- dovecot - dovecot.org

best practice purging only moved messages
by Marc 18 Mar '21

18 Mar '21

If I move a message from the 'inbox' namespace to my 'archive' namespace. The message is expunged at the 'inbox' namespace and added to the 'archive' namespace. What is the best way to only purge messages that have been moved. (I do not want to purge emails that have been deleted yet)

1 0

How can I migrate mailboxes after changing hierarchy separator?
by Popkornium18 17 Mar '21

17 Mar '21

Hi, I had a common problem (folders can't contain dots) and the obvious solution seems to be changing the hierarchy separator and using the listescape plugin. My question is: Do I need to take any extra steps after changing the separator to migrate my existing mailboxes? If so, which? I tried just simply renaming the folders and doing a `doveadm force-resync` but that did not work as intended. Afterwards I wasn't able to subscribe to any of my folders, so I guess that isn't the way to go. Kind regards Simon

1 0

inconsistency in reporting from mdbox_deleted
by Marc 17 Mar '21

17 Mar '21

This reports all folders, ok [@ testtest]# doveadm -o mail_location=mdbox_deleted:/home/mail-archive/testtest/Archive:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' '*' 2011 messages=0 vsize=0 2012 messages=0 vsize=0 2013 messages=0 vsize=0 2014 messages=0 vsize=0 2015 messages=0 vsize=0 2016 messages=0 vsize=0 2017 messages=0 vsize=0 2018 messages=0 vsize=0 2019 messages=0 vsize=0 doveadm(testtest): Error: Mailbox Archive: Failed to lookup mailbox status: Mailbox doesn't exist: Archive INBOX messages=15 vsize=12066832 This gets folder INBOX, ok [@ testtest]# doveadm -o mail_location=mdbox_deleted:/home/mail-archive/testtest/Archive:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' 'INBOX' INBOX messages=15 vsize=12066832 This reports error that a folder does not exist, ok [@ testtest]# doveadm -o mail_location=mdbox_deleted:/home/mail-archive/testtest/Archive:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' 'asdfasdfasdfasdf' doveadm(testtest): Error: Mailbox asdfasdfasdfasdf: Failed to lookup mailbox status: Mailbox doesn't exist: asdfasdfasdfasdf This query for Archive/2012 reports same as for 2012(?), by design, I guess ok [@ testtest]# doveadm -o mail_location=mdbox_deleted:/home/mail-archive/testtest/Archive:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' 'Archive/2012' Archive/2012 messages=0 vsize=0 This reports 0?, This should either report the folder does not exist, or it should report the same as getting the INBOX, like previous result [@ testtest]# doveadm -o mail_location=mdbox_deleted:/home/mail-archive/testtest/Archive:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' 'Archive/INBOX' Archive/INBOX messages=0 vsize=0

1 0

feature request: prevent linking of email
by Marc 17 Mar '21

17 Mar '21

What I have been doing wrong with testing expunged emails, is working with linked copies of emails. Although thunderbird copies the message, it looks like the message is NOT copied but linked. If I drag 3 emails from my desktop to a folder INBOX/test4 and copy 1 message from INBOX to INBOX/test4. I have 4 messages in this folder. I now shift+del this folder. The expunged messages listing gives me the expected 3 messages doveadm -o mail_location=mdbox_deleted:/home/popusers/testtest/mdbox:INDEX=/home/popindex/testtest/index mailbox status -u testtest 'messages vsize' '*' Sent messages=0 vsize=0 Drafts messages=0 vsize=0 INBOX/test2 messages=0 vsize=0 Junk messages=0 vsize=0 Trash messages=0 vsize=0 test3 messages=0 vsize=0 test1 messages=0 vsize=0 RESTORED messages=0 vsize=0 INBOX messages=3 vsize=18079344 Lets recover these: doveadm -v import -u testtest 'mdbox_deleted:/home/popusers/testtest/mdbox:INDEX=/home/popindex/testtest/index' RESTORED ALL Now I have 3 messages back, as expected. From an end users perspective if you delete a folder with 4 emails, you want your restored backup to have 4 emails, not 3 because one is already somewhere else in your folder/mailbox structure. The reason for copying an email to a different folder is that it is important. You do not want to loose it, and you want to be able to find it there. It is wrong to assume that a user will notice that these emails are missing and should look for them elsewhere. Say you have folder for a court case, and you copy emails there relevant for the court case. How can you ever know after a restore that a few email are missing from the folder, and which ones. I think it is bad this email is currently 'lost'. I rather have an option in dovecot that disables this hidden 'deduplication' feature. I think this should be the default setting also. This current deduplication feature also is hazardous because if this one copy of the email gets corrupted on the storage, you have no copies left. That is exactly the opposite of what user wants to accomplish with creating a copy. Feature request: disable this automatic linking of emails between mailboxes. Feature request: set this as a default.

2 3

Ability to put dovecot version in received header
by Kamil Jońca 17 Mar '21

17 Mar '21

I know that some time ago there was a discussion and this is conscious decision to remove dovecot version from headers during lmtp delievery. But is it possible to restore it as an option? -- http://stopstopnop.pl/stop_stopnop.pl_o_nas.html

3 3

Latest dovecot does not work with latest MUA (thunderbird)
by lja＠koti 17 Mar '21

17 Mar '21

Hi, Latest dovecot does not work with latest thunderbird. It does not react to sent emails. They are put to maildir by postfix a-ok. The version of thunderbird that works ok: 68.12.1 Distro: Distributor ID: Ubuntu Description: Ubuntu 20.04.2 LTS Release: 20.04 Codename: focal $ dovecot -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.7.2 () # OS: Linux 5.9.0-rc5 x86_64 Ubuntu 20.04.2 LTS # Hostname: superman.sillywalk.org auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = plain debug_log_path = /var/log/dovecot-debug.log info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_debug = yes mail_location = maildir:~/Maildir/ mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0660 user = postfix } } ssl_cert = </etc/letsencrypt/live/lja.fi/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { imap_metadata = yes } local_name paxsudos.fi { ssl_cert = </etc/letsencrypt/live/somethingB.fi/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it } local_name paxsudos.com { ssl_cert = </etc/letsencrypt/live/somethingB.com/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it } local_name lja.fi { ssl_cert = </etc/letsencrypt/live/somethingA.fi/fullchain.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it } -- <https://paxsudos.com/> ,-- Information -------------------------------------------------------- ------ --- -- - | Lauri Jakku | Contact: | Phone: +358 40 220 3910 | Address: Puusepänkatu 1 A 3, 90130 Oulu, Finland '--------------- -------- ----- ----- ------- ---- --- -- Firmani, Paxsudos IT, kautta olen jättämässä oman, vaikka pienen, jäljen ympäristötekoina, että tulevaisuudessakin voimme nauttia luonnosta. Ympäristö ja luonto on sellaista joita otamme itsestäänselvyyksinä, tuon takia on käymässä niin että havahdumme kun on tilanne erittäin huono. We offset our carbon footprint via Ecologi <https://ecologi.com/paxsudosit> ,-- Virus scan done for content -------------------------------------------------------- ------ --- -- - | Known viruses: 10722370 | Engine version: 0.102.4 | Scanned directories: 0 | Scanned files: 1 | Infected files: 0 | Data scanned: 0.01 MB | Data read: 0.01 MB (ratio 1.00:1) | Time: 16.864 sec (0 m 16 s) '--------------- -------- ----- ----- ------- ---- --- --

5 9

feature request: doveadm -Dv purge
by Marc 17 Mar '21

17 Mar '21

Maybe list emails being purged

1 0

how to search expunged messages
by Marc 16 Mar '21

16 Mar '21

Is there an equivalent for expunged messages of this: doveadm search -u testtest mailbox '*' DELETED

2 2

another try listing expunged mail, now only tested with dovecot cli
by Marc 16 Mar '21

