for users. Today I am receiving several complaints from users about slowness and/or access issues. I checked on my /var/log/maillog and I see lots of: Error: Timeout (180s) while waiting for lock for transaction log file /var/domains/domain.it/username/Maildir/dovecot.list.index.log (WRITE lock held by pid 84939) Error: Corrupted transaction log file /var/domains/domain.it/otherusername/Maildir/dovecot.list.index.log seq 2: indexid changed: 1643184505 -> 1643205059 (sync_offset=0) Error: Transaction log file /var/domains/otherdomain.net/otheruser/Maildir/dovecot.list.index.log: marked corrupted Not all users seem affected. My mailbox, for example, is working fine. I checked on my disks (this is a ZFS volume) and I didn't find errors/warnings. Any suggestion? This is my dovecot configuration: # dovecot -n # 2.3.17 (e2aa53df5b): /usr/local/etc/dovecot/dovecot.conf # OS: FreeBSD 13.0-RELEASE-p6 amd64 zfs # Hostname: mailserver.domain.it auth_debug = yes auth_mechanisms = plain login auth_verbose = yes default_client_limit = 2000 default_process_limit = 500 default_vsz_limit = 512 M disable_plaintext_auth = no first_valid_gid = 125 first_valid_uid = 125 imap_id_log = * mail_gid = 1003 mail_location = maildir:/mail/domains mail_privileged_group = postfix mail_uid = 1003 namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /usr/local/etc/dovecot/dovecot-sql-crypt.conf.ext driver = sql } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = postfix mode = 0600 user = postfix } } service imap { process_limit = 1536 } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/ssl/wildcard.domain.net_bundle.crt ssl_key = # hidden, use -P to show it userdb { args = /usr/local/etc/dovecot/dovecot-sql-crypt.conf.ext driver = sql } protocol imap { mail_max_userip_connections = 100 } Thank you very much

2 1

sieve-filter ignores -u argument
by Андрей Куницын 27 Jan '22

27 Jan '22

Hello I try to test my sieve script, but found out that it is impossible to use a sieve-filter tool with virtual mail users. It always uses a real user name instead of passed via -u argument. # sieve-filter -v -u postmaster(a)domain.tld ~/sieve/managesieve.sieve INBOX sieve-filter(root): Fatal: Unknown user sudo -u vmail sieve-filter -u postmaster(a)domain.tld ~/sieve/managesieve.sieve INBOX sieve-filter(vmail): Fatal: Unknown user Also there is the same question on serverfault, but without an answer. https://serverfault.com/questions/1055407/how-to-make-sieve-filter-use-virt… My environment is Ubuntu 20.04 dovecot --version 2.3.7.2 (3c910f64b) -- Sincerely, Andrey Kunitsyn

4 5

Dovecot installation problem (libssl_iostream_openssl.so is not portable!)
by Dimitri 27 Jan '22

