- dovecot - dovecot.org

dsync not deleting mail on remote side
by Otto Frauchiger 23 Nov '21

23 Nov '21

Hello Short version: Dovecot's dsync from release 2.3.7.2 (default install from focal repository) running under Ubuntu 20.04.6 LTS server is not deleting mails on the identical remote server. Background: I have installed this configuration using automated scripts several times for customers. Functionally identical installations done on Ubuntu LTS Servers 14.04, 16.04 and 18.04 are running for years without problem. Now I have tried several times to do the same with Ubuntu 20.04 and can't get dsync to work properly. Last year I could fall back onto Ubuntu 18.04. This time I can't and must install the latest versions. Setup: - Two VM's on ESXI 6.7U3 with 36 GB of disk space and 8 GB ram, 10k spinning disks or SSD with HW RAID1 - Mariadb for mail users (master - master synched) - Postfixadmin to manage the users - Postfix - Dovecot - Some with Roundcube - The clients can connect to either one server and connect SMTPS (465 or 587) or POPS (995) to the servers. - The two servers connect on a dedicated network without routing (SSL, port > 49000). The synchronization network has no mail traffic except the one that synchronizes the servers. - Additionally the two servers are ntp peers within a few ms - but that is only relevant to know when we start comparing logs from the machines Problem description: - When I send one mail to one account, it is immediately synched to the other server. This is also seen in the dovecot log and I can connect to any one of the two servers to download it. - When I read and delete the mail on one server, it is NOT deleted on the other server. I do not see a trigger in the dovecot log that kicks on the synchronization (like I do when sending mails). As a result, the mail can be downloaded and deleted from both servers. - When I send a new mail to one of the two servers, the synchronization takes place and the mail that I read and deleted is also gone on the remote (backup) server. - Changing users, rights in dsynch.conf , SSL on or off, or connecting to PLAIN ports 25, 110 or 143 is never improved it. Iptables or ufw are not in use. - In my case I have systems using the server that' don't like duplicate mails and the servers fail the acceptance test criteria. - This causes duplicate mail if one client is connecting to the other server. Since a new mail fixes that duplicate mail problem, it is likely that up to now nobody detects it and complains about this. Especially if the servers would run in a primary - backup mode. I assume that's why I could not find reportings on the web until now. Dovecot -n: See attachments Log from my automated test system using Ubuntu 20.01 and focal default dovecot package from repository (dovecot 2.3.7.2): 2021-11-22 18:20:06.30 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:20:06.81 - SMTP Server: mail-pri Port 465 TLS - User: user(a)test.ch - To: user(a)test.ch - Subject: Test 2021-11-22 18:20:06, Msg 00001 2021-11-22 18:20:14.90 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:20:15.37 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:06, Msg 00001 (retr no delete) 2021-11-22 18:20:17.32 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:20:17.77 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:06, Msg 00001 (retr no delete) -> synchronization worked when sending mails 2021-11-22 18:20:27.52 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:20:27.96 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:06, Msg 00001 (retr and delete) 2021-11-22 18:20:30.72 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:20:31.17 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:06, Msg 00001 (retr and delete) -> synchronization failed after POP3 connection with delete 2021-11-22 18:20:53.06 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:20:53.66 - SMTP Server: mail-sec Port 465 TLS - User: user(a)test.ch - To: user(a)test.ch - Subject: Test 2021-11-22 18:20:53, Msg 00002 2021-11-22 18:20:57.91 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:20:58.33 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:53, Msg 00002 (retr no delete) 2021-11-22 18:21:00.82 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:21:01.27 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:53, Msg 00002 (retr no delete) 2021-11-22 18:21:04.65 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:21:05.11 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:53, Msg 00002 (retr and delete) 2021-11-22 18:21:08.95 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-22 18:21:09.40 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-22 18:20:53, Msg 00002 (retr and delete) 2021-11-22 18:21:39.50 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- Reference log with the same installation using Ubuntu 18.04 and bionic default package form repository (dovecot 1:2.2.33.2-1ubuntu4.7): 2021-11-23 13:55:06.93 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:54:49.86 - SMTP Server: mail-pri Port 465 TLS - User: user(a)test.ch - To: user(a)test.ch - Subject: Test 2021-11-23 13:54:49, Msg 00001 2021-11-23 13:55:06.93 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:55:07.47 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-23 13:54:49, Msg 00001 (retr no delete) 2021-11-23 13:55:13.10 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:55:13.66 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-23 13:54:49, Msg 00001 (retr no delete) -> synchronization OK for sending mails 2021-11-23 13:55:22.32 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:55:22.87 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-23 13:54:49, Msg 00001 (retr and delete) 2021-11-23 13:55:27.91 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:55:28.35 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - no mails found -> synchronization OK for deleting mails 2021-11-23 13:55:36.48 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:55:37.00 - SMTP Server: mail-sec Port 465 TLS - User: user(a)test.ch - To: user(a)test.ch - Subject: Test 2021-11-23 13:55:36, Msg 00002 2021-11-23 13:55:45.94 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:55:46.48 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-23 13:55:36, Msg 00002 (retr no delete) 2021-11-23 13:55:55.59 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:55:56.14 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-23 13:55:36, Msg 00002 (retr no delete) 2021-11-23 13:56:05.70 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:56:06.26 - POP3 Server: mail-pri Port 995 TLS - User: user(a)test.ch - From: user(a)test.ch - Subject: Test 2021-11-23 13:55:36, Msg 00002 (retr and delete) 2021-11-23 13:56:38.70 - ---------------------------------------------------------------------------- ---------------------------------------------------------------------- 2021-11-23 13:56:39.12 - POP3 Server: mail-sec Port 995 TLS - User: user(a)test.ch - no mails found P.S. I compared the dovecot and postfix config files between these two versions and both servers and they are functionally identical except where they need to be different. I would appreciate any help here. If needed I can create log files that show that nothing is triggered as well as produce wireshark captures (port 25 and 110) or the link for the synch (currently with ssl but I could change that if needed). Thanks in advance Otto -- This email has been checked for viruses by AVG. https://www.avg.com

1 0

Connection refused
by fugee ohu 23 Nov '21

23 Nov '21

I'm unable to connect to dovecot: > $ openssl s_client -connect mail.servicemouse.com:993 140439527167360:error:0200206F:system library:connect:Connection refused:../crypto/bio/b_sock2.c:110: 140439527167360:error:2008A067:BIO routines:BIO_connect:connect error:../crypto/bio/b_sock2.c:111: connect:errno=111

2 1

Retrieive vsz_limit programatically
by Joan Moreau 23 Nov '21

23 Nov '21

Hello How to get, programatically (C/C++), the value of teh dovecot.conf file of vsz_limit and default_vsz_limit ? Thank you

5 9

ZFS storage and backup
by infoomatic 23 Nov '21

23 Nov '21

Hi listmembers, I am about to migrate our mailservices to FreeBSD + ZFS. Thus, before entering the sheer endless stage of performance testing, I thought I would ask here kindly for all kinds of information. My setups are nothing special with few users, however, I would like to have a nice setup, maybe some of you could contribute to this thread. We are using slow spinning disks, but we may consider using ssds in a not-so-distant future. *) storages: any infos on ZFS options or whether to use mdbox or sdbox, and what configs/options regarding compression etc. *) backup: what is a best practice regarding backups? - using only the dovecot tools or leveraging the great features of ZFS (or both) with snapshots etc.? Thanks for all sorts of infos, probably saving me quite some time evaluating different options! Robert

5 6

Mailinglistserver IPv6 address blacklisted
by Arjen de Korte 21 Nov '21

21 Nov '21

It looks like the mailinglist server IPv6 address has been blacklisted: https://check.spamhaus.org/listed/?searchterm=2a04:3545:1000:720:acc1:5bff:… The 'Show details' shows the entire 2a04:3545:1000:720::/64 network is blacklisted. Whois tells this is a network used by UpCloud Cloud Servers. So either the mailinglistserver or a server it shares its network with is compromised. If UpCloud gives its users their own /64, it would probably be the former. Otherwise it might make sense to ask them for one, as sharing IPv6 networks between customers is a no-no in the IPv6 world.

2 1

Solr FTS - message deletes not working as expected
by Shawn Heisey 19 Nov '21

19 Nov '21

I have Solr FTS enabled in dovecot. It is behaving differently than I would expect. When I delete messages in Thunderbird normally, using IMAP to talk to dovecot, the deletion hits Solr right away. If I then ask Thunderbird to empty the trash, that delete also hits Solr immediately. But if I use shift-delete in Thunderbird, which deletes the message immediately without going through Trash, things are different. One delete that I did (6 messages) took at least a minute before Solr saw the request. And on other tests that I ran, deleting one message, I never did see the delete request hit Solr. I waited for several minutes. I use the shift-delete mechanism a lot more than the method that sends to trash. That way I do not need to remember to empty the trash. Dovecot version is 2:2.3.16-2+ubuntu20.04 installed from the dovecot repo, not from distro packages. I don't think the Solr version matters, but just in case I am wrong, that is 8.10.1. I don't recall exactly what I changed in the solrconfig.xml and managed-schema files, but it should not be anything that affects how Solr FTS works. The problem seems to be that Solr FTS isn't sending deletes, not that Solr is behaving incorrectly. I just discovered that trying to get the dovecot config failed: root@bilbo:~# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) doveconf: Fatal: Error in configuration file /etc/dovecot/conf.d/10-master.conf line 64: Invalid size: $default_vsz_limit After fixing that, this is what I get for the config: root@bilbo:/etc/dovecot# doveconf -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 5.11.0-1020-aws x86_64 Ubuntu 20.04.3 LTS ext4 # Hostname: REDACTED default_vsz_limit = 1 G dict { quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 150 last_valid_uid = 150 listen = * mail_gid = mail mail_location = maildir:/var/vmail/%d/%u mail_plugins = " quota fts fts_solr" mail_privileged_group = mail mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { fts = solr fts_autoindex = yes fts_solr = url=http://localhost:8983/solr/dovecot/ quota = dict:User quota::proxy::quota quota_grace = 10%% quota_max_mail_size = 100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = file:/var/vmail/sieve/%d/%u/sieve;active=/var/vmail/sieve/%d/%u/.dovecot.sieve sieve_default = file:/var/vmail/global.sieve } postmaster_address = postmaster@REDACTED protocols = " imap lmtp sieve pop3" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = mail mode = 0666 user = vmail } } service dict { unix_listener dict { group = postfix mode = 0660 user = vmail } } service imap { vsz_limit = 1 G } service stats { unix_listener stats-reader { group = vmail mode = 0660 user = vmail } unix_listener stats-writer { group = vmail mode = 0660 user = vmail } } ssl_cert = </etc/ssl/certs/local/mainwildcards.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = " quota fts fts_solr sieve" } protocol lda { mail_plugins = " quota fts fts_solr sieve" } protocol imap { mail_max_userip_connections = 20 mail_plugins = " quota fts fts_solr imap_quota" } I repeated the delete test after fixing the config and there was no change -- the delete request never made it to Solr. Reindexing completely for my dovecot install takes about 8 minutes. I have less than 150K messages. Reindexing for some could take hours or days. This is what I use to initiate a full reindex: root@bilbo:~# cat /usr/local/sbin/reindexsolr #!/bin/sh DOVECOT_SOLR_URL_BASE="http://localhost:8983/solr/dovecot" DEL_ALL_QUERY_XML="<delete><query>*:*</query></delete>" MAIL_ROOT=/var/vmail service dovecot stop curl \ "${DOVECOT_SOLR_URL_BASE}/update?commit=true&optimize=true" \ -H "Content-Type: text/xml" \ --data-binary "${DEL_ALL_QUERY_XML}" find ${MAIL_ROOT} -name "dovecot.index*" -print0 | xargs -0 rm -f service dovecot start doveadm index -A -q '*'

3 11

FTS config - cannot search substrings
by infoomatic 19 Nov '21

19 Nov '21

Hi, I have an issue with FTS, maybe someone here can help me out. Basically my setup is working with solr + tika enabled, however, it seems my search is not configured the way I expect it. Eg when I receive a pdf document containing the word "myfoobar" I cannot search for "myfoo" or "foobar", but searching for "myfoobar" shows the right result. Any ideas? Thanks!