16 Mar '21

testing with expunging messages with subject "delete me" this is the correct commend to list expunged messages? [@ testtest]# doveadm -o mail_location=mdbox_deleted:/home/popusers/testtest/mdbox:INDEX=/home/popindex/testtest/index mailbox status -u testtest 'messages vsize' '*' Sent messages=0 vsize=0 Drafts messages=0 vsize=0 INBOX/test2 messages=0 vsize=0 Junk messages=0 vsize=0 Trash messages=0 vsize=0 test3 messages=0 vsize=0 test1 messages=0 vsize=0 INBOX messages=0 vsize=0 We have a few messages with subject 'delete me' in the inbox namespace [@ ~]# doveadm search -u testtest mailbox test1 subject 'delete me' | wc -l 4 [@ ~]# doveadm search -u testtest mailbox INBOX/test2 subject 'delete me' | wc -l 2 [@ ~]# doveadm search -u testtest mailbox test3 subject 'delete me' | wc -l 8 Disk space used [@ testtest]# du -s -k /home/popusers/testtest/mdbox/storage/ 135356 /home/popusers/testtest/mdbox/storage/ Ok lets expunge some emails [@ testtest]# doveadm expunge -u testtest mailbox test1 subject 'delete me' doveadm(testtest): Info: expunge: box=test1, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test1, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test1, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test1, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> [@ testtest]# doveadm expunge -u testtest mailbox INBOX/test2 subject 'delete me' doveadm(testtest): Info: expunge: box=INBOX/test2, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=INBOX/test2, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> [@ testtest]# doveadm expunge -u testtest mailbox test3 subject 'delete me' doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> doveadm(testtest): Info: expunge: box=test3, msgid=<202011052050.0A5Ko7Jc005461(a)web01.xxxxxx.xxxx> Looks like the correct amount of messages are deleted [@ testtest]# du -s -k /home/popusers/testtest/mdbox/storage/ 135356 /home/popusers/testtest/mdbox/storage/ Lets check the expunged mail, again still everywhere 0 [@ testtest]# doveadm -o mail_location=mdbox_deleted:/home/popusers/testtest/mdbox:INDEX=/home/popindex/testtest/index mailbox status -u testtest 'messages vsize' '*' Sent messages=0 vsize=0 Drafts messages=0 vsize=0 INBOX/test2 messages=0 vsize=0 Junk messages=0 vsize=0 Trash messages=0 vsize=0 test3 messages=0 vsize=0 test1 messages=0 vsize=0 INBOX messages=0 vsize=0 This does not return any messages, so they were expunged. [@ testtest]# doveadm search -u testtest mailbox test3 subject 'delete me' How can I get the amount of messages expunged in the folders? I do not get it.

1 1

"younger" - filter on virtual INBOX
by Josef Haider 16 Mar '21

16 Mar '21

Hello, I think I have run into an issue which has been posted to this list in 2018 already: > Hello Rob, > > Do you by chance have a virtual/All folder which holds all your > messages? If so, could I see that configuration? > > Thanks. > Dave. > > > On 2/27/18, Rob Hoelz <rob+dovecot at hoelz.ro <https://dovecot.org/mailman/listinfo/dovecot>> wrote: > >/Hi list, />//>/I just encountered a problem while using dovecot's Virtual plugin with />/2.3.0. I managed to solve the issue, />/but I wanted to bring it to the attention of others on the list to > see if />/there exists a better solution, if />/I found a bug, or if it's just a matter of updating documentation. />//>/I have a virtual folder to get the most recent two weeks of mails; it > looks />/something like this: />//>>/INBOX />>/all younger 1209600 />//>/I made this folder back in October. Lately, I started to notice that the />/virtual folder had a surprising amount />/of mail in it - I don't get 1,000 e-mails per week! After some doveadm />/commands, I realized that e-mails from />/October were still present in my virtual folder! Updating the />/dovecot-virtual would clear away e-mails older than />/two weeks (I needed to actually introduce a change, even if it was just />/whitespace - just touching the file didn't />/update things), and removing the dovecot index file also cleared things />/away. In then end, I ended up just telling />/dovecot to disable on-disk indexes for that folder. />//>/I created this folder based on the examples on />/https://wiki.dovecot.org/Plugins/Virtual > <https://wiki.dovecot.org/Plugins/Virtual> - I'm wondering if I found > a bug />/or if that page should be changed to recommend disabling on-disk indexes />/when using certain search query filters such as />/"younger". If the latter, I can always make the change - just let me > know! />//>/-Rob /> Unfortunately, that thread died, so I'm trying my luck now... I am trying to have mail from several shared mailboxes show up in a user's INBOX if they are unread or younger than 24h, using the filter "or (unseen) (all younger 86400)". This works when forcing dovecot to regenerate index files, as mentioned above, by adding spaces to the virtual Inbox config file. Otherwise, mail older than 24h is not removed from the virtual INBOX. Any help would be greatly appreciated :) namespace configuration: namespace lists { list = children location = maildir:/var/mail/lists:CONTROL=~/Maildir/lists:INDEX=~/Maildir/lists prefix = lists. separator = . subscriptions = no type = public } namespace real { hidden = yes list = no location = prefix = RealMails. separator = . } namespace vimap { hidden = yes list = no location = virtual:/var/mail/virtual/vimap:INDEX=~/Maildir/vimap prefix = vimap. separator = . } /var/mail/virtual/vimap: !RealMails all lists.* or (unseen) (all younger 86400) dovecot version: # 2.3.4.1 (f79e8e7e4) # Pigeonhole version 0.5.4 () # OS: Linux 4.19.0-14-amd64 x86_64 Debian 10.8 -Joe

1 0

dovecot.map.index corrupted: Unexpectedly lost INBOX uid=1 map_uid=4726
by Marc 15 Mar '21

15 Mar '21

I had in my archive namespace[1] an INBOX folder and did not really get why it was there so I deleted it. Now this command generates map index error (doveadm force-resync does not fix it ;)) [@ ~]# doveadm -o namespace/4archives/location=mdbox_deleted:/home/mail-archive/testtest/mdbox/Archive -o mail_location=mdbox_deleted:/home/mail-archive/testtest/mdbox/Archive:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' 'INBOX' doveadm(testtest): Error: mdbox map /home/archiveindex/testtest/index/storage/dovecot.map.index corrupted: Unexpectedly lost INBOX uid=1 map_uid=4726 doveadm(testtest): Error: Mailbox INBOX: Failed to lookup mailbox status: mdbox map /home/archiveindex/testtest/index/storage/dovecot.map.index corrupted: Unexpectedly lost INBOX uid=1 map_uid=4726 [1] namespace 4archives { disabled = no hidden = no ignore_on_failure = no inbox = no list = yes location = mdbox:/home/mail-archive/%u/Archive/:CONTROL=/home/mail-archive/%u/Archive/control:INDEX=/home/archiveindex/%u/index mailbox Archive { auto = create autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Archive } mailbox "Archived mail" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Archive } mailbox "Archived messages" { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Archive } ... ... mailbox Archives { auto = no autoexpunge = 0 autoexpunge_max_mails = 0 comment = driver = special_use = \Archive } order = 0 prefix = Archive/ separator = / subscriptions = yes type = private }

1 1

how to reclaim disk space mdbox
by Marc 15 Mar '21

15 Mar '21

When I delete messages in the archive namespace they are copied to the deleted items folder in the inbox namespace. This is 34MB increase is visible however I expected the archive to go down by 34MB. Is diskspace reclaimed automatically or do you need to issue an command? [@ sbin]# du -s -k /home/popusers/testtest /home/mail-archive/testtest 135472 /home/popusers/testtest 358824 /home/mail-archive/testtest [@ sbin]# du -s -k /home/popusers/testtest /home/mail-archive/testtest 169368 /home/popusers/testtest 358824 /home/mail-archive/testtest PS. I have mdbox_rotate_size = 4 M

1 1

Doveadm-Purge dry run
by Marc 15 Mar '21

15 Mar '21

Maybe it is nice to introduce some option to Doveadm-Purge that does not delete anything just logs what it wanted to delete sort of like rsync's -n option.

1 0

archive namespace reports mdbox_deleted: same as mdbox: is that ok?
by Marc 15 Mar '21

15 Mar '21

These commands should generate different output not? [@ ~]# doveadm -o mail_location=mdbox_deleted:/home/mail-archive/testtest/mdbox:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' "Archive/2018" Archive/2018 messages=70 vsize=6182960 [@ ~]# doveadm -o mail_location=mdbox:/home/mail-archive/testtest/mdbox:INDEX=/home/archiveindex/testtest/index mailbox status -u testtest 'messages vsize' "Archive/2018" Archive/2018 messages=70 vsize=6182960

2 13

Virtual users @ virtual domains / better documentation?
by justina colmena ~biz 15 Mar '21