27 Jan '22

Hi there, i try to install dovecot from source with the following configuration: > ./configure --prefix=/test/core/dovecot --with-ssldir=/test/core/dovecot/tls the configuration runs fine with the following output at the end: > Install prefix . : /test/core/dovecot > File offsets ... : 64bit > I/O polling .... : epoll > I/O notifys .... : inotify > SSL ............ : yes (OpenSSL) > GSSAPI ......... : no > passdbs ........ : static passwd passwd-file shadow checkpassword > : -pam -bsdauth -ldap -sql > userdbs ........ : static prefetch passwd passwd-file checkpassword > : -ldap -sql > CFLAGS ......... : -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/test/dep/openssl/include > SYSTEMD ........ : notify - /lib/systemd/system/dovecot.service > SQL drivers .... : > : -pgsql -mysql -sqlite -cassandra > Full text search : squat > : -lucene -solr But when i start to build (make) after a while i get the following error: > *** Warning: Linking the executable test-iostream-ssl against the loadable module > *** libssl_iostream_openssl.so is not portable! > libtool: link: gcc -std=gnu99 -g -O2 -fstack-protector-strong -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2 -mfunction-return=keep -mindirect-branch=keep -Wall -W -Wmissing-prototypes -Wmissing-declarations -Wpointer-arith -Wchar-subscripts -Wformat=2 -Wbad-function-cast -fno-builtin-strftime -Wstrict-aliasing=2 -I/test/dep/openssl/include -o .libs/test-iostream-ssl test-iostream-ssl.o ./.libs/libssl_iostream_openssl.so ./.libs/libssl_iostream.a ../lib-test/.libs/libtest.a ../lib/.libs/liblib.a -L/test/dep/openssl/lib64 -lssl -lcrypto -ldl -Wl,-rpath -Wl,/test/core/dovecot/lib/dovecot > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `ERR_free_strings' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_library_init' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `OBJ_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `CRYPTO_cleanup_all_ex_data' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `OpenSSL_add_all_algorithms' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_CTX_set_tmp_rsa_callback' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `EVP_cleanup' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_load_error_strings' > /usr/bin/ld: ./.libs/libssl_iostream_openssl.so: undefined reference to `SSL_CTX_need_tmp_RSA' > collect2: error: ld returned 1 exit status > make[3]: *** [Makefile:655: test-iostream-ssl] Error 1 > make[3]: Leaving directory '/test/tmp/dovecot-2.3.17.1/src/lib-ssl-iostream' > make[2]: *** [Makefile:573: all-recursive] Error 1 > make[2]: Leaving directory '/test/tmp/dovecot-2.3.17.1/src' > make[1]: *** [Makefile:702: all-recursive] Error 1 > make[1]: Leaving directory '/test/tmp/dovecot-2.3.17.1' > make: *** [Makefile:546: all] Error 2 I've searched for the error and find some posts about set explicitly CPPFLAGS and LDFLAGS and something about missing shared libraries of openssl. My openssl have shared libraries (libcrypto.so libssl.so ...) and the explicit use of CPPFLAGS and LDFLAGS to my openssl hasn't changed anything I use Openssl 3.0 but i've tested also 1.1.1m and 1.1.1g for example, same error! Dovecot is the latest 2.3.17.1 Can anyone help me with this please? Thanks!