2 2

Can sieve-script run when saving mail in Sent folder?
by Kees van Vloten 19 Nov '21

19 Nov '21

Hi everyone, Would it be possible to run a sieve-script when the mail-client sends a mail (no because smtp) on the action where the mail-client stores a copy in the Sent folder over imap? I was expecting through imapsieve_mailboxXXX_* but can find a combination of parameters are correct. Does anybody have this working? and how? - Kees

3 4

Subfolder in sieve not working as expected
by Kees van Vloten 17 Nov '21

17 Nov '21

Hi everybody, I am trying to move incoming mails into subfolders with this sieve script: require ["fileinto", "variables", "mailbox"]; if header :matches "Delivered-To" "*@*" { fileinto :create "INBOX/${2}"; } On a message to user(a)example.com I would expect it to be stored in the folder 'example.com' under 'INBOX', but instead a folder named 'INBOX\2fexample.com' is created. I tried several options: - replace / with \/ or \\/ - replace / with . - disable listescape in dovecot.conf Unfortunately nothing did the trick. Any ideas what could fix this? dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-9-amd64 x86_64 Debian 11.1 # Hostname: servers.example.com auth_default_realm = EXAMPLE.COM auth_gssapi_hostname = servers.example.com auth_krb5_keytab = /etc/keytab/dovecot.keytab auth_master_user_separator = * auth_mechanisms = gssapi gss-spnego plain auth_realms = EXAMPLE.COM first_valid_gid = 986 first_valid_uid = 990 imap_client_workarounds = tb-extra-mailbox-sep login_greeting = Dovecot ready. mail_debug = yes mail_gid = 986 mail_location = maildir:%h/%d/%n/store:LAYOUT=fs:FULLDIRNAME=0_FolderContent:UTF-8:INDEX=%h/%d/%n/index:CONTROL=%h/%d/%n/control:VOLATILEDIR=%h/%d/%n/volatile mail_plugins = zlib notify push_notification listescape acl mail_privileged_group = mail mail_shared_explicit_inbox = yes mail_uid = 990 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds spamtest imapflags notify imapsieve vnd.dovecot.imapsieve namespace inbox { inbox = yes list = yes mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Inbox { auto = subscribe } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = ~ subscriptions = yes type = private } passdb { args = username_format=%u /etc/dovecot/master-users driver = passwd-file master = yes } passdb { args = /etc/dovecot/ldap_user_to_principal.conf.ext driver = ldap pass = yes } passdb { driver = pam } plugin { acl = vfile:/var/lib/dovecot/global-acls:cache_secs=1 acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes autocreate = Trash autocreate2 = Drafts autocreate3 = Sent autosubscribe = Trash autosubscribe2 = Drafts autosubscribe3 = Sent imapsieve_mailbox1_before = file:/var/lib/dovecot/sieve/imap/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/var/lib/dovecot/sieve/imap/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * listescape_char = \ sieve = file:%h/%d/%n/sieve/sieve;active=%h/%d/%n/sieve/active.sieve sieve_after = /var/lib/dovecot/sieve/after sieve_before = /var/lib/dovecot/sieve/before sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_extensions = +vacation-seconds +reject +notify +imapflags +spamtest sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /var/lib/dovecot/sieve/bin sieve_plugins = sieve_imapsieve sieve_extprograms sieve_vacation_default_period = 1d sieve_vacation_max_period = 1d sieve_vacation_min_period = 10s sieve_vacation_use_original_recipient = yes } postmaster_address = sysadmin(a)cvanvloten.nl protocols = " imap lmtp sieve submission" service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 } service imap { executable = imap } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } service submission-login { inet_listener submission { port = 465 ssl = yes } } ssl = required ssl_cert = </etc/dovecot/private/dovecot.pem ssl_cipher_list = EECDH+AESGCM:EDH+AESGCM ssl_client_ca_dir = /etc/ssl/certs ssl_curve_list = X25519:secp521r1:secp384r1:prime256v1 ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 submission_client_workarounds = whitespace-before-path submission_relay_host = server.example.com submission_relay_password = # hidden, use -P to show it submission_relay_ssl = smtps submission_relay_user = dovecot@server userdb { args = /etc/dovecot/ldap_list_users.conf.ext driver = ldap result_success = continue } userdb { args = /etc/dovecot/ldap_user_domain.conf.ext driver = ldap result_success = continue } userdb { args = uid=vmail gid=vmail home=/srv/mail/vmail allow_all_users=yes driver = static } protocol lmtp { mail_plugins = zlib notify push_notification listescape acl sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = zlib notify push_notification listescape acl imap_acl imap_sieve } - Kees

3 4

Bug report: Global Mailbox UID mismatch on replication when upgrading from 2.3.13 to 2.3.17
by Dennis Højgaard | Powerhosting Support 17 Nov '21

17 Nov '21

Hi. We use dovecot for replication on two dovecot nodes (using Maildir). Worked perfectly until upgrading from 2.3.13 to 2.3.17. I found out about it a couple of days after where Queued 'full resync' requests had gone up. And then i saw some failed requests. But nothing in the log. I found out which users having trouble and saw that it was new user so i ran doveadm sync manually and got the following error: doveadm(2849817): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 38e69e0ba98d936142ac29004e3fea09 (maybe it was just deleted?) So i found out that dovecot-uidlist had a mismatch on the Global Mailbox UID, so global mailbox uid is not the same on both servers for new users. I don't know if there is something that has changed with regards to how this GUID is generated, because when i look at old mailboxes they are always identical on both servers. I fix this issue manually by editing dovecot-uidlist on one of the servers making the global mailbox uid on both servers identical, and then run force-resync. This works, but i guess something has changed. -- Dennis Højgaard Powerhosting Support t: +45 7222 4457 | e: dh(a)powerhosting.dk | w: https://powerhosting.dk

1 0

Postfix -> bogogilter -> Dovecot -> Sieve
by Mike 17 Nov '21

17 Nov '21

I've been trying to work out how to get postfix to accept mail, send it to bogofilter, then deliver using dovecot while allowing a global sieve filter and users able to filter mail based on the bogofilter header. I've been successful at getting it to add the bogofilter header as needed, but don't understand what I need to do in order to have it get routed to sieve. Anyone do anything like this already and have a working config? I THINK I need to make dovecot deliver mail locally using lmtp or lda, but I'm not exactly sure. Thanks for any thoughts or ideas that you might have to accomplish this. Mike.

3 2

Help needed for OAuth and WSO2 Identity Server
by Tyler Montney 16 Nov '21

16 Nov '21

As outlined here: https://doc.dovecot.org/configuration_manual/authentication/oauth2/ Can Postman https://identity.foo.mylocal:9443/oauth2/token OK. Using this command to generate the base64 token: echo -en 'n,a=test(a)foo.com,\001host=localhost\001port=143\001auth=Bearer S3cure!Password\001\001' | base64 -w0; echo I telnet to localhost 143, and run 01 AUTHENTICATE OAUTHBEARER {TOKEN}. Get 'User id is not available for user: FOO.MYLOCAL/test(a)carbon.super' (HTTP 500). It could be because Dovecot is just sending a username instead of the full email address? I can generate the same 500 error by just sending the username in Postman. ***dovecot-oauth.conf.ext*** introspection_mode = post introspection_url = https://adminusername:adminpassword@identity.foo.mylocal :9443/oauth2/introspect username_attribute = username tls_allow_invalid_cert = yes active_attribute = active active_value = true use_grant_password = yes # Have tried this, no change. #username_format = %n client_id = {CLIENTID} client_secret = {CLIENTSECRET} grant_url = https://identity.foo.mylocal:9443/oauth2/token tokeninfo_url = https://identity.foo.mylocal:9443/oauth2/tokeninfo?oauth= pass_attrs = pass=%{oauth2:access_token} ***dovecot.conf*** auth_mechanisms = $auth_mechanisms oauthbearer xoauth2 passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/dovecot-oauth2.conf.ext }

1 0

Dovecot and certificates/keys on PKCS11 smartcards/HSMs
by Graham Leggett 16 Nov '21

16 Nov '21

Hi all, To configure SSL on dovecot using certificates and keys in files on disk, you specify the following: # Preferred permissions: root:root 0400 ssl_cert = </etc/ssl/dovecot.pem ssl_key = </etc/ssl/dovecot.pem Is there a syntax that will allow a certificate and key to be specified on a smartcard/HSM, as is possible (for example) for httpd at https://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslcertificatefile: # Example use of a certificate and private key from a PKCS#11 token: SSLCertificateFile "pkcs11:token=My%20Token%20Name;id=45” Regards, Graham —

1 0

Bug report: Global Mailbox UID mismatch on replication when upgrading from 2.3.13 to 2.3.17
by Dennis Højgaard | Powerhosting Support 16 Nov '21

16 Nov '21

Hi. We use dovecot for replication on two dovecot nodes (using Maildir). Worked perfectly until upgrading from 2.3.13 to 2.3.17. I found out about it a couple of days after where Queued 'full resync' requests had gone up. ANd then i saw some failed requests. But nothing in the log. I found out which users having trouble and saw that it was new user so i ran doveadm sync manually and got the following error: doveadm(2849817): Warning: Mailbox changes caused a desync. You may want to run dsync again: Remote lost mailbox GUID 38e69e0ba98d936142ac29004e3fea09 (maybe it was just deleted?) So i found out that dovecot-uidlist had a mismatch on the Global Mailbox UID, so global mailbox uid is not the same on both servers. I don't know if there is something that has changed with regards to how this GUID is generated, because when i look at old mailboxes they are always identical on both servers. I fix this issue manually by editing dovecot-uidlist on one of the servers making the global mailbox uid on both servers identical, and then run force-resync. This works, but i guess something has changed. -- Dennis Højgaard Powerhosting Support *t:* +45 7222 4457 |*e:* dh(a)powerhosting.dk |*w:* https://powerhosting.dk

1 0

Subfolder in sieve not working as expected
by Kees van Vloten 16 Nov '21

16 Nov '21

On 15-11-2021 23:04, dovecot(a)ptld.com wrote: >> On 11-15-2021 3:46 pm, Kees van Vloten wrote: >> >> I am trying to move incoming mails into subfolders with this sieve >> script: >> >> require ["fileinto", "variables", "mailbox"]; >> if header :matches "Delivered-To" "*@*" >> { >> fileinto :create "INBOX/${2}"; >> } > > I am not using variables and my folders are pre-created. But just to > give you a starting point, this is what works using maildir++ format > with default directory layout. > https://doc.dovecot.org/configuration_manual/mail_location/Maildir/ > > require ["fileinto"]; > # rule:[Dovecot] > if header :contains "sender" "@dovecot.org" > { > fileinto "INBOX.Dovecot"; > } I have seen that working in the past :-) I switched to LAYOUT=fs recently because of the limitations of the dot as a folder separator (now I can have the domain-name as a folder-name). I found a nice description about folder and namespace issues here: https://forum.hestiacp.com/t/character-not-allowed-in-mailbox-name/566/4 But somehow the sieve implementation does not seem to work properly with LAYOUT=fs. What a good approach to further analyze this issue?