15 Mar '21

I have configured postfix so it will deliver mail to virtual mailboxes. For some reason, the mail is not delivered to the virtual mailboxes unless both $virtual_alias_domains and $virtual_alias_maps are left undefined: these directives are apparently for aliasing virtual users "@" virtual domains to "real" unix users on the local system. --%%== # ADDRESS REDIRECTION (VIRTUAL DOMAIN) # # The VIRTUAL_README document gives information about the many forms # of domain hosting that Postfix supports. virtual_mailbox_domains = domain1.example.org domain2.example.com virtual_transport = virtual #virtual_alias_domains = domain1.example.org domain2.example.com virtual_mailbox_base = /var/mail/vhosts virtual_mailbox_maps = hash:/etc/postfix/vmailbox virtual_minimum_uid = 100 virtual_uid_maps = static:5000 virtual_gid_maps = static:5000 #virtual_alias_maps = hash:/etc/postfix/virtual ==%-- If the $virtual_alias_maps directive invalidates virtual mailboxes, then "the usual" aliases (postmaster@, etc.) for the virtual domains would have to be listed in /etc/aliases along with the non-virtual aliases, but this does not work either, and generates a warning when "newaliases" is run. postalias: warning: /etc/aliases, line 99: name must be local So as far as I can tell, no aliasing at all is available for "virtual_mailbox_domains" in postfix I am still unsure how to authenticate the virtual users on postfix. PAM authentication works fine for non-virtual users. The following command gives two options for authentication: cyrus-sasl and dovecot-sasl. # postconf -a cyrus dovecot Postfix also works with cyrus-sasl if the passwords are set in "/etc/sasldb2" via the "saslpasswd2" command, but dovecot doesn't seem to work with cyrus-sasl, and has its own type of sasl authentication. I realize this is not a postfix list, so my real question here is, What do I need in order for dovecot to authenticate the virtual users and allow them to read their mail and obtain authorization to send mail via postfix on the same system?

3 2

understanding refcount=0, where is my deleted message?
by Marc 14 Mar '21

14 Mar '21

I have migrated beginning this year from mbox to mdbox, but I am still struggling with the concept of refcount=0 and where these message stay. This is my test mailbox (shell script uses 'doveadm mailbox status -u') [@ sbin]# mailbox-ls.sh testtest size listing mailboxes of testtest: Archive msgs=0 vsize=0B Archive/2011 msgs=0 vsize=0B Archive/2012 msgs=0 vsize=0B Archive/2013 msgs=0 vsize=0B Archive/2014 msgs=0 vsize=0B Archive/2015 msgs=0 vsize=0B Archive/2016 msgs=0 vsize=0B Archive/2017 msgs=0 vsize=0B Archive/2018 msgs=0 vsize=0B Archive/2019 msgs=3435 vsize=277MiB Archive/Archive msgs=1 vsize=2.4KiB Deleted Messages msgs=0 vsize=0B Drafts msgs=4 vsize=1.1KiB INBOX msgs=1329 vsize=211MiB INBOX/test2 msgs=3 vsize=187KiB Junk msgs=2 vsize=2.0KiB Sent msgs=20 vsize=13KiB Trash msgs=47 vsize=752KiB [@ sbin]# doveadm -o mail_location=mdbox_deleted:/home/popusers/testtest/mdbox:INDEX=/home/popindex/testtest/index mailbox status -u testtest 'messages vsize' '*' Sent messages=0 vsize=0 Drafts messages=0 vsize=0 INBOX/test2 messages=0 vsize=0 Junk messages=0 vsize=0 Deleted Messages messages=0 vsize=0 Trash messages=0 vsize=0 INBOX messages=0 vsize=0 Now I am deleting 1 message from inbox with thunderbird, and I am getting this expected result, 1 message less in inbox, 1 message more in Deleted messages. [root@mail04 sbin]# mailbox-ls.sh testtest size listing mailboxes of testtest: Archive msgs=0 vsize=0B Archive/2011 msgs=0 vsize=0B Archive/2012 msgs=0 vsize=0B Archive/2013 msgs=0 vsize=0B Archive/2014 msgs=0 vsize=0B Archive/2015 msgs=0 vsize=0B Archive/2016 msgs=0 vsize=0B Archive/2017 msgs=0 vsize=0B Archive/2018 msgs=0 vsize=0B Archive/2019 msgs=3435 vsize=277MiB Archive/Archive msgs=1 vsize=2.4KiB Deleted Messages msgs=1 vsize=433B Drafts msgs=4 vsize=1.1KiB INBOX msgs=1328 vsize=211MiB INBOX/test2 msgs=3 vsize=187KiB Junk msgs=2 vsize=2.0KiB Sent msgs=20 vsize=13KiB Trash msgs=47 vsize=752KiB [@ sbin]# doveadm -o mail_location=mdbox_deleted:/home/popusers/testtest/mdbox:INDEX=/home/popindex/testtest/index mailbox status -u testtest 'messages vsize' '*' Sent messages=0 vsize=0 Drafts messages=0 vsize=0 INBOX/test2 messages=0 vsize=0 Junk messages=0 vsize=0 Deleted Messages messages=0 vsize=0 Trash messages=0 vsize=0 INBOX messages=0 vsize=0 Now I right click trash in thunderbird and choose empty trash, and I am getting this expected result, Deleted messages is empty. (Notice Trash stays at the same message count) [@ sbin]# mailbox-ls.sh testtest size listing mailboxes of testtest: Archive msgs=0 vsize=0B Archive/2011 msgs=0 vsize=0B Archive/2012 msgs=0 vsize=0B Archive/2013 msgs=0 vsize=0B Archive/2014 msgs=0 vsize=0B Archive/2015 msgs=0 vsize=0B Archive/2016 msgs=0 vsize=0B Archive/2017 msgs=0 vsize=0B Archive/2018 msgs=0 vsize=0B Archive/2019 msgs=3435 vsize=277MiB Archive/Archive msgs=1 vsize=2.4KiB Deleted Messages msgs=0 vsize=0B Drafts msgs=4 vsize=1.1KiB INBOX msgs=1328 vsize=211MiB INBOX/test2 msgs=3 vsize=187KiB Junk msgs=2 vsize=2.0KiB Sent msgs=20 vsize=13KiB Trash msgs=47 vsize=752KiB So this message should have refcount=0. But where is it, this still shows 0 messages everywhere? [@ sbin]# doveadm -o mail_location=mdbox_deleted:/home/popusers/testtest/mdbox:INDEX=/home/popindex/testtest/index mailbox status -u testtest 'messages vsize' '*' Sent messages=0 vsize=0 Drafts messages=0 vsize=0 INBOX/test2 messages=0 vsize=0 Junk messages=0 vsize=0 Deleted Messages messages=0 vsize=0 Trash messages=0 vsize=0 INBOX messages=0 vsize=0

1 0

Panic: file mdbox-map.c: line 1494 (mdbox_map_get_uid_validity): assertion failed: (map->view != NULL)
by Marc 12 Mar '21

12 Mar '21

Does this mean I have some problems with filesystem uid's? Currently I have only u=rwx, go is nothing. dovecot-2.2.36-6.el7_8.1.x86_64

3 8

auto scaling dovecot server on AWS
by girivasan.rajasekaran＠minfytech.com 10 Mar '21

10 Mar '21

Hello There - I'm trying to setup dovecot server on AWS and would like to understand the approach on the email server sizing? The emails are expected to surge at times seasonally. How do I plan the email server sizing to handle such load? Does this support auto-scaling? Probably I'm missing the basics. Appreciate your help in giving some clarity.