1 0

doveadm stateful backup
by Christian 26 Jan '22

26 Jan '22

Hi all, first: I'm using version 2.3.4.1 I manage some rather large imap mailboxes which I want to backup on a regular basis. Some of them have relatively heavy traffic and one of them is greater than 30GB in size. I studied the docs for doveadm backup (https://wiki2.dovecot.org/Tools/Doveadm/Sync) and even did some code research to better understand the process. The docs state that using stateful synchronization is the most efficient way to synchronize mailboxes, therefore I chose this approach. Highlevel overview: - store a copy of the whole maildir in a separate directory (/var/vmail/backup) - backup to this directory once a minute (trying to make most use of transaction logs) using the last state stored within a file - create a backup once a day using tar (full, differential and incremental ones) blocking the backup process of the before mentioned step I quite often receive notifications that doveadm backup returned an exit code of 2, which should be quite normal. These notifications look like that: dsync(another_address(a)my.domain): Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync (Modseq 171631 no longer in transaction log (highest=177818, last_common_uid=177308, nextuid=177309)) dsync(another_address(a)my.domain): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID e9149d0ae4e02d532505000026ca4352 (maybe it was just deleted?) Synced another_address(a)my.domain successfully but missing some changes. Took 3 seconds. Starting retry 1... The first message seems to point out that the transaction log got rolled and no more contains the messages from the backup dir, right? I thought about setting mail_index_log_rotate_min_age to 1hour to prevent rolling transaction logs too often, but abandoned this thought and increased the backup interval to once a minute. The warnings still appear so maybe my thoughts about transactions logs are wrong. The second message seems less alarming to me. How does doeveadm backup behave in such situations? Does it directly fall back to a less efficient way of syncing mails? Does the state store the information "retry with a full sync" and the next run uses this mode? To investigate on this I simply measured runtimes an saw that the second/retry run takes a bit longer (up to about 15 seconds) to sync the dir. I'm afraid of losing messages using my approach. Is it safe to always use doveadm backup -s $state? Simply counting one maildirs files within the live directory and the backup copy shows a 100 fewer files within the backup dir although the script runs only since a few days. For reference, see my backup script below. Regards Christian #!/bin/bash # * * * * * /root/bin/backup.sh --sync-only # 12 2 1-7 * * test $(date +\%u) -eq 6 && /root/bin/backup.sh --full # 12 2 8-31 * * test $(date +\%u) -eq 6 && /root/bin/backup.sh --differential # 12 2 * * * test $(date +\%u) -ne 6 && /root/bin/backup.sh synconly=0 differential=0 fullbackup=0 if [ $# -gt 0 ] ; then if [ "$1" == "--sync-only" ] ; then synconly=1 elif [ "$1" == "--differential" ] ; then differential=1 elif [ "$1" == "--full" ] ; then fullbackup=1 fi fi basedir="/var/vmail/backup" targetdir="/var/vmail/backup/done" mailaddresses="one_address(a)my.domain another_address(a)my.domain yet_another(a)my.domain" if [ ! -d "$basedir" ] ; then mkdir -p "$basedir" chown vmail:vmail "$basedir" fi if [ ! -d "$targetdir" ] ; then mkdir -p "$targetdir" chown vmail:vmail "$targetdir" fi for mailaddr in ${mailaddresses} ; do #echo "Creating backup for $mailaddr." domainpart=${mailaddr#*@} localpart=${mailaddr%%@*} lockfile="$basedir/$mailaddr.lock" statefile="$basedir/$mailaddr.state" backupdir="$domainpart/$localpart/Maildir" snapshotfile_full="$basedir/$mailaddr.full.snar" snapshotfile="$basedir/$mailaddr.snar" backup_basename="$basedir/${mailaddr}_$(date '+%Y%m%d_%H%M%S')" ( if [ $synconly -eq 1 ] ; then flock -xn 200 if [ $? -eq 1 ] ; then # failed to acquire lock. Skip mailbox silently. exit fi fi # try to acquire exclusive lock for one minute flock -xw 60 200 if [ $? -eq 1 ] ; then echo "Failed to acquire write lock within 60 seconds. Skipping $mailaddr." exit fi retries=0 retval=1 until [ $retval -eq 0 ] || [ $retries -ge 3 ] ; do let 'retries++' if [ -f "$statefile" ] ; then oldstate=$(head -1 "$statefile") else oldstate="" fi start_time=$(date +%s) ERROR=$((doveadm backup -u "$mailaddr" -s "$oldstate" "maildir:$basedir/$backupdir") 2>&1 > "$statefile") retval=$? end_time=$(date +%s) let 'duration=end_time-start_time' if [ $retval -eq 2 ] ; then #if [ $retries -gt 1 ] ; then echo "$ERROR" echo "Synced $mailaddr successfully but missing some changes. Took $duration seconds. Starting retry $retries..." #fi elif [ $retval -ne 0 ] ; then echo "$ERROR" echo "Syncing $mailaddr failed. Return code $retval. Took $duration seconds. Removing backup directory and starting retry $retries..." rm -rf "$basedir/$backupdir" rm -f "$statefile" "$snapshotfile" elif [ $retries -gt 1 ] ; then echo "Successful sync took $duration seconds." fi done # downgrade lock to shared lock flock -sn 200 [ $synconly -eq 1 ] && exit if [ $retval -ne 0 ] ; then echo "Too many retries. Aborting backup of $mailaddr." exit fi cd "$basedir" if [ $fullbackup -eq 1 ] || [ ! -f "$snapshotfile_full" ] ; then tar -cpzf "${backup_basename}_full.tar.gz" --level=0 -g "$snapshotfile_full" "$backupdir" cp -f "$snapshotfile_full" "$snapshotfile" else suffix="" if [ $differential -eq 1 ] ; then cp -f "$snapshotfile_full" "$snapshotfile" suffix="_diff" fi tar -cpzf "${backup_basename}${suffix}.tar.gz" -g "$snapshotfile" "$backupdir" fi cd - > /dev/null mv "${basedir}/"*.tar.gz "$targetdir" ) 200>"$lockfile" [ $synconly -eq 1 ] && continue # housekeeping newest_full=$(ls -1 "${targetdir}/${mailaddr}_"*_full.tar.gz 2>/dev/null | sort | tail -1) if [ -n "$newest_full" ] ; then #echo "Cleaning up files older than $newest_full..." find "$targetdir" -depth -maxdepth 1 -name "${mailaddr}_*" ! -newer "$newest_full" ! -samefile "$newest_full" -printf 'Deleting %p...\n' -delete fi done