1 0

[Move mailboxes] 2.2.13 -> 2.3.13: Stuck on certificate verification
by phren＠ist-einmalig.de 15 Nov '21

15 Nov '21

Hi, I'm about to move all mailboxes from an old machine - running Dovecot 2.2.13 - to a new machine - running Dovecot 2.3.13 (89f716dc2). Cause the new machine is in a different location I must use SSL encryption. I followed the guide's I found, but I stuck on certificate verification: $ doveadm backup -Ru <user> tcps:<host>:12354 doveadm(<user>): Info: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) doveadm(<user>): Error: doveadm server disconnected before handshake: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) doveadm(<user>): Error: Disconnected from remote: Received invalid SSL certificate: unable to get local issuer certificate: /CN=<host> (check ssl_client_ca_* settings?) On port 12354 the server sends an incomplete certificate chain, whereas on port 993 everything is fine. I read that the settings - ssl_client_ca_dir - ssl_client_ca_file are not used on certificate verification for port 12354, one should use the setting ssl_ca Here are the non-default setting on the client side: $ dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 5.10.0-9-amd64 x86_64 Debian 11.1 ... ssl_ca = </etc/dovecot/dovecot_imap_chain.crt ssl_cert = </etc/ssl/letsencrypt.org/<host>.combine.crt ssl_cipher_list = EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+AES256:!aNULL:!eNULL:!LOW:!MEDIUM:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:!CAMELLIA ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt ... ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes ... verbose_ssl = yes ssl_verify_client_cert = yes According to https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/ the setting ssl_ca should contain Issuing CA cert Issuing CA CRL Intermediate CA cert Intermediate CA CRL Root CA cert Root CA CRL But how do I build this file? I tried root certificate, root + intermediate certificate and root + intermediate + signed certificate. None of them made it work... I'm completely stuck on how to make certificate verification work. Can anyone give me a hint? Thanks in advance.

1 0

Strategies for protecting IMAP (e.g. MFA)
by Kees van Vloten 14 Nov '21

14 Nov '21

Apart from a really nice firewall firehol also supplies a good set of ip-blacklists. For public exposure of email ports, I am using the combination of firehol-firewall, firehol-blacklist, fail2ban and a whitelist based on geo-ip. The mail-client ports exposed are 993 and 465, because starttls is considered flawed nowadays: https://nostarttls.secvuln.info/) Full access from any IP (except firehol-blacklist and fail2ban) is possible over VPN (openvpn) with MFA (privacyidea). Privacyidea also supplies a mobile-app compatible with a.o. TOTP and HOTP but it provides a more secure way of enrollment (2-step). Thanks for pointing at crowdsec.net, will see if it can tighten security further in cooperation with the above. - Kees On 14-11-2021 11:33, infoomatic wrote: > I will throw in a few interesting projects which have kept my small > servers safe: > > *) firehol.org > > *) crowdsec.net > > *) www.fail2ban.org > > Have a look at those interesting projects! > > > On 13.11.21 22:16, Tyler Montney wrote: >> With the world of ransomware as it is today (aka attacks seem more >> vicious and commonplace), anything I expose to WAN must have >> additional protection. I've seen a few posts to this list on it. The >> only thing that helped was that Dovecot supports OAuth. Through OAuth >> I figure I could implement MFA. However, I'd have to host my own >> identity server. From there, Thunderbird supports OAuth so that should >> work. >> >> Since this is getting increasingly complicated, I wanted to ask before >> going further. What do you all do? Any recommendations?

4 4

Re: Strategies for protecting IMAP (e.g. MFA)
by Marc 14 Nov '21

14 Nov '21

Don't use email addresses as login ;) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -. F1 Outsourcing Development Sp. z o.o. Poland t: +48 (0)12 4207 835 e: marc(a)f1-outsourcing.eu

3 3

IPv4/v6 based access checking and logging
by Lefteris Tsintjelis 13 Nov '21

13 Nov '21

Hi, I am currently using postfix/dovecot with postfix admin and I track the last login date already by using this: https://doc.dovecot.org/configuration_manual/lastlogin_plugin/ Besides last login date, I would like to also implement IPv4 and IPv6 last login tracking also and if possible, IP based login checking. Is post-login scripting the best most efficient way to go? Regards, Lefteris

3 6

2.3.17 update breaks dsync over tcps: Received invalid SSL certificate unable to get certificate CRL
by Salatiel Filho 12 Nov '21

12 Nov '21

Hi, I have updated dovecot from 2.3.16 (working flawless ) to 2.3.17 ( both Centos8 - community repo ) . Now dsync does not work anymore, logs shows: dovecot[30398]: doveadm(vmail): Error: Disconnected from remote: Received invalid SSL certificate: unable to get certificate CRL: /CN=imap.signed.with.my.own.ca(check ssl_client_ca_* settings?) I have a certificate signed by my "own CA". Both hosts trust my CA, and as I told previously, the configuration works just fine on 2.3.16. I really was not expecting that a minor update would break things, but 2.3.17 appears to have broken the setup for some people here in the maillists. Is there a workaround for this? I have tried to set ssl_require_crl = no , but nothing changed. I have: service doveadm { inet_listener { port = 26 ssl = yes } } ssl = required ssl_ca = </etc/ssl/certs/mail-cluster-communication_ca.pem ssl_cert = </etc/ssl/certs/mail-cluster-communication.crt ssl_key = # hidden, use -P to show it Thanks! Atenciosamente/Kind regards, Salatiel

1 0

after replication with compression quotas are wrong
by Arnaud Abélard 12 Nov '21

12 Nov '21

Hello, We are very long time happy dovecot users (since 2008 at least). We have around 90k mailboxes and since we had to move away from our NAS storage to a ceph storage I jumped on the opportunity to enable compression with the zlib plugin and dovecot's replication mecanism. We are using debian's dovecot 2.2.27 packages on production and our new server is running dovecot's own ce-2.3.17 packages. On the production server everything works fine but on the new server, replicated mailboxes' quota is all wrong: on production: # doveadm quota get -u dummy-c-1 Quota name Type Value Limit % Quota Utilisateur STORAGE 660026 976563 67 Quota Utilisateur MESSAGE 8651 - 0 on new server: doveadm quota get -u dummy-c-1 Quota name Type Value Limit % Quota Utilisateur STORAGE 1125251 976563 115 Quota Utilisateur MESSAGE 16646 - 0 If I add all the S flag from the filenames n both servers I get exactly the same usage, which is coherent with the quota on the production server: # find . -type f | grep 'S=' | awk -F'S=' '{print $2}' | awk -F',' '{print $1}' | awk -F':' '{print $1}' | paste -sd+ | bc -l 675865938 And I have exactly the same amountof mails on the two server, the replication works as expected, no unwanted duplication of mails occurs. Of course, I've tried to ask dovecot to recalculate quotas with doveadm quota recalc -u <username>, but it doesn't fix the problem. What am I missing? Thanks, Arnaud PS: Here is my doveconf -n output: # 2.3.17 (e2aa53df5b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: Linux 4.19.0-18-amd64 x86_64 Debian 10.11 # Hostname: gromel-test auth_cache_size = 10 k auth_verbose = yes disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it hostname = gromel1.univ-nantes.prive lda_mailbox_autosubscribe = yes listen = * log_timestamp = "%Y-%m-%d %H:%M:%S " login_trusted_networks = (...) mail_gid = 5000 mail_location = maildir:%h mail_plugins = quota zlib notify replication mail_privileged_group = vmail mail_uid = 5000 maildir_stat_dirs = yes maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { inbox = yes location = prefix = INBOX. separator = . type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { quota = maildir:Quota Utilisateur quota_exceeded_message = Cet utilisateur a dépassé son quota, votre message n'a pu lui être livré. quota_full_tempfail = yes quota_rule = *:storage=1000M quota_rule2 = INBOX.Trash:storage=+100M sieve = ~/dovecot.sieve sieve_dir = ~/sieve sieve_extensions = -vacation sieve_global_dir = /var/lib/dovecot/sieve/global/ sieve_max_redirects = 1 zlib_save = gz zlib_save_level = 6 } postmaster_address = postmaster@<snip> protocols = imap pop3 sieve replication_max_conns = 50 service auth { client_limit = 49452 unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service dict { unix_listener dict { mode = 0600 user = vmail } } service doveadm { inet_listener { port = 12345 } } service imap-login { process_min_avail = 8 service_count = 0 user = mail } service imap { executable = imap process_limit = 16384 vsz_limit = 2 G } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 8 service_count = 0 user = mail vsz_limit = 2 G } service managesieve { drop_priv_before_exec = yes process_limit = 16384 } service pop3-login { process_min_avail = 8 service_count = 0 user = mail } service pop3 { drop_priv_before_exec = yes process_limit = 16384 } ssl = no userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } verbose_proctitle = yes protocol imap { mail_max_userip_connections = 50 mail_plugins = quota zlib notify replication imap_quota zlib } protocol pop3 { mail_plugins = quota zlib notify replication } protocol sieve { mail_max_userip_connections = 10 } protocol lda { mail_plugins = quota zlib notify replication sieve zlib } -- Arnaud Abélard Responsable pôle Système et Stockage Service Infrastructures DSIN Université de Nantes -

2 10

2.3.17: Panic on LMTP deliveries
by Michael Glaus 12 Nov '21

12 Nov '21

Hello Since the doevcot update to 2.3.17 i get a panic if a mail is delivered with lmtp. In the logs i get these messages: lmtp(rcpt(a)example.com)<21067><AtxaKh+hi2FLUgAAwujwpQ>: Error: lmtp-server: conn 10.0.0.105:52981 [1]: rcpt rcpt(a)example.com: duplicate db: User rcpt(a)example.com doesn't have home dir set, disabling duplicate database lmtp(rcpt(a)example.com)<21067><AtxaKh+hi2FLUgAAwujwpQ>: Panic: file imem.c: line 65 (i_strconcat): assertion failed: (str1 != NULL) lmtp(rcpt(a)example.com)<21067><AtxaKh+hi2FLUgAAwujwpQ>: Fatal: master: service(lmtp): child 21067 killed with signal 6 (core dumped) In the running config userdb does not return the field “home” and therefor a user does not have a “mail_home” only a “mail_location”. If i change the config to provide a “mail_home” it works, but due to the directory structure i can not change this yet. Best regards Michael Glaus Junior System Administrator -- Hostpoint AG Neue Jonastrasse 60 | 8640 Rapperswil-Jona | Schweiz michael.glaus(a)hostpoint.ch | www.hostpoint.ch

2 1

Userdb problem
by Erwan David 11 Nov '21

11 Nov '21

Hello I am trying to move authentication from ldap to passwdfile. Autentication works, but clients do not find the mails. With ldap I have : root@email:~ # doveadm auth login erwan xxxxx passdb: erwan auth succeeded extra fields: user=erwan userdb extra fields: erwan home=/var/db/mailboxes/erwan /var/db/mailboxes/erwan=/var/db/mailboxes/erwan uid=587 gid=587 auth_mech=PLAIN With passwdfile I get root@email:~ # doveadm auth login erwan xxxxx passdb: erwan auth succeeded extra fields: user=erwan userdb extra fields: erwan home=/var/db/mailboxes/erwan,uid=587,gid=587 uid=587 gid=587 auth_mech=PLAIN The only difference is this "/var/db/mailboxes/erwan=/var/db/mailboxes/erwan" (which is the place where email is stored). What is the problem with this ? auth configuration is : passdb { driver = passwd-file args = scheme=SHA512-CRYPT username_format=%n /usr/local/etc/dovecot/users } userdb { driver = passwd-file args = username_format=%n /usr/local/etc/dovecot/users # Default fields that can be overridden by passwd-file #default_fields = quota_rule=*:storage=1G default_fields = home=/var/db/mailboxes/%n,uid=587,gid=587 # Override fields from passwd-file #override_fields = home=/home/virtual/%u override_fields = home=/var/db/mailboxes/%n,uid=587,gid=587 }