1 0

invalid vsize-hdr
by Christopher Wensink 10 Mar '21

10 Mar '21

Good afternoon everyone, I have one account on our internal dovecot server that keeps throwing the same repeated error: The user is on a Windows 10 computer running the latest version of Thunderbird. Here's the log: -------------------------------------------------------------------------------------------------------------------- Mar 9 13:03:16 mario2 dovecot: imap(pstrangfeld): Error: vsize-hdr has invalid size: 36 Mar 9 13:09:53 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:18:57 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:25:09 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:29:07 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:31:03 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:37:20 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:42:26 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:47:21 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:50:11 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:53:46 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 13:59:40 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:03:52 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:08:54 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:11:53 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:17:02 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:21:14 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:24:00 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:28:43 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:33:00 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:38:24 mario2 dovecot: imap(user): Connection closed (IDLE running for 0.001 + waiting input for 0.001 secs, 2 B in + 10+10 B out, state=wait-input) in=1578244 out=2878370 Mar 9 14:40:51 mario2 dovecot: imap-login: Login: user=<user>, method=PLAIN, rip=10.5.1.77, lip=10.5.1.17, mpid=97537, TLS, session=<AvLvkCC9w9kKBQFN> Mar 9 14:41:30 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 Mar 9 14:44:14 mario2 dovecot: imap(user): Connection closed (IDLE running for 0.002 + waiting input for 0.001 secs, 2 B in + 10+10 B out, state=wait-input) in=319541 out=1272761 Mar 9 14:44:14 mario2 dovecot: imap-login: Login: user=<user>, method=PLAIN, rip=10.5.1.77, lip=10.5.1.17, mpid=97671, TLS, session=<85YInSC95NkKBQFN> Mar 9 14:46:37 mario2 dovecot: imap(user): Error: vsize-hdr has invalid size: 36 --------------------------------------------------------------- I have tried the following: -Restarting the workstation - Compacting folders in Thunderbird - Repaired the Inbox Folder in Thunderbird - Restarting the dovecot service - Set the connections in Thunderbird Account settings to not check for messages automatically (manual only) - Set the user to own all folders and sub-folders in his home directory on the server I found old message in the archives from 2017 that had the same error but I did not see a posted solution. dovecot --version 2.2.36 (lfl0bfa63) config file: [root@mario2 dovecot]# cat dovecot.conf ## Dovecot configuration file # If you're in a hurry, see http://wiki2.dovecot.org/QuickConfiguration # "doveconf -n" command gives a clean output of the changed settings. Use it # instead of copy&pasting files when posting to the Dovecot mailing list. # '#' character and everything after it is treated as comments. Extra spaces # and tabs are ignored. If you want to use either of these explicitly, put the # value inside quotes, eg.: key = "# char and trailing whitespace " # Most (but not all) settings can be overridden by different protocols and/or # source/destination IPs by placing the settings inside sections, for example: # protocol imap { }, local 127.0.0.1 { }, remote 10.0.0.0/8 { } # Default values are shown for each setting, it's not required to uncomment # those. These are exceptions to this though: No sections (e.g. namespace {}) # or plugin settings are added by default, they're listed only as examples. # Paths are also just examples with the real defaults being based on configure # options. The paths listed here are for configure --prefix=/usr # --sysconfdir=/etc --localstatedir=/var # Protocols we want to be serving. #protocols = imap pop3 lmtp protocols = imap pop3 # A comma separated list of IPs or hosts where to listen in for connections. # "*" listens in all IPv4 interfaces, "::" listens in all IPv6 interfaces. # If you want to specify non-default ports or anything more complex, # edit conf.d/master.conf. #listen = *, :: listen = *, :: # Base directory where to store runtime data. #base_dir = /var/run/dovecot/ # Name of this instance. In multi-instance setup doveadm and other commands # can use -i <instance_name> to select which instance is used (an alternative # to -c <config_path>). The instance name is also added to Dovecot processes # in ps output. #instance_name = dovecot # Greeting message for clients. #login_greeting = Dovecot ready. # Space separated list of trusted network ranges. Connections from these # IPs are allowed to override their IP addresses and ports (for logging and # for authentication checks). disable_plaintext_auth is also ignored for # these networks. Typically you'd specify your IMAP proxy servers here. #login_trusted_networks = login_trusted_networks = 10.5.1.0/24 # Space separated list of login access check sockets (e.g. tcpwrap) #login_access_sockets = # With proxy_maybe=yes if proxy destination matches any of these IPs, don't do # proxying. This isn't necessary normally, but may be useful if the destination # IP is e.g. a load balancer's IP. #auth_proxy_self = # Show more verbose process titles (in ps). Currently shows user name and # IP address. Useful for seeing who are actually using the IMAP processes # (eg. shared mailboxes or if same uid is used for multiple accounts). #verbose_proctitle = no # Should all processes be killed when Dovecot master process shuts down. # Setting this to "no" means that Dovecot can be upgraded without # forcing existing client connections to close (although that could also be # a problem if the upgrade is e.g. because of a security fix). #shutdown_clients = yes # If non-zero, run mail commands via this many connections to doveadm server, # instead of running them directly in the same process. #doveadm_worker_count = 0 # UNIX socket or host:port used for connecting to doveadm server #doveadm_socket_path = doveadm-server # Space separated list of environment variables that are preserved on Dovecot # startup and passed down to all of its child processes. You can also give # key=value pairs to always set specific settings. #import_environment = TZ ## ## Dictionary server settings ## # Dictionary can be used to store key=value lists. This is used by several # plugins. The dictionary can be accessed either directly or though a # dictionary server. The following dict block maps dictionary names to URIs # when the server is used. These can then be referenced using URIs in format # "proxy::<name>". dict { #quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext #expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext } # Most of the actual configuration gets included below. The filenames are # first sorted by their ASCII value and parsed in that order. The 00-prefixes # in filenames are intended to make it easier to understand the ordering. !include conf.d/*.conf # A config file can also tried to be included without giving an error if # it's not found: !include_try local.conf ----------- I need assistance. I appreciate the help. Chris -- Christopher Wensink IS Administrator Five Star Plastics, Inc 1339 Continental Drive Eau Claire, WI 54701 Office: 715-831-1682 Mobile: 715-563-3112 Fax: 715-831-6075 cwensink(a)five-star-plastics.com www.five-star-plastics.com

6 6

DMARC problems with some emails from the list
by Ángel L. Mateo 09 Mar '21

09 Mar '21

Hello, I'm having problems with some emails from the list, been classified as SPAM in my system because of DMARC failures. I'm not sure but this may be a problem with the list configuration. I attach the log for the failures in the last week. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

3 8

Dovecot v2.3.14 released
by Aki Tuomi 09 Mar '21

09 Mar '21

Hi! We are pleased to release v2.3.14 of Dovecot. IMPORTANT NOTE: We have removed some components from the software, please review changelogs carefully prior upgrading. Please find source tarballs at https://dovecot.org/releases/2.3/dovecot-2.3.14.tar.gz https://dovecot.org/releases/2.3/dovecot-2.3.14.tar.gz.sig Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * Added new aliases for some variables. Usage of the old ones is possible, but discouraged. (These were partially added already to v2.3.13.) See https://doc.dovecot.org/configuration_manual/config_file/config_variables/ for more information. * Optimize imap/pop3/submission/managesieve proxies to use less CPU at the cost of extra memory usage. * Remove autocreate, expire, snarf and mail-filter plugins. * Remove cydir storage driver. * Remove XZ/LZMA write support. Read support will be removed in future release. * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP environment variable is not set. Timestamp format is taken from log_timestamp setting. * If BROKENCHAR or listescape plugin is used, the escaped folder names may be slightly different from before in some situations. This is unlikely to cause issues, although caching clients may redownload the folders. * imapc: It now enables BROKENCHAR=~ by default to escape remote folder names if necessary. This also means that if there are any '~' characters in the remote folder names, they will be visible as "~7e". * imapc: When using local index files folder names were escaped on filesystem a bit differently. This affects only if there are folder names that actually require escaping, which isn't so common. The old style folders will be automatically deleted from filesystem. * stats: Update exported metrics to be compliant with OpenMetrics standard. + doveadm: Add an optional '-p' parameter to metadata list command. If enabled, "/private", and "/shared" metadata prefixes will be prepended to the keys in the list output. + doveconf: Support environment variables in config files. See https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax… for more details. + indexer-worker: Change indexer to disconnect from indexer-worker after each request. This allows service indexer-worker's service_count & idle_kill settings to work. These can be used to restart indexer-worker processes once in a while to reduce their memory usage. - auth: "nodelay" with various authentication mechanisms such as apop and digest-md5 crashed AUTH process if authentication failed. - auth: Auth lua script generating an error triggered an assertion failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify): assertion failed: (lua_gettop(script->L) == 0). - configure: Fix libunwind detection to work on other than x86_64 systems. - doveadm-server: Process could crash if logging was done outside command handling. For example http-client could have done debug logging afterwards, resulting in either segfault or Panic: file http-client.c: line 642 (http_client_context_close): assertion failed: (cctx->clients_list == NULL). - dsync: Folder name escaping with BROKENCHAR didn't work completely correctly. This especially caused problems with dsync-migrations using imapc where some of the remote folder names may not have been accessible. - dsync: doveadm sync + imapc doesn't always sync all mails when doing an incremental sync (-1), which could lead to mail loss when it's used for migration. This happens only when GUIDs aren't used (i.e. imapc without imapc_features=guid-forced). - fts-tika: When tika server returns error, some mails cause Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts): assertion failed: (ctx->nested_parts_count == 0 || i_stream_have_bytes_left(ctx->input)) - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have resulted in crashes. This exposed that Dovecot was wrongly accepting atoms in "nstring" handling. Changed the IMAP parsing to be more strict about this now. - lib-index: If dovecot.index.cache has corrupted message size, fetching BODY/BODYSTRUCTURE may cause assert-crash: Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish): assertion failed: (mail->data.parts != NULL). - lib-index: Minor error handling and race condition fixes related to rotating dovecot.index.log. These didn't usually cause problems, unless the log files were rotated rapidly. - lib-lua: Lua scripts using coroutines or lua libraries using coroutines (e.g., cqueues) panicked. - Message PREVIEW handled whitespace wrong so first space would get eaten from between words. - FTS and message PREVIEW (snippet) parsed HTML &entities case-sensitively. - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE was written in a way that may have caused confusion for IMAP clients and also Dovecot itself when parsing it. The truncated part is now written out using application/octet-stream MIME type. - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed: (meth->context_size <= MAC_MAX_CONTEXT_SIZE). - event filters: NOT keyword did not have the correct associativity. NOT a AND b were getting parsed as NOT (a AND b) instead of (NOT a) AND b. - Ignore ECONNRESET when closing socket. This avoids logging useless errors on systems like FreeBSD. - event filters: event filter syntax error may lead to Panic: file event-filter.c: line 137 (event_filter_parse): assertion failed: (state.output == NULL) - lib: timeval_cmp_margin() was broken on 32-bit systems. This could potentially have caused HTTP timeouts to be handled incorrectly. - log: instance_name wasn't used as syslog ident by the log process. - master: After a service reached process_limit and client_limit, it could have taken up to 1 second to realize that more client connections became available. During this time client connections could have been unnecessarily rejected and a warning logged: Warning: service(...): process_limit (...) reached, client connections are being dropped - stats: Crash would occur when generating openmetrics data for metrics using aggregating functions. - stats: Event filters comparing against empty strings crash the stats process.