1 1

pop3-login logging double Disconencted
by Noel Butler 26 Jan '22

26 Jan '22

Hi all, Wondering if anyone else is seeing this double Disconnected in the logs with current stable version, it only happens for pop3-login, and only with Too many commands... other pop3-login logging with Disconnected like Connection closed (no auth attempts... etc are fine Example of anomaly - pop3-login: Info: Disconnected: Disconnected: Too many bad commands (no auth attempts in ... If anyone running 2.3.17.1 sees this or does not see it on Too many bad... or at all, kindly mind letting me know, not sure if something has gone haywire here or its a bug that needs reporting since logs indicate this only occurred after updating to the point 1 release. -- Regards, Noel Butler This Email, including attachments, may contain legally privileged information, therefore at all times remains confidential and subject to copyright protected under international law. You may not disseminate this message without the authors express written authority to do so. If you are not the intended recipient, please notify the sender then delete all copies of this message including attachments immediately. Confidentiality, copyright, and legal privilege are not waived or lost by reason of the mistaken delivery of this message.

2 1

noob maildir question
by mikfum 25 Jan '22

25 Jan '22

I would like to ask if it is an acceptable practice to manage messages in the maildir as a file (move them from one folder to another) while dovecot is in stop state thinking that it will be rebuild to the next imap user login thanks for your patience:) mik

5 10

Re: noob maildir question
by mikfum 24 Jan '22

24 Jan '22

thanks ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ Il lunedì 24 gennaio 2022 5:15 AM, Ted Hatfield <ted(a)io-tx.com> ha scritto: > I do this all the time on my server. From one user mailbox to another or > > from one maildir folder to another. On my platform I need to make certain > > owner/group of the moved messages is correct for the user I've moved them > > to. Other than that dovecot appears to re-index on the fly. > > Be aware that this is observed information. Others more knowledgeable may > > have concerns that I'm not aware of or just can't see on my system. > > Ted > > On Mon, 24 Jan 2022, mikfum wrote: > > > I would like to ask if it is an acceptable practice to manage messages in the maildir as a file (move them from > > > > one folder to another) while dovecot is in stop state thinking that it will be rebuild to the next imap user login > > > > thanks for your patience:) > > > > mik

1 0

zlib.read errors after upgrade from 2.3.15 to 2.3.17.1
by Arno Schneider 24 Jan '22

24 Jan '22

After upgrading my mailserver from buster to bullseye and dovecot 2.3.15 to 2.3.17.1 I got the following errors: Jan 22 14:22:32 Warning: doveadm(user1)<2953060><49b0NRQF7GFkDy0ALVPUUA>: mdbox /local/mail/user1/storage: rebuilding indexes Jan 22 14:22:39 Error: doveadm(user2)<2953112><awsPGB8F7GGYDy0ALVPUUA>: dsync(2nd.dovecot.server): read(compress(/local/mail/user2/storage/m.4650)) failed: read(/local/mail/user2/storage/m.4650) failed: zlib.read(/local/mail/user2/storage/m.4650): unexpected EOF at 7038367 (last sent=mail, last recv=mail_request (EOL)) I have 2 dovecot servers in a multi-master configuration. The both servers are synced with dsync and the users are routed through a dovecot directors. Any hints where I can continue to investigate / solve this issue? best regards, arno

1 0

Why would dovecot not be answering
by Ruben Safir 23 Jan '22

23 Jan '22

I am really lost as to why dovecot is not authenticating I have smtpd_sasl_type = dovecot in main.cf and # Postfix smtp-auth unix_listener /var/spool/postfix/private/auth { mode = 0666 user = postfix group = postfix } in /etc/dovecot/conf.d/10-master.conf I want it to authenticate on submition only Everything I read says this should do it, but I am up against a wall. I have no debugging information or log at all to confirm what postfix is doing. -- So many immigrant groups have swept through our town that Brooklyn, like Atlantis, reaches mythological proportions in the mind of the world - RI Safir 1998 http://www.mrbrklyn.com DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002 http://www.nylxs.com - Leadership Development in Free Software http://www2.mrbrklyn.com/resources - Unpublished Archive http://www.coinhangout.com - coins! http://www.brooklyn-living.com Being so tracked is for FARM ANIMALS and extermination camps, but incompatible with living as a free human being. -RI Safir 2013

3 5

S3 integration w Dovecot
by Martin Olsen 21 Jan '22

21 Jan '22

Good morning, day, evening :P As stated on documentation S3-compatible Storages — Dovecot documentation <https://doc.dovecot.org/configuration_manual/mail_location/obox/s3/> only AWS S3 is officially supported. However, we know that Scality has been successfully integrated at some larger corporations. Particularly curious if anyone has integrated with Pure S3 object storage solution, or any other for that matter? Just looking at some different options. - Sincerely, Martin.