1 1

Question about sieves
by João Silva 10 Nov '21

10 Nov '21

Hi I'm having a problem related to Dovecot (version 2.2.36) sieves and I'm not finding information. I'm calling a sieve with 90-sieve.conf: imapsieve_mailbox2_name = * 90-sieve.conf: imapsieve_mailbox2_from = SPAM 90-sieve.conf: imapsieve_mailbox2_causes = COPY 90-sieve.conf: imapsieve_mailbox2_before = file:/etc/dovecot/sieve/learn-ham.sieve The SPAM folder have a autoexpunge set. From the log analysis I have a very strong suspect that the sieve is being called when the mails from the Spam folder are expunged, is that possible? Is any other imapsieve_mailbox2_causes that could be used to prevent that? Thanks

3 3

dovecot: 2.3.16 -> 2.3.17_1
by Elise 10 Nov '21

10 Nov '21

Hi team, perhaps I do overlook something here, but after the update from 2.3.16 -> 2.3.17_1on startup Dovecot is generating error message: > doveconf: Fatal: execvp(/usr/local/sbin/dovecot) failed: Argument list too long > /usr/local/etc/rc.d/dovecot: WARNING: failed to start dovecot As a temporary solution I currently hashed out SSL in dovecot.conf and receive e-mail again. Can you tell how to fix? Thanks! /elise

5 9

Dovecot Proxy with OAuth2 Setting Question
by UMETSU HARUYASU(梅津　晴康) 08 Nov '21

08 Nov '21

Hi I'm setting up a Dovecot Proxy Server to access Gmail. But It doesn’t work. I tried to configure Dovecot without proxy authentication. passdb { driver = static args = nopasssword=y proxy=y proxy_mech=xoauth2 ... } It works fine. So far so good. But with proxy authentication It does not work. Many clients don't support Oauth2, so Dovecot needs to authenticate for them. Please tell me how to set up Dovecot Proxy with OAuth2. Reference https://doc.dovecot.org/configuration_manual/authentication/oauth2/ Dovecot 2.3.8 HAL Pyoco

1 0

How to enable LDAP authentication for schema SSHA384
by Ralph Seichter 08 Nov '21

08 Nov '21

While using LDAP-based authentication, I have come across the message auth: Error: [...] Unknown scheme SSHA384 Based on the docs at [1] I use the dovecot.org packages provided for Ubuntu 20.04 LTS which, as you can see, are not yet documented in the HTML page, put are available via [2]. Specifically, I used apt-get install dovecot-ldap dovecot-sqlite to install Dovecot. What else is needed beyond the two listed packages in order to enable support for SSHA384 password hashes in Dovecot? Am I perhaps missing some required configuration parameter? Your help is appreciated. -Ralph [1] https://doc.dovecot.org/installation_guide/dovecot_community_repositories/u… [2] http://repo.dovecot.org/ce-2.3-latest/ubuntu/focal/

3 4

auth-cache on disk?
by Przemysław Kwiatkowski 07 Nov '21

07 Nov '21

Hello, As far as I understand - auth cache it stored in memory, isn't it? Is there a way for it to survive Dovecot restart? -- Przemyslaw Kwiatkowski

4 6

Unable to find mail
by Rob Campbell 06 Nov '21

06 Nov '21

I just installed dovecot and it seems to be working well except I can't find where my new mail is being stored. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In all things, Be Intentional.

2 1

Moving old emails to Gmail
by Rob Campbell 06 Nov '21

06 Nov '21

I have a backup of mail messages I have from back when i was in school using pine and I want to have them imported to my Gmail. So I set up dovecot and my Gmail can access it just fine but it can't find anything except my inbox (which I can't even find). I've moved my mail directory and I can view the emails using alpine but I cannot view my inbox using alpine. Also, although Gmail can get my new test messages, it can't find the messages in ~/mail where I am viewing them with alpine. How do I make it so Gmail can pull from ~/mail or ~/Maildir because I also converted the messages in ~/mail to ~/Maildir format but although I've tried mail_location = mbox:~/mail mail_location = mbox:~/Maildir mail_location = maildir:~/mail and mail_location = maildir:~/Maildir None of this worked but mail_location = maildir:~/Maildir is the only one that will at least allow me to get test messages in my inbox which Gmail can then pull. How do I resolve these issues? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In all things, Be Intentional.

2 1

stale (?) .dovecot.svbin causing segfault in dovecot-lda
by Matthieu Herrb 05 Nov '21