5 5

start dovecot multiple instances
by Gonzalo Palacios Goicolea 08 Mar '21

08 Mar '21

Hi All, I'm trying to run dovecot with dovecot-director on the same server, using two different instances, but I'n not able to make the two instances start with systemctl (we are using RHEL7) May be I shueld create a /etc/systemd/system/dovecot.service.d/service.conf file and add there any command? Thanks and best regards -- *Gonzalo Palacios Goicolea* U.T de Infraestructura de Equipos Centrales /Tecnologías de la Información/ Universidad Autónoma de Madrid • Campus de Cantoblanco

2 1

director implementation
by Gonzalo Palacios Goicolea 08 Mar '21

08 Mar '21

Hi All, We're going to put into production dovecot-director. As I wrote in a previous message, we have a lot of errors like these: Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=228: Missing middle file seq=5 (between 5..4294967295, we have seqs 4): Log is locked - newer log can't exist (initial_mapped=1, reason=Index mapped) Feb 28 08:50:42 server5 dovecot: imap(user@domain): Warning: fscking index file path/Maildir/dovecot.index Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Failed to map transaction log path/Maildir/dovecot.index.log at sync_offset=10328 after locking: pread() failed: Stale file handle Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=228: Missing middle file seq=5 (between 5..4294967295, we have seqs 4): Requested newer log than exists - still after NFS flush: Log inode is unchanged (initial_mapped=1, reason=Index mapped) Feb 28 08:50:45 server5 dovecot: imap(user@domain): Error: Failed to map transaction log path/Maildir/dovecot.index.log at sync_offset=10328 after locking: pread() failed: Stale file handle Feb 28 08:50:45 server5 dovecot: imap(user@domain): Error: Failed to map view for path/Maildir/dovecot.index: Missing middle file seq=5 (between 5..5, we have seqs 4): Requested newer log than exists - still after NFS flush: Log inode is unchanged My doubt is if it's recommended to delete all dovecot.index* files before passing the traffic through de director servers or it's not required. Any information on this way will be appreciated. We've dovecot-2.2.36-8.el7.x86_64 over RHEL7 Thanks and best regards -- *Gonzalo Palacios Goicolea* U.T de Infraestructura de Equipos Centrales /Tecnologías de la Información/ Universidad Autónoma de Madrid • Campus de Cantoblanco <3D"http://www.uam.es/"> Antes de imprimir este correo piense si es necesario.Cuidemos el medioambiente.

2 1

not getting internal errors logged
by Arkadiusz Miśkiewicz 08 Mar '21

08 Mar '21

Hello. dovecot 2.3.13, 2.3.14 web imap client when doing search is getting error induced by me by deleting lucene-indexes folder: UID SEARCH: Internal error occurred. Refer to server log for more information. [2021-03-08 15:08:01] (0.002 + 0.000 + 0.001 secs). but I'm not getting that internal error logged in syslog. Other information like from lmtp, imap logging in, out etc is logged just fine. In my configs log_path info_log_path debug_log_path are not set, so dovecot default syslog is used. Tested log_path = /tmp/file.txt, too but the effect was the same (regular logs logged there, internal errors not logged) stracing dovecot process I see error message only write()n once (to client) but nowhere else (in a strace visible way). Is anything else controlling internal errors logging? Can't find anything in docs. -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

Mailbox configuration questions
by justina colmena ~biz 08 Mar '21

08 Mar '21

I am having subtle problems with IMAP mailbox configuration on certain clients such as KMail and Thunderbird, whereas the previous setup was working on K9Mail (mobile) and Trojitá (desktop). I was using Maildir folders, which were mostly working before, but for some reason I had to create explicitly named namespaces for the flatfile (mbox) Inbox and the Maildir "Home" folders. I also specified an INDEX directory for the inboxes, which I made world-writable and sticky, because of permission problems creating subdirectories in it. KMail always seems to put sent mail into a local "sent-mail" folder, rather than the IMAP Sent folder associated with the sending account. (KMail and Thunderbird have a more POP-oriented architecture for the desktop, whereas Trojitá is exclusively IMAP.) Is there an easier better way to organize some of this stuff? Or how is it "usually" done?

3 2

Re: Re: v2.3.11.3 solr plugin search via MUA fails to match accented ascii characters; cmd line exec of `doveadm fts lookup` PANICs (assertion failed)
by Roland Martinez 05 Mar '21

05 Mar '21

1 0

Where can I contact with this list administrator?
by Ángel L. Mateo 05 Mar '21

05 Mar '21

Hi, I'm having problems with some emails receive from this list. Problems related with DMARC. How can I contact with this list administrator to try to fix it? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información y las Comunicaciones Aplicadas (ATICA) http://www.um.es/atica Tfo: 868889150 Fax: 868888337

3 2

last login plugins
by Henry 05 Mar '21

05 Mar '21

Anyone kwon the last-login plugins can using Authentication variables such as %m mechanism, %a local_port . we want to record this in DB, thanks

3 21

About TLS variables
by Henry 04 Mar '21

04 Mar '21

Hello, I found the Variable %c only has TLS, Can it be using "TLSv1, TLSv1.1, TLSv1.2, TLSv1.3" instead of only TLS like as dovecot logging, this is really a most meaningful , thanks Variable %cLong name securedDescription “TLS” with established SSL/TLS connections, “TLS handshaking”, or “TLS [handshaking]: error text” if disconnecting due to TLS error. “secured” with localhost connections. Otherwise empty.

2 2

Re: Bug in renaming folder hierarchies - any reaction ?
by Klaus Steinberger 04 Mar '21

04 Mar '21

Hi, no comments on this? This is definitly with two different IMAP Clients reproducible. This led already to some message loss in user Mailboxes. > we discovered a major problem with renaming folders with subfolders > > testszenario: > > folders: > > test1 > test1/test1-1 > test1/test1-2 > > all 3 folders contain a test message > > after renaming the top level folder test1 to test2 following folders exist: > > test2 > test2/test1-1 > test2/test1-2 > > the subfolders test1-1 and test1-2 are empty, the top level folder contains the > correct message. > > > Now renmaing test2 back to test1: > > Alle folders again contain their messages. > > So this looks like during renaming the top level folder just the message > references for the subfolders got lost, and with renaming back they are there again. > > I can reproduce this behavior both with thunderbird and Horde Webmail as a > client, also it happens with a second different dovecot setup > Sincerly, Klaus Steinberger

2 7

Pigeonhole v0.5.14 released
by Aki Tuomi 04 Mar '21

04 Mar '21

Hi! We are pleased to release v0.5.14 of Pigeonhole. Please find source tarballs at https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.14.t… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.14.t… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Aki Tuomi Open-Xchange oy --- * IMAP FILTER command: cmd-filter-sieve - Do not allow NIL as script name argument.