4 3

Stop used or not
by mauric＠gmx.ch 21 Jan '22

21 Jan '22

Sieve scripts running fine, but please what would mean the "Stop", if I have multiple Policy that will run true, I need one stop to finish this per section? if header :is ["from","bcc","to"] ["Email-Address-one", "Email-Address-Two", "and so on"] { fileinto ".\Magic-FolderName"; stop; } thanks

3 4

Upgrade only piegenhole to 0.5.17?
by mauric＠gmx.ch 20 Jan '22

20 Jan '22

Please it's possible to update only piegenhole to 0.5.17, on existing Dovecot installation? Downloading dovecot-2.3-pigeonhole-0.5.17.1 Here I found the update-version, its this the possible way? And why I don't found any Informations on any readme, please point me to the right place. installed version, I think this it's the right view? Please on witch place I can check the Sieve installed module? doveconf | head # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5 () Also found in file pieg-config /* Define to the version of Pigeonhole for Dovecot. */ #define PIGEONHOLE_VERSION "0.5.4" On Debian 10 I have this installed. dovecot-managesieved 1:2.3.4.1-5+deb10u6 amd64 secure POP3/IMAP server - ManageSie dovecot-sieve 1:2.3.4.1-5+deb10u6 amd64 secure POP3/IMAP server - Sieve filters support also checking the folder /usr/include/dovecot/sieve with intention so found any possible version? Thanks for any update

2 2

sockets created for lmtp
by Mike 20 Jan '22

20 Jan '22

Was recently configuring lmtp to listen in the postfix spool for mail. I set the socket as suggested in the documentation, however, when I look at what sockets were created there was an additional one for dovecot. Since I made the change, my expectation would have been just the one that I set up. I doubt it impacts it negatively, but I wanted to understand if I configured things correctly or not. Thanks. Mike

4 6

FTS Tokenization filters normalizer-icu vs lowercase
by Alessio Cecchi 20 Jan '22

20 Jan '22

Hi, I'm trying to setup fts-flatcurve with tokenization. What are the differences/benefits with "fts_filters = normalizer-icu" vs "fts_filters = lowercase"? Reading the Doc I found about normalizer-icu "This is potentially very resource intensive." and about lowercase "Supports UTF8, when compiled with libicu". So, using lowercase is almost the same that normalizer-icu but faster? FYI for using fts-flatcurve with dovecot RPM packages from repo.dovecot.org you have to rebuild with --with-icu --with-stemmer --with-textcat and related library. Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

2 1

Save of messages slow when replica unavailable
by Jörg Faudin Schulz 20 Jan '22

20 Jan '22

We have a setup with a dovecot server + replica. This works fine as long as the replica is available. When the replica is not available for some reason, the clients can work normally with one exception: the saving of sent messages to their inboxes takes ages. Thunderbird times out and complains (and duplicates the message), mail.app just waits until it's done. Is there any setting that helps here? For the time being, I deactivated replication; but this isn't a long time solution. Thank you for all your work&support, appreciating the doc as well.