05 Nov '21

Hi, I've not touched the sieve filters I'm using for a long time (last modification 2 years ago), but I've upgraded the dovecot package and the system of my mail server. ~/.dovecot.svbin has not been updated, but I found out today that it would cause dovecot-lda to crash on some specifig messages (and fail to deliver them). Most of the mails (>99.9%) are delivered ok though. Here's the trace of the crash in the system logs : Nov 3 08:48:13 nowhere dovecot: lda(matthieu)<33178><DvDOErY+gmGagQAAB9SSGw>: Panic: Buffer write out of range (0 + 1) Nov 3 08:48:15 nowhere smtpd[37379]: ac2aaecba4099baa mda delivery evpid=b9346ef1d2a6c223 from=<REDACTED> to=<matthieu(a)herrb.eu> rcpt=<matthieu(a)herrb.eu> user=matthieu delay=12s result=PermFail stat=Error ("Abort trap (core dumped) ") After removing the old file, dovecot-lda is able to deliver the message that caused the crash whitout issues. Shouldn't ~/.dovecot.svbin be automatically be re-generated on dovecot version changes ? or is it dependant on other things (like system libs changing) ? Some details: I'm running OpenBSD (7.0 right now, was 6.9 before and probably 6.5 the last time .dovecot.svbin was generated). My logs show that the issue has also been happening with OpenBSD 6.9, but I never noticed until today). OpenSMTP is configured to deliver the message through dovecot-lda with: action "deliver" \ mda "/usr/local/libexec/dovecot/dovecot-lda" \ alias <aliases> in /etc/mail/smtpd.conf Below is the output of doveadm config : # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: OpenBSD 7.0 amd64 ffs # Hostname: nowhere.herrb.eu # NOTE: Send doveconf -n output instead when asking for help. auth_anonymous_username = anonymous auth_cache_negative_ttl = 1 hours auth_cache_size = 0 auth_cache_ttl = 1 hours auth_cache_verify_password_with_worker = no auth_debug = no auth_debug_passwords = no auth_default_realm = auth_failure_delay = 2 secs auth_gssapi_hostname = auth_krb5_keytab = auth_master_user_separator = auth_mechanisms = plain auth_policy_check_after_auth = yes auth_policy_check_before_auth = yes auth_policy_hash_mech = sha256 auth_policy_hash_nonce = auth_policy_hash_truncate = 12 auth_policy_log_only = no auth_policy_reject_on_fail = no auth_policy_report_after_auth = yes auth_policy_request_attributes = login=%{requested_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s session_id=%{session} auth_policy_server_api_header = auth_policy_server_timeout_msecs = 2000 auth_policy_server_url = auth_proxy_self = auth_realms = auth_socket_path = auth-userdb auth_ssl_require_client_cert = no auth_ssl_username_from_cert = no auth_stats = no auth_use_winbind = no auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@ auth_username_format = %Lu auth_username_translation = auth_verbose = yes auth_verbose_passwords = no auth_winbind_helper_path = /usr/bin/ntlm_auth auth_worker_max_count = 30 base_dir = /var/dovecot config_cache_size = 1 M debug_log_path = default_client_limit = 500 default_idle_kill = 1 mins default_internal_group = _dovecot default_internal_user = _dovecot default_login_user = _dovenull default_process_limit = 100 default_vsz_limit = 256 M deliver_log_format = msgid=%m: %$ dict_db_config = director_flush_socket = director_mail_servers = director_max_parallel_kicks = 100 director_max_parallel_moves = 100 director_output_buffer_size = 10 M director_ping_idle_timeout = 30 secs director_ping_max_timeout = 1 mins director_servers = director_user_expire = 15 mins director_user_kick_delay = 2 secs director_username_hash = %u disable_plaintext_auth = yes dotlock_use_excl = yes doveadm_allowed_commands = doveadm_api_key = doveadm_http_rawlog_dir = doveadm_password = doveadm_port = 0 doveadm_socket_path = doveadm-server doveadm_ssl = no doveadm_username = doveadm doveadm_worker_count = 0 dsync_alt_char = _ dsync_commit_msgs_interval = 100 dsync_features = dsync_hashed_headers = Date Message-ID dsync_remote_cmd = ssh -l%{login} %{host} doveadm dsync-server -u%u -U first_valid_gid = 1 first_valid_uid = 1000 haproxy_timeout = 3 secs haproxy_trusted_networks = hostname = imap_capability = imap_client_workarounds = imap_fetch_failure = disconnect-immediately imap_hibernate_timeout = 0 imap_id_log = imap_id_retain = no imap_id_send = name * imap_idle_notify_interval = 2 mins imap_literal_minus = no imap_logout_format = in=%i out=%o deleted=%{deleted} expunged=%{expunged} trashed=%{trashed} hdr_count=%{fetch_hdr_count} hdr_bytes=%{fetch_hdr_bytes} body_count=%{fetch_body_count} body_bytes=%{fetch_body_bytes} imap_max_line_length = 64 k imap_metadata = no imap_urlauth_host = imap_urlauth_logout_format = in=%i out=%o imap_urlauth_port = 143 imapc_cmd_timeout = 5 mins imapc_connection_retry_count = 1 imapc_connection_retry_interval = 1 secs imapc_features = imapc_host = imapc_list_prefix = imapc_master_user = imapc_max_idle_time = 29 mins imapc_max_line_length = 0 imapc_password = imapc_port = 143 imapc_rawlog_dir = imapc_sasl_mechanisms = imapc_ssl = no imapc_ssl_verify = yes imapc_user = import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = instance_name = dovecot last_valid_gid = 0 last_valid_uid = 0 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = libexec_dir = /usr/local/libexec/dovecot listen = *, :: lmtp_add_received_header = yes lmtp_client_workarounds = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_proxy_rawlog_dir = lmtp_rawlog_dir = lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0 lock_method = fcntl log_core_filter = log_debug = log_path = syslog log_timestamp = "%b %d %H:%M:%S " login_access_sockets = login_greeting = Dovecot ready. login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> login_plugin_dir = /usr/local/lib/dovecot/login login_plugins = login_proxy_max_disconnect_delay = 0 login_proxy_max_reconnects = 3 login_proxy_notify_path = proxy-notify login_proxy_timeout = 30 secs login_source_ips = login_trusted_networks = mail_access_groups = mail_always_cache_fields = mail_attachment_detection_options = mail_attachment_dir = mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} mail_attachment_min_size = 128 k mail_attribute_dict = mail_cache_fields = flags mail_cache_min_mail_count = 0 mail_chroot = mail_debug = no mail_fsync = optimized mail_full_filesystem_access = no mail_gid = mail_home = mail_location = maildir:/var/mail/Maildir/%u:INDEX=/var/mail/indexes/%u mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " mail_max_keyword_length = 50 mail_max_lock_timeout = 0 mail_max_userip_connections = 10 mail_never_cache_fields = imap.envelope mail_nfs_index = no mail_nfs_storage = no mail_plugin_dir = /usr/local/lib/dovecot mail_plugins = mail_prefetch_count = 0 mail_privileged_group = mail_save_crlf = no mail_server_admin = mail_server_comment = mail_shared_explicit_inbox = no mail_sort_max_read_count = 0 mail_temp_dir = /tmp mail_temp_scan_interval = 1 weeks mail_uid = mail_vsize_bg_after_count = 0 mailbox_idle_check_interval = 30 secs mailbox_list_index = yes mailbox_list_index_include_inbox = no mailbox_list_index_very_dirty_syncs = no maildir_broken_filename_sizes = no maildir_copy_with_hardlinks = yes maildir_empty_new = no maildir_stat_dirs = no maildir_very_dirty_syncs = no managesieve_client_workarounds = managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext master_user_separator = mbox_dirty_syncs = yes mbox_dotlock_change_timeout = 2 mins mbox_lazy_writes = yes mbox_lock_timeout = 5 mins mbox_md5 = apop3d mbox_min_index_size = 0 mbox_read_locks = fcntl mbox_very_dirty_syncs = no mbox_write_locks = fcntl mdbox_preallocate_space = no mdbox_rotate_interval = 0 mdbox_rotate_size = 10 M mmap_disable = yes namespace inbox { disabled = no hidden = no ignore_on_failure = no inbox = yes list = yes location = mailbox Drafts { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Junk } mailbox Sent { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox "Sent Messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Sent } mailbox Trash { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Trash } order = 0 prefix = separator = / subscriptions = yes type = private } old_stats_carbon_interval = 30 secs old_stats_carbon_name = old_stats_carbon_server = old_stats_command_min_time = 1 mins old_stats_domain_min_time = 12 hours old_stats_ip_min_time = 12 hours old_stats_memory_limit = 16 M old_stats_session_min_time = 15 mins old_stats_user_min_time = 1 hours passdb { args = auth_verbose = default default_fields = deny = no driver = bsdauth master = no mechanisms = name = override_fields = pass = no result_failure = continue result_internalfail = continue result_success = return-ok skip = never username_filter = } plugin { sieve = file:~/sieve;active=~/.dovecot.sieve } pop3_client_workarounds = pop3_delete_type = default pop3_deleted_flag = pop3_enable_last = no pop3_fast_size_lookups = no pop3_lock_session = no pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s pop3_no_flag_updates = no pop3_reuse_xuidl = no pop3_save_uidl = no pop3_uidl_duplicates = allow pop3_uidl_format = %08Xu%08Xv pop3c_features = pop3c_host = pop3c_master_user = pop3c_password = pop3c_port = 110 pop3c_quick_received_date = no pop3c_rawlog_dir = pop3c_ssl = no pop3c_ssl_verify = yes pop3c_user = %u postmaster_address = postmaster@%{if;%d;ne;;%d;%{hostname}} protocols = imap lmtp sieve quota_full_tempfail = no rawlog_dir = recipient_delimiter = + rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s replication_dsync_parameters = -d -N -l 30 -U replication_full_sync_interval = 1 days replication_max_conns = 10 replicator_host = replicator replicator_port = 0 sendmail_path = /usr/sbin/sendmail service aggregator { chroot = . client_limit = 0 drop_priv_before_exec = no executable = aggregator extra_groups = fifo_listener replication-notify-fifo { group = mode = 0600 user = } group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replication-notify { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service anvil { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = anvil extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 1 protocol = service_count = 0 type = anvil unix_listener anvil-auth-penalty { group = mode = 0600 user = } unix_listener anvil { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service auth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = auth -w extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener auth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service auth { chroot = client_limit = 0 drop_priv_before_exec = no executable = auth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener auth-client { group = mode = 0600 user = $default_internal_user } unix_listener auth-login { group = mode = 0600 user = $default_internal_user } unix_listener auth-master { group = mode = 0600 user = } unix_listener auth-userdb { group = mode = 0666 user = $default_internal_user } unix_listener login/login { group = mode = 0666 user = } unix_listener token-login/tokenlogin { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service config { chroot = client_limit = 0 drop_priv_before_exec = no executable = config extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = config unix_listener config { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service dict-async { chroot = client_limit = 0 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict-async { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dict { chroot = client_limit = 1 drop_priv_before_exec = no executable = dict extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dict { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service director { chroot = . client_limit = 0 drop_priv_before_exec = no executable = director extra_groups = fifo_listener login/proxy-notify { group = mode = 00 user = } group = idle_kill = 4294967295 secs inet_listener { address = haproxy = no port = 0 reuse_port = no ssl = no } privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener director-admin { group = mode = 0600 user = } unix_listener director-userdb { group = mode = 0600 user = } unix_listener login/director { group = mode = 00 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service dns-client { chroot = client_limit = 1 drop_priv_before_exec = no executable = dns-client extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = unix_listener dns-client { group = mode = 0666 user = } unix_listener login/dns-client { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service doveadm { chroot = client_limit = 1 drop_priv_before_exec = no executable = doveadm-server extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 1 type = unix_listener doveadm-server { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service health-check { chroot = client_limit = 1 drop_priv_before_exec = yes executable = script -p health-check.sh extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = service_count = 0 type = user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-hibernate { chroot = client_limit = 0 drop_priv_before_exec = no executable = imap-hibernate extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 0 type = unix_listener imap-hibernate { group = $default_internal_group mode = 0660 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = imap-login extra_groups = group = idle_kill = 0 inet_listener imap { address = haproxy = no port = 0 reuse_port = no ssl = no } inet_listener imaps { address = haproxy = no port = 993 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-login { chroot = token-login client_limit = 0 drop_priv_before_exec = no executable = imap-urlauth-login extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = imap service_count = 1 type = login unix_listener imap-urlauth { group = mode = 0666 user = } user = $default_login_user vsz_limit = 18446744073709551615 B } service imap-urlauth-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-urlauth-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service imap-urlauth { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap-urlauth extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener token-login/imap-urlauth { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service imap { chroot = client_limit = 1 drop_priv_before_exec = no executable = imap extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = imap service_count = 1 type = unix_listener imap-master { group = mode = 0600 user = } unix_listener login/imap { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service indexer-worker { chroot = client_limit = 1 drop_priv_before_exec = no executable = indexer-worker extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 10 process_min_avail = 0 protocol = service_count = 0 type = worker unix_listener indexer-worker { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service indexer { chroot = client_limit = 0 drop_priv_before_exec = no executable = indexer extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener indexer { group = mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service ipc { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = ipc extra_groups = group = idle_kill = 0 privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener ipc { group = mode = 0600 user = $default_internal_user } unix_listener login/ipc-proxy { group = mode = 0600 user = $default_login_user } user = $default_internal_user vsz_limit = 18446744073709551615 B } service lmtp { chroot = client_limit = 1 drop_priv_before_exec = no executable = lmtp extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = lmtp service_count = 0 type = unix_listener lmtp { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service log { chroot = client_limit = 0 drop_priv_before_exec = no executable = log extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = log unix_listener log-errors { group = mode = 0600 user = } user = vsz_limit = 18446744073709551615 B } service managesieve-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = managesieve-login extra_groups = group = idle_kill = 0 inet_listener sieve { address = haproxy = no port = 4190 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service managesieve { chroot = client_limit = 1 drop_priv_before_exec = no executable = managesieve extra_groups = group = idle_kill = 0 privileged_group = process_limit = 0 process_min_avail = 0 protocol = sieve service_count = 1 type = unix_listener login/sieve { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service old-stats { chroot = empty client_limit = 0 drop_priv_before_exec = no executable = old-stats extra_groups = fifo_listener old-stats-mail { group = mode = 0600 user = } fifo_listener old-stats-user { group = mode = 0600 user = } group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener old-stats { group = mode = 0600 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop { address = haproxy = no port = 0 reuse_port = no ssl = no } inet_listener pop3 { address = haproxy = no port = 110 reuse_port = no ssl = no } inet_listener pop3s { address = haproxy = no port = 995 reuse_port = no ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service pop3 { chroot = client_limit = 1 drop_priv_before_exec = no executable = pop3 extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = pop3 service_count = 1 type = unix_listener login/pop3 { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } service replicator { chroot = client_limit = 0 drop_priv_before_exec = no executable = replicator extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener replicator-doveadm { group = mode = 00 user = $default_internal_user } unix_listener replicator { group = mode = 0600 user = $default_internal_user } user = vsz_limit = 18446744073709551615 B } service stats { chroot = client_limit = 0 drop_priv_before_exec = no executable = stats extra_groups = group = idle_kill = 4294967295 secs privileged_group = process_limit = 1 process_min_avail = 0 protocol = service_count = 0 type = unix_listener stats-reader { group = mode = 0600 user = } unix_listener stats-writer { group = $default_internal_group mode = 0666 user = } user = $default_internal_user vsz_limit = 18446744073709551615 B } service submission-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = submission-login extra_groups = group = idle_kill = 0 inet_listener submission { address = haproxy = no port = 587 reuse_port = no ssl = no } privileged_group = process_limit = 0 process_min_avail = 0 protocol = submission service_count = 1 type = login user = $default_login_user vsz_limit = 18446744073709551615 B } service submission { chroot = client_limit = 1 drop_priv_before_exec = no executable = submission extra_groups = $default_internal_group group = idle_kill = 0 privileged_group = process_limit = 1024 process_min_avail = 0 protocol = submission service_count = 1 type = unix_listener login/submission { group = mode = 0666 user = } user = vsz_limit = 18446744073709551615 B } shutdown_clients = yes ssl = yes ssl_alt_cert = ssl_alt_key = ssl_ca = ssl_cert = </etc/ssl/herrb.eu.fullchain.pem ssl_cert_username_field = commonName ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ssl_cipher_suites = ssl_client_ca_dir = ssl_client_ca_file = ssl_client_cert = ssl_client_key = ssl_client_require_valid_cert = yes ssl_crypto_device = ssl_curve_list = ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_key_password = ssl_min_protocol = TLSv1.2 ssl_options = ssl_prefer_server_ciphers = no ssl_require_crl = yes ssl_verify_client_cert = no state_dir = /var/dovecot stats_http_rawlog_dir = stats_writer_socket_path = stats-writer submission_client_workarounds = submission_host = submission_logout_format = in=%i out=%o submission_max_mail_size = 0 submission_max_recipients = 0 submission_relay_command_timeout = 5 mins submission_relay_connect_timeout = 30 secs submission_relay_host = submission_relay_master_user = submission_relay_max_idle_time = 29 mins submission_relay_password = submission_relay_port = 25 submission_relay_rawlog_dir = submission_relay_ssl = no submission_relay_ssl_verify = yes submission_relay_trusted = no submission_relay_user = submission_ssl = no submission_timeout = 30 secs syslog_facility = mail userdb { args = auth_verbose = default default_fields = driver = passwd name = override_fields = result_failure = continue result_internalfail = continue result_success = return-ok skip = never } valid_chroot_dirs = verbose_proctitle = no verbose_ssl = yes version_ignore = no protocol lmtp { mail_plugins = " sieve" } protocol lda { mail_plugins = " sieve" } -- Matthieu Herrb