1 0

Why Last-login?
by ＠lbutlr 04 Mar '21

04 Mar '21

I've noticed several threads over the last year or so about last-login, and I was curious WHY people care about tracking this in the database. I can see wanting to know if a user has logged in recently, but this seems quite easy to tell by simply looking at the time stamp and/or contents of the mail spool for the user. For example, on my system I can look at the timestamps on the 'new' folders in the user's maildir to see if they are getting mail, and if the folders are empty, I have a time stamp of when they last checked that mailbox, giving me a pretty accurate time for when they last logged in. For example, looking at one user: # ls -lsdtr /path/to/user/maildir/{new,.**/new} I can see that the most recent "new" mailboxes were accessed on 02 Mar 14:25 and 03 Mar 01:45, and I can see that the latter mailbox has files in it and the former mailbox does not (just by the size, without doing an extra ls of those directories), so I know that the last time the user logged in was about 14:25 or later yesterday and that they definitely have not logged in in the last 3h05, which seems close enough to me. Am I missing some reason I would need/want to keep track of that specific login time separately? -- 'But you ain't part of it, are you?' said Granny conversationally. 'You try, but you always find yourself watchin' yourself watchin' people, eh? Never quite believin' anything? Thinkin' the wrong thoughts?'

7 12

Git / Compilation error
by Joan Moreau 04 Mar '21

04 Mar '21

Hello, With latest git, I get the following error : configure.ac:761: the top level configure.ac:22: error: possibly undefined macro: AC_DEFINE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:205: error: possibly undefined macro: AC_MSG_ERROR configure.ac:247: error: possibly undefined macro: AS_IF configure.ac:303: error: possibly undefined macro: AM_ICONV configure.ac:434: error: possibly undefined macro: AC_CHECK_HEADER configure:28073: error: possibly undefined macro: AC_CHECK_FUNC Something I am missing? Thank you

2 7

t/s expired cert error
by Voytek Eymont 04 Mar '21

04 Mar '21

since a couple of days one of users reported getting expired certificate error in TB, looking at the log, I can see like: Mar 02 21:46:24 pop3-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=111.222.333.444, lip=103.106.168.105, TLS: SSL_read failed: error:14094415:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate expired: SSL alert number 45, session=<...> but, looking at server with https://ssl-tools.net/mailservers/emu.sbt.net.au it says 'valid' as does certbot tool what am I missing ? Expiry Date: 2021-04-27 12:11:32+00:00 (VALID: 55 days) Certificate Path: /etc/letsencrypt/live/emu.sbt.net.au/fullchain.pem Private Key Path: /etc/letsencrypt/live/emu.sbt.net.au/privkey.pem # grep ssl_ dovecot.conf ssl_cert = </etc/letsencrypt/live/emu.sbt.net.au/fullchain.pem ssl_key = </etc/letsencrypt/live/emu.sbt.net.au/privkey.pem ssl_dh=</etc/dovecot/dh.pem

7 9

LDA File Permissions
by David Morsberger 03 Mar '21

03 Mar '21

All, I am looking for an easy way to setup LDA so that it creates files with group read permission. Currently LDA/Sieve create the '.dovecot.lda-dupes’ file with ‘0600’. My backup process needs to be able to read the file because it runs as a user that is in the same group as the LDA process. I looked into the source code and the file is opened with mode ‘0666’ as " fd = open(lock_info->lock_path, O_RDWR | O_EXCL | O_CREAT, 0666); This implies it is a umask issue. What is the best way to view and set the umask value for the LDA process on Ubuntu 20.04? Thanks, David

1 0

Can Dovecot honor Outlook's "leave mail on server for X days" setting?
by Steve Dondley 03 Mar '21

03 Mar '21

I googled around for a quite bit but surprisingly came up empty for an answer to this question which I'm sure has been broached before. I've got a linux box running dovecot/postfix using maildir format. I was surprised to learn that a client that had many GBs of email was running POP3, not IMAP. It turns out they had a setting to delete POP3 mail after X days turned on but it just went ignored. I know this is not how POP3 is supposed to work, but is there a way to get dovecot to honor the user's settings in Outlook? Or should I just tell the client to turn this off and use a proper IMAP account?

3 2

Skipped because not active
by 刘莹莹 03 Mar '21

03 Mar '21

config: mail_attribute_dict = file:%h/dovecot-attributes mailbox_list_index=yes plugin { push_notification_driver = dlog push_notification_driver = ox:url=http://127.0.0.1:80/notify-example.php } protocol imap { mail_plugins = autocreate notify push_notification imap_metadata = yes } protocol lda { mail_plugins = autocreate notify push_notification log_path = /var/log/lda.log } Error: Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set)

2 1

Can master users retain private \Seen flags ?
by tuuialou 02 Mar '21

02 Mar '21

Hello, I am trying to setup a shared mailbox for a small team. Let's say Alice and Bob both need to read and answer sales(a)example.com. I would like Alice and Bob to retain private \Seen flags on sales(a)example.com. I know I can achieve that with INDEXPVT on shared or public mailboxes but I am not 100% happy with this solution because: - Thunderbird displays sales(a)example.com/Inbox and sales(a)example.com/Sent as "subscribed folders" within alice(a)example.com and bob(a)example.com. So Alice and Bob can't use the unified view of Thunderbird. - I need create a special identity in Alice and Bob Thunderbird's configuration so the sender is sales(a)example.com when Alice or Bob sends an email from sales(a)example.com (and not alice(a)example.com or bob(a)example.com) But I am not sure another email client is able to do that (on a mobile phone for example). - I need to add ACL rights if a new folder is created under sales(a)example.com. So I am now looking at the "master users" feature of Dovecot to replicate this MS Exchange setup https://www.en.its.aau.dk/instructions/Mail/shared-mailbox-thunderbird/ (alice(a)example.com and bob(a)example.com log is as sales(a)example.com) I achieved that but I don't know how to retain private \Seen flags so that Bob doesn't see an email as read even if Alice has marked it as read before. Is it possible to retain private \Seen flags with master users? If yes, how can I achieve that? Thank you for any help! PS: I posted the same question on https://forum.iredmail.org/post77816.html and https://forum.iredmail.org/topic13549-proposal-for-a-exchange-like-shared-m… but I couldn't get help and was advised to ask here.

2 6

migrating users to new server, dsync ?
by Voytek Eymont 02 Mar '21

02 Mar '21

I have Dovecot 2.3.13 on new server, 2.3.11 on 'old' server, Centos 6, old server still has a couple domains and about a dozen users, what's a the best way to migrate user mailboxes to new server (Maildir), use 'dsync' , is that the way to do it ? TIA, V

2 1

Failed to map transaction log path - Stale file handle
by Gonzalo Palacios Goicolea 02 Mar '21

02 Mar '21

Hi All, We recently moved from RHEL6 to RHEL7 and updated dovecot from dovecot-2.2.10-1_14.el6.x86_64 to dovecot-2.2.36-8.el7.x86_64. We use NFS for storing the mail, and 5 servers running at the same time. Before updating dovecot we stopped the service and deleted all dovecot.index* files Now we're experiencing some problems. For example, when deleting an email it is note deleted and appears again duplicated. These are the logs: Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=228: Missing middle file seq=5 (between 5..4294967295, we have seqs 4): Log is locked - newer log can't exist (initial_mapped=1, reason=Index mapped) Feb 28 08:50:42 server5 dovecot: imap(user@domain): Warning: fscking index file path/Maildir/dovecot.index Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Failed to map transaction log path/Maildir/dovecot.index.log at sync_offset=10328 after locking: pread() failed: Stale file handle Feb 28 08:50:42 server5 dovecot: imap(user@domain): Error: Index path/Maildir/dovecot.index: Lost log for seq=5 offset=228: Missing middle file seq=5 (between 5..4294967295, we have seqs 4): Requested newer log than exists - still after NFS flush: Log inode is unchanged (initial_mapped=1, reason=Index mapped) Feb 28 08:50:45 server5 dovecot: imap(user@domain): Error: Failed to map transaction log path/Maildir/dovecot.index.log at sync_offset=10328 after locking: pread() failed: Stale file handle Feb 28 08:50:45 server5 dovecot: imap(user@domain): Error: Failed to map view for path/Maildir/dovecot.index: Missing middle file seq=5 (between 5..5, we have seqs 4): Requested newer log than exists - still after NFS flush: Log inode is unchanged Usually restarting the email client solves the problem for a while. We've tried deleting the indexes but it happens again some time later. This is dovecot config: dovecot -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-1160.6.1.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.9 (Maipo) # Hostname: server auth_cache_negative_ttl = 5 mins auth_cache_size = 500 M auth_cache_ttl = 5 mins auth_failure_delay = 5 secs default_vsz_limit = 1 G disable_plaintext_auth = no hostname = server imap_logout_format = in(bytes read)=%i out(bytes sent)=%o listen = * lock_method = dotlock mail_fsync = always mail_location = maildir:%h/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = " quota mail_log notify" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapflags notify mbox_write_locks = fcntl mmap_disable = yes namespace { location = maildir:%h/Maildir/_backup prefix = _backup. separator = . type = private } namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { mail_log_events = delete undelete expunge mailbox_delete mailbox_rename mailbox_create save mail_log_fields = uid box msgid from subject quota = maildir:_backup:ns= quota_exceeded_message = El espacio asignado para el almacenamiento del correo del destinatario ha superado su capacidad total. Por ello, el correo que usted intenta enviar no se puede entregar al destinatario. quota_warning = storage=70%% quota-warning 70 %u quota_warning1 = storage=90%% quota-warning 90 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=99%% quota-warning 99 %u sieve = ~/.dovecot.sieve sieve_dir = ~/Maildir/sieve sieve_extensions = +notify +imapflags } postmaster_address = postmaster@domain protocols = imap pop3 sieve service auth { unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } process_min_avail = 20 } service imap { process_limit = 2048 } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } process_min_avail = 20 } service pop3-login { inet_listener pop3 { port = 110 } process_min_avail = 20 } service pop3 { process_limit = 2048 } service quota-warning { executable = script /etc/dovecot/scripts_notification_quota/quota-warning.sh unix_listener quota-warning { user = vmail } user = vmail } ssl = no ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_key = # hidden, use -P to show it submission_host = smtp.domain:25 syslog_facility = local1 userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lda { mail_plugins = " quota mail_log notify sieve" } protocol imap { mail_max_userip_connections = 10000 mail_plugins = " quota mail_log notify imap_quota" } protocol pop3 { mail_max_userip_connections = 10 } Can you please help me? Thanks in advance and best regards -- *Gonzalo Palacios Goicolea* U.T de Infraestructura de Equipos Centrales /Tecnologías de la Información/ Universidad Autónoma de Madrid • Campus de Cantoblanco <3D"http://www.uam.es/"> Antes de imprimir este correo piense si es necesario.Cuidemos el medioambiente.