1 0

dovecot-2.3.17: "Panic: file ioloop.c: line 865"
by Christian Küppers 20 Jan '22

20 Jan '22

Hello, we got the same backtrace in dovecot-ee version 2:2.3.17-8+ubuntu20.04 as Andreas Piper mentioned in November 2021 https://dovecot.org/pipermail/dovecot/2021-November/123468.html after installing dovecot package updates. Panic: file ioloop.c: line 865 (io_loop_destroy): assertion failed: (ioloop == current_ioloop) Error: Raw backtrace: #0 t_askpass[0x7fc609b0eba0] -> #1 backtrace_append[0x7fc609b0ee00] -> #2 backtrace_get[0x7fc609b0ef70] -> #3 i_syslog_error_handler[0x7fc609b1bfa0] -> #4 i_syslog_fatal_handler[0x7fc609b1c0d0] -> #5 i_panic[0x7fc609a6f1af] -> #6 i_error[0x7fc609a72906] -> #7 doveadm_http_server_deinit[0x55abd194af90] -> #8 doveadm_print_stream[0x55abd19447b0] -> #9 doveadm_print_istream[0x55abd1944810] -> #10 expunge_search_args_check[0x55abd1936a00] -> #11 expunge_search_args_check[0x55abd1935860] -> #12 doveadm_dsync_main[0x55abd1932900] -> #13 doveadm_cmd_ver2_to_mail_cmd_wrapper[0x55abd1933890] -> #14 doveadm_cmd_run_ver2[0x55abd1943fb0] -> #15 doveadm_server_deinit[0x55abd1948760] -> #16 io_loop_call_io[0x7fc609b32440] -> #17 io_loop_handler_run_internal[0x7fc609b33a00] -> #18 io_loop_handler_run[0x7fc609b32500] -> #19 io_loop_run[0x7fc609b32680] -> #20 master_service_run[0x7fc609aa4780] -> #21 main[0x55abd1923820] -> #22 __libc_start_main[0x7fc60970efc0] -> #23 _start[0x55abd1923980] Error: doveadm server disconnected before handshake: EOF Command fetch failed for <mailbox>: EOF We got it during doveadm fetch of a mail on multiple mailboxes. Is there any progress on this? Will it be fixed in next release? Kind regards, Christian Küppers Expert Administrator onOffice GmbH Charlottenburger Allee 5 | 52068 Aachen Tel. +49 (0)241 446 86-0 | Fax. +49 (0)241 446 86-250 E-Mail:c.kueppers@onoffice.de| Web:www.onOffice.com Registergericht: Amtsgericht Aachen, HRB 21420 Geschäftsführer: Dipl.-Kfm. Stefan Mantl Prokuristen: Janosch Reuschenbach, Kristina Andresen, Christian Mähringer

2 1

lmtp_save_to_detail_mailbox
by dovecot＠ptld.com 19 Jan '22

19 Jan '22

lmtp_save_to_detail_mailbox: " If the recipient address includes a detail element / role (as in user+detail format), save the message to the detail mailbox. " Im not understanding this, what is the "detail mailbox"? I tried testing this feature by setting "lmtp_save_to_detail_mailbox = yes" and sending an email to user+test(a)example.com. The email still ended up in the default inbox folder. So what does lmtp_save_to_detail_mailbox do or is there another setting that also needs to be set to use this feature?

3 5

Outlook vs. Dovecot experience
by Vladislav Kurz 18 Jan '22

18 Jan '22

Dear colleagues, what is your experience regarding using outlook (2016/365) as IMAP client and dovecot on server side? We have sync issues with outlook vs. cyrus IMAP server, and we consider moving to dovecot. But before that I'd like to hear from others if this combination works well. Especially if users have large and bushy mailboxes (>10 GB, >100 mailboxes), two mailboxes (accounts) on the same server. I don't want to do the migration just to find out that it is general issue of outlook vs. any IMAP server. -- Best regards Vladislav Kurz

7 10

JA3/JA3S as a Dovecot plugin?
by Sidsel Jensen 18 Jan '22

18 Jan '22

Hi We have been looking a bit into JA3 (https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247… <https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247…> and https://blog.squarelemon.com/tls-fingerprinting/ <https://blog.squarelemon.com/tls-fingerprinting/> ) for possible threat actor identifications. Roughly speaking you can think of JA3 as the TLS equivalent of the User-Agent string. Has anybody been looking into the possibility of building an open source dovecot JA3 plugin? I’d also like to hear the technical pros/cons of doing so…and perhaps the ethical deliberations also :-) Kind Regards, Sidsel

1 0

FTS flatcurve not index messages when SEARCH run on Virtual Mailboxes
by Alessio Cecchi 18 Jan '22