2 1

dsync-trouble
by Hanns Mattes 05 Nov '21

05 Nov '21

Hi, dsync and replication are failing. They used to work, so I guess, it might be related to the update to 2.3.17. This is a fresh install of Freebsd 13. Please let me know, if further Information is needed (I haven't follow Odhiambos advice from another thread yet, but will follow, if requested) With replication-plugin disabled: # doveadm sync -u xxx(a)zzz.de tcps:mail.bruecko.de doveadm(xxx(a)zzz.de): Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Abort enabled plugin (btw: what makes dovecot trying to sync accounts on a fresh install, though the other server isn't configured to replicate with freebsd.bruecko.de): Nov 3 19:08:28 freebsd dovecot[68537]: doveadm(x.zzzz(a)yyy.de)<91733><IT8dBxzQgmFVZgEAA4a8sQ>: Fatal: master: service(doveadm): child 91733 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps) I didn't follow Odhiambos advice from another thread yet, but do, if requested. Any help appreciated doveconf -n: # 2.3.17 (e2aa53df5b): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: FreeBSD 13.0-RELEASE-p4 amd64 # Hostname: freebsd.bruecko.de auth_master_user_separator = * auth_mechanisms = plain login digest-md5 cram-md5 apop auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890+.-_@ auth_verbose = yes doveadm_password = # hidden, use -P to show it doveadm_port = 54321 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To lmtp_save_to_detail_mailbox = yes mail_location = mdbox:~/mdbox mail_plugins = " quota fts fts_xapian zlib notify acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = mdbox:%%h/mdbox prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace { location = mdbox:/virtualmail/public:INDEXPVT=%h/mdbox/Public prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/virtualmail/shared-mailboxes.db fts = xapian fts_autoindex = yes fts_autoindex_exclude = \Trash fts_enforced = yes fts_xapian = partial=3 full=20 verbose=0 mail_replica = tcps:mail.bruecko.de quota = dict:User quota::file:%h/dovecot-quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 250M quota_rule = *:storage=2500M quota_rule2 = INBOX/Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = storage=75%% quota-warning 75 %u sieve = ~/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /virtualmail sieve_max_actions = 0 sieve_max_redirects = 64 sieve_max_script_size = 0 sieve_quota_max_scripts = 0 trash = /usr/local/etc/dovecot/dovecot-trash.conf.ext } postmaster_address = postmaster(a)bruecko.de protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 30 -U -x Public service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail user = vmail } } service decode2text { executable = script /usr/local/libexec/dovecot/decode2text.sh unix_listener decode2text { mode = 0666 } user = dovecot } service doveadm { drop_priv_before_exec = yes inet_listener { port = 54321 ssl = yes } vsz_limit = 0 } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service indexer-worker { vsz_limit = 2 G } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </test/letsencrypt/live/bruecko.de/fullchain.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = " quota fts fts_xapian zlib notify acl sieve" } protocol lda { mail_plugins = " quota fts fts_xapian zlib notify acl sieve" } protocol imap { mail_plugins = " quota fts fts_xapian zlib notify acl imap_quota imap_zlib imap_acl" }

3 12

Recovering deleted messages?
by Sean McBride 05 Nov '21

05 Nov '21

Hi all, I've run postfix and dovecot for years, but they have been so trouble-free that I've never really learned in-depth how they work. :) But now I have a user who accidentally used a POP client, and it deleted all his email. He told me this only days later, and it's now been days later still, and so of course he has sent and received email since. I have backups of course, but it is a feasible thing to 'merge' the deleted emails from the backup into his current mailboxes? I couldn't find any FAQ for such a scenario, so thought I'd ask here... Thanks, Sean

5 5

mail_location for doveadm?
by Grant Keller 05 Nov '21

05 Nov '21

Hello, I am working on getting doveadm commands working from a director to a backend server and I am hitting a bit of a roadblock. We use a homebrew hashing algorithm for mail_location, which we set for users in postlogin scripts. Works fine except I get the following when I run doveadm on a user: # doveadm -D expunge -u gvk mailbox INBOX.Trash SENTBEFORE 1-Jan-2021Debug: Loading modules from directory: /usr/lib64/dovecot/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_quota_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib10_doveadm_quota_plugin.so: undefined symbol: quota_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_lucene_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_lucene_plugin.so: undefined symbol: lucene_index_iter_deinit (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_fts_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/lib20_doveadm_fts_plugin.so: undefined symbol: fts_user_get_language_list (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_mail_crypt_plugin, because dlopen() failed: /usr/lib64/dovecot/doveadm/libdoveadm_mail_crypt_plugin.so: undefined symbol: mail_crypt_box_get_pvt_digests (this is usually intentional, so just ignore this message) doveadm(gvk): Debug: auth-master: passdb lookup(gvk): Started passdb lookup doveadm(gvk): Debug: auth-master: conn unix:/var/run/dovecot/director-userdb: Connecting doveadm(gvk): Debug: auth-master: conn unix:/var/run/dovecot/director-userdb (pid=21984,uid=0): Client connected (fd=11) doveadm(gvk): Debug: auth-master: passdb lookup(gvk): auth PASS input: user=gvk proxy=y proxy_refresh=450 host=c.lab.imapd.sonic.net hostip=184.23.168.77 doveadm(gvk): Debug: auth-master: passdb lookup(gvk): Finished passdb lookup (user=gvk proxy=y proxy_refresh=450 host=c.lab.imapd.sonic.net hostip=184.23.168.77) doveadm(gvk): Error: remote(c.lab.imapd.sonic.net:1842): mail_location not set and autodetection failed: Mail storage autodetection failed with home=/home2/22/25/gvk doveadm(gvk): Debug: auth-master: conn unix:/var/run/dovecot/director-userdb (pid=21984,uid=0): Disconnected: Connection closed (fd=11) I don't see anything like a doveadm-postlogin service in the documentation, so how would I go about making this work. Grant Keller System Operations grant.keller(a)sonic.com

2 1

Memory leaks in dovecot
by Joan Moreau 04 Nov '21

04 Nov '21

Hi Anyone can help on those memory leaks since 2.3.17 ? These came after adding the fts_mail_user_init(user, FALSE, &error) and fts_mail_user_deinit(user) function calls to avoid breaking due to change in the API Thank you for help doveadm: Warning: Event 0x5563f3f2b740 leaked (parent=0x5563f3f2b330): mail-user.c:78 doveadm: Warning: Event 0x5563f3f2b330 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f4009ef0 leaked (parent=0x5563f3f4cf80): mail-index.c:67 doveadm: Warning: Event 0x5563f40096c0 leaked (parent=0x5563f3f4cf80): fs-api.c:32 doveadm: Warning: Event 0x5563f40092b0 leaked (parent=0x5563f3f4cf80): mail-storage.c:430 doveadm: Warning: Event 0x5563f3f4cf80 leaked (parent=0x5563f3f21f00): mail-user.c:78 doveadm: Warning: Event 0x5563f3f21f00 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3f2d080 leaked (parent=0x5563f3f234f0): mail-index.c:67 doveadm: Warning: Event 0x5563f3f2c820 leaked (parent=0x5563f3f234f0): fs-api.c:32 doveadm: Warning: Event 0x5563f3f2c300 leaked (parent=0x5563f3f234f0): mail-storage.c:430 doveadm: Warning: Event 0x5563f3f234f0 leaked (parent=0x5563f3f4e1d0): mail-user.c:78 doveadm: Warning: Event 0x5563f3f4e1d0 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3f24d20 leaked (parent=0x5563f3fd58b0): mail-index.c:67 doveadm: Warning: Event 0x5563f3f24620 leaked (parent=0x5563f3fd58b0): fs-api.c:32 doveadm: Warning: Event 0x5563f3f23e30 leaked (parent=0x5563f3fd58b0): mail-storage.c:430 doveadm: Warning: Event 0x5563f3fd58b0 leaked (parent=0x5563f3fd54a0): mail-user.c:78 doveadm: Warning: Event 0x5563f3fd54a0 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3fd6df0 leaked (parent=0x5563f3fcc8a0): mail-index.c:67 doveadm: Warning: Event 0x5563f3fd65c0 leaked (parent=0x5563f3fcc8a0): fs-api.c:32 doveadm: Warning: Event 0x5563f3fd5dd0 leaked (parent=0x5563f3fcc8a0): mail-storage.c:430 doveadm: Warning: Event 0x5563f3fcc8a0 leaked (parent=0x5563f3f1c990): mail-user.c:78 doveadm: Warning: Event 0x5563f3f1c990 leaked (parent=(nil)): mail-storage-service.c:1359 doveadm: Warning: Event 0x5563f3f16a20 leaked (parent=0x5563f3fbb710): mail-index.c:67

2 1

Dovecot v2.3.17 released
by Aki Tuomi 04 Nov '21

04 Nov '21

We are pleased to release v2.3.17 of Dovecot. Please note that 2.3.17 release will be the last one to support Debian/Stretch since Bullseye is now supported. https://dovecot.org/releases/2.3/dovecot-2.3.17.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.17.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Regards Aki Tuomi Open-Xchange oy --- * Dovecot now logs a warning if time seems to jump forward at least 100 milliseconds. * dict: Lines logged by the dict process now contain the dict name as the prefix. * lib-index: mail_cache_fields, mail_always_cache_fields and mail_never_cache_fields now verifies that the listed header names are valid. Especially the UTF8 "–" character has sometimes been wrongly used instead of the ASCII "-". + *-login: Added login_proxy_rawlog_dir setting to capture rawlogs between proxy and backend. + dict: The server process now keeps the last 10 idle dict backends cached for maximum of 30 seconds. Practically this acts as a connection pool for dict-redis and dict-ldap. Note that this doesn't affect dict-sql, because it already had its own internal cache. + doveadm: New stats add/remove commands added to support changing the metrics configuration on runtime. + lazy_expunge: Added lazy_expunge_exclude settings to disable lazy_expunge for specific folders. \Special-use flags can be used as folder names. + lib-lua: Added a new helper function dovecot.restrict_global_variables() to disable or enable defining new global variables. - LAYOUT=index List index rebuild was missing. - LAYOUT=index: Duplicate GUIDs were not detected. - acl: When using acl_ignore_namespace Dovecot attempted to access or create dovecot-acl-list even when the namespace should have been ignored. For virtual namespaces this could have yielded errors about "Read-only file system" or "Permission denied". - auth: Setting the "master" passdb field to empty value would cause proxying to fail with an authentication error. Now an empty "master" field is ignored. - doveadm-server: Duplicate error lines were sent for failed commands. This didn't normally cause visible problems, except when using wildcards in usernames or -A parameter to go through multiple users. - doveadm-server: Logs written by doveadm-server were often missing log prefixes, especially mail_log_prefix for mail commands. Logs sent to doveadm TCP client were also missing log prefixes. - doveadm: v2.3 regression: batch command always crashes. - doveadm: v2.3.11 regression: Commands failed if ssl_cert or ssl_key files weren't readable by the user running doveadm, even though doveadm didn't actually use these settings - imap-hibernate: Process may crash at deinit: Panic: file ioloop.c: line 928 (io_loop_destroy): assertion failed: (ioloop->cur_ctx == NULL). - imap: Using imap_fetch_failure=no-after can cause assert-crash with some IMAP commands if reading the mail fails (e.g. wrong cached mail size). Fixes: Panic: file index-mail-headers.c: line 198 (index_mail_parse_header_init): assertion failed: (!mail->data.header_parser_initialized) - imap: v2.3.10 regression: When using INDEXPVT to enable private \Seen flags (for shared or public namespaces) the STORE command did not send untagged replies for the \Seen flag changes. - imap: v2.3.15 regression: If PREVIEW/SNIPPET is not the final FETCH option in the command, the IMAP FETCH response is broken. - imap: v2.3.15 regression: MOVE command leaks mailbox if it can't be opened and crashes at deinit: Panic: file mail-user.c: line 229 (mail_user_deinit): assertion failed: ((*user)->refcount == 1). - imapc: Copying nonexistent mail via imapc could have crashed. Fixes: Panic: file mail-storage.c: line 2385 (mailbox_transaction_commit_get_changes): assertion failed: (ret < 0 || seq_range_count(&changes_r->saved_uids) == save_count || array_count(&changes_r->saved_uids) == 0). - indexer: v2.3.15 regression: Process crashes if indexer-client disconnects while it's waiting for command reply. This happened for example if IMAP SEARCH triggered long fts indexing and the IMAP client disconnected while waiting for the reply. - indexer: v2.3.15 regression: Process may have crashed in some situations. - indexer: v2.3.15 regression: indexer-worker processes may not have reached the process_limit in some situations, possibly even using just one indexer-worker process even though there were many indexing requests queued. - lib-compression: Reading lz4 compressed mdbox mails may crash. Fixes: Panic: file istream.c: line 345 (i_stream_read_memarea): assertion failed: (!stream->blocking). - lib-compression: bench-compress crashes due to xz being read-only. - lib-lua: Fix linking libdict_lua for non-GNU linkers when Lua support is disabled. - lib-mail: There was no limit on how large an email header name could be. Processable header names are now limited to 1000 bytes. - lib-oauth2: Dovecot disallowed JWT tokens if their validity time was older than token creation time (nbf < iat). - lib-storage: Reduce memory footprint of certain storage operations. - lib-storage: When listing mailboxes with storage name escape characters (^ or .) as part of the mailbox name, the listing could show corrupted mailbox names. Due to an issue in handling escaped parent folders, the listing of other mailbox names would become corrupted by prepending parts of the previously listed mailboxes parent folder as prefix to the actual mailbox names. The corruption can occur when using LAYOUT=INDEX and maildir or obox, or when using the listescape plugin. - mail-crypt: Fix "-O" argument for "doveadm mailbox cryptokey password" command to be a boolean, and not expect a string. - submission-login: Add support for not authenticating to next hop in submission proxying. - submission-login: EHLO was not sent again after XCLIENT when doing submission proxying. - virtual: Mailboxes do not correctly detect underlying mailboxes getting re-created even though they have a different UIDVALIDITY or GUID.