2 5

Issue with masterauth
by Samuel Mutel 02 Mar '21

02 Mar '21

Hello, I would like to setup masterauth account to be able to connect to imap to log in as other users without password. My users are currently setup in LDAP and it is working correctly. I follow the page https://doc.dovecot.org/configuration_manual/authentication/master_users/ to setup this but I think I forgot something. When I try to login with telnet: Master user logging in as toto => it seems that i can connect with master user ldap(toto,127.0.0.1,<quR66Hm8KgB/AAAB>): invalid credentials => however ldap is request for password check, why ? Normmally the goal of master user is to not specify the password of the final user... Thanks.

2 1

Search is uninterruptable
by van der Kamp, John 01 Mar '21

01 Mar '21

Hi, When a user is doing a search, and the data is not indexed, then a search can take a very long time. It seems that search process is uninterruptable. The IMAP connection gets a status message with an ETA every so often, but an administrator on the server cannot stop it. Any SIGTERM or doveadm kick is ignored. Also, when the client times out (it seems clients are not seeing the ETA as a reason to keep the connection open) and the client disconnects is this search process continuing, even though any write to the socket would return an error. I believe the server is stuck in this loop: https://github.com/dovecot/core/blob/master/src/lib-storage/index/index-sea… Somehow the server needs to check for disconnected clients and let the session be kicked from the server too. You probably know better what to do about this then me. John Amazon Development Center (Netherlands) B.V., Johanna Westerdijkplein 1, 2521 EN The Hague, Registration No. Chamber of Commerce 56869649, VAT: NL 852339859B01

3 2

dsync and sieve again
by Edgaras Lukoševičius 01 Mar '21

01 Mar '21

Hi, I'm starting to wonder if dsync is supposed to sync sieve scripts at all? Or should it work only as a part of replicator? Because I was not able to get it working on multiple Dovecot and Pigeon versions, and I see lots of replication/dsync and sieve related questions in the mailing list. I'm trying to get it to work using latest versions on http://repo.dovecot.org/ce-2.3-latest repo. The versions I am testing at the moment are: - Dovecot 2.3.13 (89f716dc2) - Pigeonhole 0.5.13 (cdd19fe3) It's a straightforward setup, nothing fancy. So the question is - is it supposed to work at all without replicator?

2 3

sieve_after seems to not bring any effect to life in dovecot 2.3.13 dovecot-pigeonhole-0.5.13
by Bug Report 26 Feb '21

26 Feb '21

dovecot 2.3.13 (89f716dc2) dovecot-pigeonhole-0.5.13 OS: FreeBSD amd64 12.2-RELEASE After following code ------ require ["copy"]; # rule:[redirect] if true { redirect :copy "mail(a)mail.com"; keep; } ------ (both with keep and without keep) is executed sieve_after seems to not execute at all. Same code together with sieve_after was working as supposed in earlier versions.

3 7

doveadm user '*' vs sssd: enumeration works only once
by Heiko Schlittermann 25 Feb '21

25 Feb '21

Hi, I've a quite simple setup using sssd (id_provider, auth_provider: AD), and dovecot. doveadm user * returns the full user list only once. A 2nd invocation of the same command within a small timeframe returns a subset of the local users only (the users I've in /etc/passwd with uid >= first_valid_uid). If I wait until the dovecot/auth worker processes are gone (or if I kill them), I get the full list again. Calling getent passwd repeateadly always returns the full list of users. Question: - [ ] unfortunate configuration (see attachment) - [ ] misbehaviour of sssd (more specifically its nss module) - [ ] misbehaviour of dovecot/auth processes? Dovecot: 2.3.4.1 (f79e8e7e4) Operating System: Debian GNU/Linux 10 (buster) Sssd: 1.16.30 Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 8

doveadm copy not respecting quotas?
by MAREN ZUBIZARRETA 24 Feb '21

24 Feb '21

Hello: I have a problema with the quotas at my system with dovecot 2.3.9.2, y use: quota_rule5 = RECUPERADOS_VGTIC:ignore I want to be free of quota limits at that mailbox RECUPERADOS_VGTIC when copying messages from "lazy_expunge" folder To recover from backup I use doveadm copy: doveadm copy -u nppgiibi RECUPERADOS_VGTIC mailbox .BORRADOS_VGTIC/sent-mail ALL But when I do so, quota for this mailbox RECUPERADOS_VGTIC is not ignored, and it grows to 200% Is this a bug? Or there is something that I'm doing wrongly? Thanks for your help. Maren PD: My config file for quotas follows below: /etc/dovecot/conf.d/90-quota.conf # Quota mail_vsize_bg_after_count = 100 # Limits plugin { quota = count:User quota quota_rule = *:storage=10G #for backups and lazy expunge quota_rule3 = .BORRADOS:ignore quota_rule4 = Recuperados_VGTIC:ignore quota_rule5 = RECUPERADOS_VGTIC:ignore quota_rule6 = BORRADOS_VGTIC:ignore quota_rule7 = .BORRADOS_VGTIC:ignore # This is required quota_vsizes = yes } -----Mensaje original----- De: dovecot <dovecot-bounces(a)dovecot.org> En nombre de Aki Tuomi Enviado el: miércoles, 24 de febrero de 2021 8:37 Para: Mark Constable <markc(a)renta.net>; dovecot(a)dovecot.org Asunto: Re: LMDB support? > On 24/02/2021 08:15 Mark Constable <markc(a)renta.net> wrote: > > > Hi all, is there any way I could use LMDB for userdb and passdb lookups? You can use Lua userdb/passdb. See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… Aki

1 0

LMDB support?
by Mark Constable 24 Feb '21

24 Feb '21

Hi all, is there any way I could use LMDB for userdb and passdb lookups?