18 Jan '22

Hi, I'm testing FTS flatcurve plugin in order to understand if I can switch from FTS Solr to flatcurve. In my configuration I have enabled Virtual mailboxes and for search in all folders I just SEARCH on Virtual/All folder. I this (virtual) folder is not indexed with FTS Solr Dovecot start to index it (or all real folders). But with FTS flatcurve when I SEARCH on Virtual/All for the first time the indexer process does not start and the search return empty. Only if I run manually "doveadm index -q -u alessio(a)email.net '*'" flatcurve find messages. Can flatcurve have the same feature as Solr for Virtual mailboxes? Here a sample of my configuration: namespace Virtual { hidden = yes list = no location = virtual:/etc/dovecot/virtual:INDEX=~/Maildir/virtual prefix = Virtual/ separator = / subscriptions = no } namespace inbox { [...] mailbox virtual/All { comment = All my messages special_use = \All } } # cat /etc/dovecot/virtual/All/dovecot-virtual * all Thanks -- Alessio Cecchi Postmaster @ http://www.qboxmail.it https://www.linkedin.com/in/alessice

3 6

Extracting CLIENTID information from checkpassword or postlogin scripting
by Dan Conway 18 Jan '22

18 Jan '22

Hello, When extracting client_id information from the client connection (i.e. setting imap_id_log = *) the information is directly logged by Dovecot as such: ID sent: name=Thunderbird, version=91.5.0 My question is, Is it possible to export/set this information in a checkpassword script or a postlogin script? client_id If|imap_id_retain| <https://doc.dovecot.org/settings/core/#core_setting-imap_id_retain>is enabled this variable is populated with the client ID request as IMAP arglist. I've enabled both checkpassword and postlogin on a test server, as well as 'imap_id_retain' set to 'yes'. I wrote a simple Perl script that dumps everything in %ENV as well as @ARGV for checkpassword and postlogin, but I don't see any occurrences of ID information. I've also tried to see if I could supply that variable in dovecot.conf by setting 'client_id' as a parameter, but that didn't seem to do the trick either. passdb { ... # Doesn't work args = /usr/local/bin/checkpassword.pl client_id # Doesn't work args = /usr/local/bin/checkpassword.pl %{client_id} ... } What am I missing? Is it possible to get these variables into an external script that checkpassword or postlogin executes? Thanks.

3 2

Order of loading and checking userdb on Ubuntu
by Mike 16 Jan '22

16 Jan '22

When using the lmtp service for local delivery, I'd like to change the user lookup to only use the user portion of the email address. I think I do that in the 20-lmtp.conf file, but not exactly sure how. From what I've found on the web, I just need to change the auth_username_format=%n. I feel confident that I'm not doing it right. older posts implied that the order things are loaded is an issue, but not sure if that is the case anymore. My goal is to set username_format for only lmtp. Thanks for any help.

1 1

Wrong timestamp value in name of file
by Ervin Hegedüs 14 Jan '22

14 Jan '22

Hi there, Debian 10, Dovecot 2.3.4 (1:2.3.4.1-5+deb10u6), ext4 mailstore. A user on our server reorganized the sent items: he moved few items from the old sent folder into a new one. After that, he noticed me that he does not see every mail, but when he starts a search, then he finds it. I looked up the mail, and found this situation: # ls -la 1642152396.M997381P21341.mail2\,S\=473164\,W\=479469\:2\,S -rw-r--r-- 1 vmail vmail 473164 aug 24 10:21 '1642152396.M997381P21341.mail2,S=473164,W=479469:2,S' # grep Date '1642152396.M997381P21341.mail2,S=473164,W=479469:2,S' Date: Tue, 24 Aug 2021 10:21:39 +0200 # date -d @1642152396 Fri Jan 14 10:26:36 CET 2022 As you can see that mail had sent on 24 Aug, 2021, but after the reorganization it got a new timestamp with the date of today. I assume the client (iPhone) orders the mail by the name of files - am I right? Why did this happen? How can I fix that? I mean, is there any way to rename this files (a few hundred...) to the "real" timestamp? Thanks, a.

1 0

ssl=required per user?
by Arkadiusz Miśkiewicz 13 Jan '22

13 Jan '22

Can ssl=required be forced on per user setting? Right now I could modify password_query to check if %c (%{secured}) is empty and return appropriate error as "reason" like in https://doc.dovecot.org/configuration_manual/authentication/nologin/#authen… example. Unfortunately password_query is a bit too late. I would like to deny access as soon as possible, so just after user sends his login. (that won't help much in cases when client sends password early like "AUTH PLAIN b64loginpass" but will help in all other cases) user_query doesn't have this capability that password_query it seems. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0