9 13

2.3.17 broken on CentOS8 / bug
by TG Servers 04 Nov '21

04 Nov '21

7 14

disable sieve replication with dsync
by David Mandelberg 04 Nov '21

04 Nov '21

Hi, I think I got dsync working for mail, but I'm getting these errors: Error: sieve: file storage: mkdir_parents_chgrp(/usr/local/etc/mail/mandelberg.org/david/sieve/tmp) failed: Read-only file system I'm managing sieve files externally, and I don't want any part of dovecot writing to them. Is there any way to configure dsync to not replicate them? I looked at doveadm-sync(1) to see about adding a flag to replication_dsync_parameters, but the closest thing I see is -x for excluding mailboxes. Or maybe -o? Is there a way to specify a nested setting to -o, so I could do something like `plugin { sieve = }` for dsync?

1 0

Re: full-text index and search
by Marc 03 Nov '21

03 Nov '21

Is there some info on what to expect how big these indexes can get (% mailbox)? Is there any differences between solr / xapian storage use? https://github.com/slusarz/dovecot-fts-flatcurve/

2 1

Re: limiting cpu time of dovecot/imap
by Marc 03 Nov '21

03 Nov '21

> > What would be the best way to 'throttle' dovecot/imap processes of specific users? > > > > Can you please elaborate a bit how you would like to ‘throttle’ the processes? Give it less CPU time? > > That you can probably achieve by returning service/imap/executable="/usr/bin/nice -n 10 /usr/libexec/dovecot/imap" > from users for the throttled users. > Thanks Sami, I was experimenting with some external script that applied cpulimit and ionice to processes. But this suggestion is of course much nicer.

1 0

RE: health check passthrough not 100% in combination with haproxy
by Marc 03 Nov '21

03 Nov '21

I was not having the exit trap and the sleep+kill, I don't really get why it is necessary to have these. Looks a bit inefficient to me having a sleep and to kill your own process. But I am not really a bash expert. > > which of course does not make sense... can you try if this works? I'm guessing your script probably looks pretty much like this already... > > #!/bin/bash > timeout=10 > trap "exit 0" QUIT > { > sleep $timeout > kill -3 $$ 2>/dev/null > } & > read -r input > exit_code=$? > if [ ${exit_code} -eq 0 ]; then > echo -n -e "HTTP/1.1 200 OK\r\n" > echo -n -e "Content-Length: 0\r\n" > echo -n -e "\r\n" > fi > exit 0

1 0

dsync error: Received unexpected input d != N
by David Mandelberg 03 Nov '21

03 Nov '21

Hi, I'm trying to set up replication with dsync, and I'm getting errors like this: dsync-local(david(a)mandelberg.org)<...>: Error: dsync(...): Received unexpected input d != N I tried the `doveadm -D sync` command from https://doc.dovecot.org/configuration_manual/replication/#administration and its output looked like: ... dsync-local(david(a)mandelberg.org)<...>: Debug: brain M: Locking done by remote (local hostname=..., remote hostname=...) dsync-local(david(a)mandelberg.org)<...>: Debug: brain M: Local mailbox tree: ... [line above repeated many times for different mailboxes] dsync-local(david(a)mandelberg.org)<...>: Error: dsync(...): Received unexpected input d != N dsync-local(david(a)mandelberg.org)<...>: Error: dsync(...): Received unexpected input d != N dsync-local(david(a)mandelberg.org)<...>: Debug: auth-master: conn unix:/run/dovecot/auth-userdb (pid=47097,uid=0): Disconnected: Connection closed (fd=8) I'm a bit stuck. Does anybody have any ideas what's going on? The output of `doveconf -n` is attached.

1 1

Auth-Trouble
by Hanns Mattes 03 Nov '21

03 Nov '21

Hi, I've installed Dovecot on a freshly installed machine running Freebsd 13.4. Configuration was copied from an earlier installation, which worked perfectly, until I screwed an update. AFAICS things are working, except replication. I see tons of Errors on the remote and the local machine Oct 31 16:15:30 freebsd dovecot[3248]: doveadm(xxx(a)xx.de): Fatal: connect(213.239.197.36:54321) failed: Interrupted system call and some Oct 31 16:47:33 freebsd dovecot[5509]: auth: cram-md5(xxx(a)xx.de,176.199.241.57,<xSyR+afPn9ywx/E5>): Password mismatch Oct 31 16:47:28 freebsd dovecot[5509]: doveadm(xxx(a)yy.de): Fatal: connect(213.239.197.36:54321) failed: Connection refused and we also get Oct 31 18:17:17 freebsd dovecot[934]: imap(xxx(a)wxxx.de)<1649><lWFvO6nPDeewx/E5>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Oct 31 18:17:17 freebsd dovecot[934]: imap(xxx(a)wxxx.de)<1649><lWFvO6nPDeewx/E5>: Fatal: master: service(imap): child 1649 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set service imap { drop_priv_before_exec=yes }) not to forget Oct 31 18:18:33 freebsd dovecot[934]: doveadm(xxx@xxx): Fatal: connect(213.239.197.36:54321) failed: Connection refused Users are authenticating with ldap. I'm clueless, and I don't have any clue, if it is a misconfiguration of dovecot or my freebsd-install. Any ideas appreciated Here is the output of doveconf -n # 2.3.17 (e2aa53df5b): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.17 (054dddfa) # OS: FreeBSD 13.0-RELEASE-p4 amd64 # Hostname: freebsd.bruecko.de auth_mechanisms = plain login digest-md5 cram-md5 apop auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890+.-_@ auth_verbose = yes doveadm_password = # hidden, use -P to show it doveadm_port = 54321 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lda_original_recipient_header = X-Original-To lmtp_save_to_detail_mailbox = yes mail_location = mdbox:~/mdbox mail_plugins = " quota fts fts_xapian trash zlib notify replication acl" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace { hidden = no ignore_on_failure = no inbox = no list = children location = mdbox:%%h/mdbox prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace { location = mdbox:/virtualmail/public:INDEXPVT=%h/mdbox/Public prefix = Public/ separator = / subscriptions = yes type = public } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = INBOX/ separator = / } passdb { args = /usr/local/etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile acl_anyone = allow acl_shared_dict = file:/virtualmail/shared-mailboxes.db fts = xapian fts_autoindex = yes fts_autoindex_exclude = \Trash fts_enforced = yes fts_xapian = partial=3 full=20 verbose=0 mail_replica = tcps:mail.bruecko.de quota = dict:User quota::file:%h/dovecot-quota quota_exceeded_message = Storage quota for this account has been exceeded, please try again later. quota_grace = 250M quota_rule = *:storage=2500M quota_rule2 = INBOX/Trash:storage=+10%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full / Mailbox ist voll quota_status_success = DUNNO quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u quota_warning3 = storage=75%% quota-warning 75 %u sieve = ~/dovecot.sieve sieve_dir = ~/sieve sieve_global_dir = /virtualmail sieve_max_actions = 0 sieve_max_redirects = 128 sieve_max_script_size = 0 sieve_quota_max_scripts = 0 trash = /usr/local/etc/dovecot/dovecot-trash.conf.ext } postmaster_address = admin(a)bruecko.de protocols = imap pop3 lmtp sieve replication_dsync_parameters = -d -N -l 30 -U -x Public service aggregator { fifo_listener replication-notify-fifo { user = vmail } unix_listener replication-notify { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } unix_listener auth-userdb { group = vmail user = vmail } } service decode2text { executable = script /usr/local/libexec/dovecot/decode2text.sh unix_listener decode2text { mode = 0666 } user = dovecot } service doveadm { inet_listener { port = 54321 ssl = yes } vsz_limit = 0 } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service indexer-worker { vsz_limit = 2 G } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = 24 } user = vmail } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </usr/local/etc/dovecot/fullchain17.pem ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_client_ca_dir = /etc/ssl/certs ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /usr/local/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = " quota fts fts_xapian trash zlib notify replication acl sieve" } protocol lda { mail_plugins = " quota fts fts_xapian trash zlib notify replication acl sieve" } protocol imap { mail_max_userip_connections = 100 mail_plugins = " quota fts fts_xapian trash zlib notify replication acl imap_quota imap_zlib imap_acl" } Regards Hanns

2 7

Shared folders - dovecot.index.pvt view is inconsistent
by Felix Ingram 03 Nov '21