2 1

Problem with fs:User quota: Postfix quota-status returns always DUNNO
by Niccolo Rigacci 23 Feb '21

23 Feb '21

I installed a mail server on a Debian GNU/Linux 10 Buster, which provide Dovecot 2.3.4.1. It works almost everything, but I'm unable to make the Postfix quota service to work as expected. First of all I verify that the Dovecot idea of quota is OK: doveadm quota get -u username(a)example.org Quota name Type Value Limit % User quota STORAGE 2752 3500 78 Then I ask the Postfix quota-status service: printf "recipient=username(a)example.org\nsize=3000000\n\n" \ | nc localhost 12340 action=DUNNO But a size of 3 Mb should trigger the "action=554 5.2.2 Quota exceeded" message. I find a workaround for this problem: just adding the following section will "fix" the problem: plugin { quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u } How the quota_over_flag_value is related to the quota over filesystem? Why should I add both the quota_over_flag_value AND the quota_over_script options? The script is executed always for each SMTP check (regardless of the quota_over_flag_value is FALSE or TRUE), obviously I provided a "do nothing" quota-warning script. Here the relevant parts of "dovecot -n" output: plugin { quota = fs:User quota:user quota_grace = 5%% quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u quota_status_nouser = DUNNO quota_status_overquota = 554 5.2.2 Quota exceeded quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = ~/sieve_before.d/ sieve_extensions = +vnd.dovecot.filter sieve_filter_bin_dir = /usr/local/lib/dovecot/sieve-filter sieve_filter_socket_dir = sieve-filter sieve_plugins = sieve_extprograms } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = root } -- Niccolo Rigacci - http://www.rigacci.net/ Firenze/Prato - Italy Tel. Mobile: +39-327-5619352

1 0

Bug renaming folder hierarchies
by Klaus Steinberger 23 Feb '21

23 Feb '21

Hi, we discovered a major problem with renaming folders with subfolders testszenario: folders: test1 test1/test1-1 test1/test1-2 all 3 folders contain a test message after renaming the top level folder test1 to test2 following folders exist: test2 test2/test1-1 test2/test1-2 the subfolders test1-1 and test1-2 are empty, the top level folder contains the correct message. Now renmaing test2 back to test1: Alle folders again contain their messages. So this looks like during renaming the top level folder just the message references for the subfolders got lost, and with renaming back they are there again. I can reproduce this behavior both with thunderbird and Horde Webmail as a client, also it happens with a second different dovecot setup Here is the dovecot config: root@dmz-sv-dovecot ~]# dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 3.10.0-1160.15.2.el7.x86_64 x86_64 Scientific Linux release 7.9 (Nitrogen) nfs4 # Hostname: dmz-sv-dovecot.physik.uni-muenchen.de auth_cache_negative_ttl = 5 mins auth_cache_size = 10 M auth_cache_ttl = 5 mins auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln auth_verbose = yes default_client_limit = 32768 default_process_limit = 8192 dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 8 imap_capability = +SPECIAL-USE imap_hibernate_timeout = 1 mins imapc_features = rfc822.size imapc_host = zarafa.physik.uni-muenchen.de imapc_user = %u lda_original_recipient_header = X-Original-To mail_fsync = always mail_location = mdbox:/var/vmail/%Lu:FULLDIRNAME=DbOx-mAiLs:UTF-8:VOLATILEDIR=/var/dovecot-volatile/%Lu:INDEX=/var/vmail/%Lu/indexes mail_nfs_index = yes mail_plugins = quota acl lazy_expunge fts fts_lucene mail_prefetch_count = 20 mail_server_admin = mailto:helpdesk@physik.uni-muenchen.de mail_server_comment = IMAP Server Fakultätfür Physik LMU München mailbox_list_index_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl metric imap_command { filter = event=imap_command_finished AND tagged_reply_state=OK group_by = cmd_name } metric imap_select_no { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply_state=NO } metric imap_select_no_notfound { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply="NO*Mailbox doesn't exist:*" } metric push_notifications { filter = event=push_notification_finished } metric storage_http_gets { filter = event=http_request_finished AND category=storage AND method=get } mmap_disable = yes namespace { list = children location = mdbox:/var/vmail/%%Lu:FULLDIRNAME=DbOx-mAiLs:INDEX=/var/vmail/%%Lu/indexes:INDEXPVT=/var/vmail/%%Lu/indexes.pvt:UTF-8 prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace { hidden = yes list = children location = mdbox:/var/vmail/%Lu/expunged:FULLDIRNAME=DbOx-mAiLs:UTF-8 prefix = .EXPUNGED/ separator = / subscriptions = no type = private } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/dovecot.acl acl_shared_dict = file:/var/vmail/dovecot-dicts/shared-mailboxes fts = lucene fts_lucene = whitespace_chars=@. lazy_expunge = .EXPUNGED/ lazy_expunge_only_last_instance = yes quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_rule3 = Spam:storage=+100M quota_rule4 = .EXPUNGED:ignore recipient_delimiter = + sieve = file:/var/vmail/%Lu/sieve;active=/var/vmail/%Lu/dovecot.sieve sieve_vacation_use_original_recipient = yes } postmaster_address = postmaster(a)physik.uni-muenchen.de protocols = imap lmtp sieve sieve quota_full_tempfail = yes service auth { unix_listener auth-userdb { group = daemon mode = 0666 user = mail } } service dict { unix_listener dict { group = daemon mode = 0600 user = vmail } } service imap-hibernate { client_limit = 8192 unix_listener imap-hibernate { user = vmail } } service imap-login { process_min_avail = 6 service_count = 0 vsz_limit = 1 G } service imap-postlogin { executable = script-login -d /etc/dovecot/acl_groups.py user = $default_internal_user } service imap { executable = imap imap-postlogin process_limit = 8192 unix_listener imap-master { user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0660 user = vmail } unix_listener stats-writer { group = dovecot mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/pki/tls/certs/dmz-sv-dovecot-with-chain.crt.pem ssl_client_ca_file = /etc/ssl/certs/ca-bundle.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve } protocol lda { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve syslog_facility = mail } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota acl lazy_expunge fts fts_lucene imap_quota imap_acl lazy_expunge } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k

1 0

Some questions about mail_crypt setups
by deano-dovecot＠areyes.com 23 Feb '21

23 Feb '21

Some questions about mail_crypt setups I have global mail enecryption working nicely, and replication works nicely between two systems. The main problem is that the private and public keys are *right there* on the server in /etc/dovecot/private ... Fine for a completely controlled system, but not so fine when on a rented VPS etc. When are the keys read in by dovecot ? Are they ever read in again while dovecot is running, or does it cache them in ram until dovecot is restarted ? Would it be possible for dovecot to read the keys as output from a script ? I'm thinking of a small script that would reach out to an authentication service like Authy or Okta or similar. Admin gets an alert on their phone, taps OK, UNLOCK and the two keys are returned to the script, which then hands them back to dovecot and away it goes. The mail_crypt config normally contains > mail_crypt_global_private_key = </etc/dovecot/private/dovecot_crypt_privkey > mail_crypt_global_public_key = </etc/dovecot/private/dovecot_crypt_pubkey Perhaps add another variable like > mail_crypt_global_script = </etc/dovecot/private/dovecot_crypt_script That script would run and feed the two keys back into dovecot (no matter how it got to them). So I started looking into per-user/per-folder encryption to see how that would work, and I have that setup nicely too. The config looks like this > # /etc/dovecot/conf.d/99-mailcrypt.conf > #-------------------------------------- > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > plugin { > mail_crypt_require_encrypted_user_key = yes > mail_crypt_save_version = 2 > mail_crypt_curve = secp521r1 > } > > # /etc/dovecot/dovecot-sql.conf.ext > #---------------------------------- > # CREATE TABLE IF NOT EXISTS `users` ( > # `username` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'localpart of email-address', > # `domain` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'domain-part of email-address', > # `name` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'Full name of user', > # `password` varchar(128) character set utf8 collate utf8_bin NOT NULL COMMENT 'base64-encoded SHA512 hash of password', > # PRIMARY KEY (`username`,`domain`) > # ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='users'; > > driver = mysql > connect = host=/var/run/mysqld/mysqld.sock dbname=emailers user=dovecot password=RandomPassword > default_pass_scheme = SHA512-CRYPT > > password_query = SELECT username, password, '%w' AS userdb_mail_crypt_private_password, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' > > # For LDA: > user_query = SELECT '/var/mail/%d/%n' AS home, 'vmail' AS uid, 'vmail' AS gid FROM users WHERE username = '%n' AND domain = '%d' > > # For using doveadm -A: > iterate_query = SELECT username, domain FROM users Except that replication doesn't work due to the user password not being available. Actually, indexing fails too for the same reason. > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Failed to read mailbox INBOX mail UID=1 stream: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Mail search failed: Internal error occurred. Refer to server log for more information. [2021-02-21 14:02:13] > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: transaction context (attempted to index 1 messages (UIDs 1..1)) > > Feb 21 14:02:13 dsync-local(testuser(a)example.com)<TGxiDTWuMmAN2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=prefetch) What are the options here for providing the decryption password or key ? The user password is already stored in the mysql database as a SHA512-CRYPT so we don't want to store it unencrypted ... I saw the mail_crypt docs (https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/) mention > mail_crypt_private_key - Private key to decrypt user's master key, can be base64 encoded I'm assuming that can just be a key generated with > openssl ecparam -name secp521r1 -genkey | openssl pkey but that leaves the situation almost the same as with a global key - they key is local on the system, though a bit better in that it's not just visible there as a simple file, it can be buried in the database. One could retrieve it with > password_query = SELECT username, password, privkey AS userdb_mail_crypt_private_key, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' How are other people handling mail store encryption ? -- Dean Carpenter deano is at areyes dot com 203 six oh four 6644

4 3