03 Nov '21

Hello all, As part of the system I'm cobbling together, I have a need for sharing folders between users. I've followed the various pieces of documentation and seem to have something working but have encountered an odd issue. When user1 shares a folder with user2, then on first access user2 gets a "permission denied" error when trying to access the folder. If I immediately try to access the folder again, then everything is okay. The logs talk about the index.pvt files being inconsistent, which seems to result in the error the first time but allows access the second. I've searched the mailing lists and it seems that this was seen a few years ago and is due to the index files being empty but there didn't seem to be a resolution. At the moment, I am filing messages into folders under INBOX, which means that the INBOX itself is empty (though I've seen the same behaviour if I put some messages in there as well). Can anyone suggest a fix/workaround? I've included my config and some log entries below. In the logs, the "tester@..." user is trying to access the folder "INBOX/tester2" shared by "foo123@...". (Bonus question: can anyone suggest a mail client that allows easy access to shared folders? For the life of me I can't see how to do it in Thunderbird, so I'm using a python script at the moment.) Thanks in advance, Felix # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.10.16.3-microsoft-standard-WSL2 x86_64 Ubuntu 20.04.3 LTS overlay # Hostname: ptm-dovecot-5b466fb667-gk6f7 auth_debug = yes auth_debug_passwords = yes auth_master_user_separator = * auth_username_chars = auth_verbose = yes dict { acl = pgsql:/etc/dovecot/conf.d/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no log_path = /dev/stderr mail_debug = yes mail_location = maildir:/home/vmail/%u mail_plugins = acl master_user_separator = * namespace { inbox = yes location = prefix = separator = / type = private } namespace { list = children location = maildir:/home/vmail/%%u:INDEXPVT=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } plugin { acl = vfile:/etc/dovecot/dovecot-acl:cache_secs=6 acl_defaults_from_inbox = yes acl_shared_dict = proxy::acl sieve_default = /etc/dovecot/conf.d/user-to-folder.sieve } protocols = imap lmtp service auth { unix_listener auth-userdb { group = vmail mode = 0600 user = vmail } user = root } service lmtp { inet_listener lmtp { address = 0.0.0.0 port = 24 } } userdb { args = /etc/dovecot/conf.d/dovecot-sql.conf.ext driver = sql } protocol lmtp { log_path = /home/vmail/dovecot-deliver.log mail_plugins = acl sieve postmaster_address = admin(a)mydomain.com } protocol imap { mail_plugins = acl imap_acl } Log output: Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = tester(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 1 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: Namespace : type=shared, prefix=shared/%u/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no location=maildir:/home/vmail/%u:INDEXPVT=~/Maildir/shared/%u Nov 03 14:38:27 : Debug: shared: root=/var/run/dovecot, index=, indexpvt=, control=, inbox=, alt= Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = tester(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 0 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: Mailbox INBOX: Mailbox opened because: SELECT Nov 03 14:38:27 : Debug: acl vfile: file /home/vmail/ tester(a)dovecot.mydomain.com/dovecot-acl not found Nov 03 14:38:27 : Debug: Namespace : /home/vmail/tester(a)dovecot.mydomain.com doesn't exist yet, using default permissions Nov 03 14:38:27 : Debug: Namespace : Using permissions from /home/vmail/ tester(a)dovecot.mydomain.com: mode=0700 gid=default Nov 03 14:38:27 : Debug: acl vfile: file /home/vmail/ tester(a)dovecot.mydomain.com/dovecot-acl not found Nov 03 14:38:27 : Debug: auth-master: userdb lookup( foo123(a)dovecot.mydomain.com) Started userdb lookup Nov 03 14:38:27 : Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting Nov 03 14:38:27 : Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Client connected (fd=18) Nov 03 14:38:27 auth: Debug: master in: USER 1 foo123(a)dovecot.mydomain.com service=imap Nov 03 14:38:27 auth: Debug: sql(foo123(a)dovecot.mydomain.com): Performing userdb lookup Nov 03 14:38:27 auth: Debug: sql(foo123(a)dovecot.mydomain.com): SELECT home, uid, gid FROM users WHERE userid = 'foo123' AND domain = ' dovecot.mydomain.com' Nov 03 14:38:27 auth: Debug: sql(foo123(a)dovecot.mydomain.com): Finished userdb lookup Nov 03 14:38:27 auth: Debug: userdb out: USER 1 foo123(a)dovecot.mydomain.com home=/tmp/foo123 uid=5000 gid=5001 Nov 03 14:38:27 : Debug: auth-master: userdb lookup( foo123(a)dovecot.mydomain.com) auth USER input: foo123(a)dovecot.mydomain.com home=/tmp/foo123 uid=5000 gid=5001 Nov 03 14:38:27 : Debug: auth-master: userdb lookup( foo123(a)dovecot.mydomain.com) Finished userdb lookup (username= foo123(a)dovecot.mydomain.com home=/tmp/foo123 uid=5000 gid=5001) Nov 03 14:38:27 : Debug: maildir++: root=/home/vmail/ foo123(a)dovecot.mydomain.com, index=, indexpvt=/tmp/foo123/Maildir/shared/ foo123(a)dovecot.mydomain.com, control=, inbox=/home/vmail/ foo123(a)dovecot.mydomain.com, alt= Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = foo123(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 1 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: maildir++: root=/home/vmail/ foo123(a)dovecot.mydomain.com, index=, indexpvt=/tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com, control=, inbox=/home/vmail/ foo123(a)dovecot.mydomain.com, alt= Nov 03 14:38:27 : Debug: acl: initializing backend with data: vfile:/etc/dovecot/dovecot-acl:cache_secs=6 Nov 03 14:38:27 : Debug: acl: acl username = tester(a)dovecot.mydomain.com Nov 03 14:38:27 : Debug: acl: owner = 0 Nov 03 14:38:27 : Debug: acl vfile: Global ACL file: /etc/dovecot/dovecot-acl Nov 03 14:38:27 : Debug: Mailbox shared/foo123(a)dovecot.mydomain.com/INBOX: Mailbox opened because: SELECT Nov 03 14:38:27 : Debug: acl vfile: reading file /home/vmail/ foo123(a)dovecot.mydomain.com/dovecot-acl Nov 03 14:38:27 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX/dovecot.index.pvt reset, view is now inconsistent Nov 03 14:38:27 : Debug: Namespace shared/: Using permissions from : mode=0700 gid=default Nov 03 14:38:27 : Debug: acl vfile: file /home/vmail/ foo123(a)dovecot.mydomain.com/.INBOX.tester2/dovecot-acl not found Nov 03 14:38:27 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX/dovecot.index.pvt view is inconsistent Nov 03 14:38:27 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: Mailbox opened because: SELECT Nov 03 14:38:27 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX.tester2/dovecot.index.pvt reset, view is now inconsistent Nov 03 14:38:28 : Error: /tmp/tester/Maildir/shared/ foo123(a)dovecot.mydomain.com/.INBOX.tester2/dovecot.index.pvt view is inconsistent Nov 03 14:38:28 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: UID 1: Opened mail because: prefetch Nov 03 14:38:28 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: UID 1: Opened mail because: access Nov 03 14:38:28 : Debug: Mailbox shared/ foo123(a)dovecot.mydomain.com/INBOX/tester2: UID 1: Opened mail because: full mail Nov 03 14:38:28 : Info: FETCH failed: Permission denied in=360 out=2880 deleted=0 expunged=0 trashed=0 hdr_count=0 hdr_bytes=0 body_count=1 body_bytes=857

1 0

full-text index and search
by Yonghua Peng 03 Nov '21

03 Nov '21

dear community Does dovecot have the plugins to implement full-text indexing and searching? Thanks a lot.

2 1

Multiple messages with the same GUID
by Ron Garret 02 Nov '21

02 Nov '21

I somehow ended up with multiple messages in the same mailbox with the same GUID. All of the messages are identical (AFAICT) but getting multiple responses for doveadm fetch for a particular guid is screwing up one of my applications. When I searched for the offending guid in dovecot-uidlist I found this: 4927 :1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 4928 G1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 :1632880292.M915983P1968.vm1.rngh.net,S=3942258,W=3993573 4929 G1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 :1632880303.M863130P547.vm1.rngh.net,S=3942258,W=3993573 4930 G1632837493.M663171P23208.vm1.rngh.net,S=3942258,W=3993573 :1632880303.M863131P547.vm1.rngh.net,S=3942258,W=3993573 I tried to figure this out by looking at: https://doc.dovecot.org/admin_manual/mailbox_formats/maildir/ but this case doesn’t seem to be covered there. Can someone please help me figure out what might have happened to produce this situation? Is there a way to recover from it? Thanks, rg

2 2

Transfer or Archival of Dovecot Accounts
by Stefan Malte 02 Nov '21

02 Nov '21

Hello, We have the following situation: We are using Dovecot on several Mailservers administered via ISPConfig. The servers all use old versions of Debian and ISPConfig and my job - I joined the company as a Linux system administrator 6 months ago - is to consolidate these old servers into one new server I already set up. I did a trial run with one user from one company by way of duplicating her account on the new server, creating a new mail account in her outlook and changing the MX record from the old to the new server. This works. This was rather time-intensive and I still have to face the problem of what to do with the existing mail data once we shut down the old servers one-by-one. Is there a way to move or even better integrate the data from the old mailbox on the old server to the new mailbox on the new server without any user intervention? https://pypi.org/project/dovecot-archive/ looks promising, but it assumes a situation we don't have: In our case the original user and the user in whose mailbox the data should be stored have the same email address. I am very open to suggestions on how to do this the smart way. Even manually entering the users' account data by hand on the new server is very time consuming. At the same time this is a much needed opportunity to weed out old mailboxes and forwardings which are not used any more. Even complete domains on the old servers have proven to be not in use anymore - the client company switched to Exchange online according to the MX record and failed to inform us. Anyway, this is a huge load of work and I'd rather spend more time preparing correctly and efficiently repeating simple tasks again and again. I am grateful for any advice. After all, this situation is certainly not unique. Yours faithfully Stefan Malte Schumacher

1 0

health check passthrough not 100% in combination with haproxy
by Marc 02 Nov '21

02 Nov '21

I have been trying to get a simple health check in haproxy to work. But somehome the haproxy request is differently handled then a curl request, which generates a socket error in haproxy. The health script echos these lines, with this config[2] echo -ne "HTTP/1.1 200 OK\r\n" echo -ne "Content-Length: 0\r\n" echo -ne "\r\n" exit 0 The curl request generates ok, haproxy generates socket error. The haproxy=yes, reuseport=yes do not seem to resolve anything. If stop dovecot and run "dovecot-health-check.sh | nc -l 192.168.10.46 5001" then the haproxy check is ok. So I guess the script is ok. But what is dovecot then doing with it's output when haproxy is requesting it? [1] https://discourse.haproxy.org/t/httpck-on-bash-script-results-in-socket-err… [2] service health-check { executable = script -p /usr/local/sbin/dovecot-health-check.sh inet_listener health-check { port = 5001 haproxy = no reuse_port = no } }

3 6

Ldap dict for shared mailboxes
by Kees van Vloten 02 Nov '21

02 Nov '21

Hi everybody, I am trying to construct a LDAP dict for shared mailboxes. There is a lot of documentation available but nothing specific to this usecase. I could not find anything useful on Google nor in the mailinglist archives :-( The best start point seems to be the doc on shared mailbox dictionaries (https://doc.dovecot.org/configuration_manual/shared_mailboxes/shared_mailbo…) in particular the example for SQL dict. But obviously LDAP is different than SQL. The dictionaries page (https://doc.dovecot.org/configuration_manual/dict/) has LDAP example but it looks like it does not contain all the bit and pieces I need. Following the structure of the SQL example, I come to something like this: map { pattern = shared/shared-boxes/user/$to/$from base_dn = ou=shared mailboxes,dc=example,dc=com filter = (&(objectClass=group)(mail=%{from}) fields { from_user=$from to_user=$to } } The "to_user" / "$to" should be filled with the 'uid' or 'email' of a nested group lookup of the 'member' fields of the group. What are the mechanics to get that done? Does anyone has an example or pointer to documentation or is a LDAP dict for shared-mailboxes not possible / supported? And in the latter case, suggestions about possible alternatives are welcome :-) FYI. the LDAP implementation I am using is a recent Samba4 ad-dc. - Kees.

1 0

limiting cpu time of dovecot/imap
by Marc 01 Nov '21

01 Nov '21

What would be the best way to 'throttle' dovecot/imap processes of specific users?

2 1