- dovecot - dovecot.org

Dovecot & OAuth
by mizuki 06 Dec '19

06 Dec '19

Hi all, We'd like to enable OAuth with Keycloak in Dovecot, after enabling 'OAUTHBEARER XOAUTH2' in Dovecot based on online document, I can confirm Dovecot is ready for OAuth using openssl command, however when the auth request comes in, it failed in establishing a SSL connection with Keycloak server on port 443, shown as following in debug logs. I can confirming using commands 'openssl s_client -connect <keycloak_server>:443' or 'curl -v https://<keycloak_server/' all returns normal and no errors. Altering some of the SSL options in dovecot such as 'ssl_ca = </etc/pki/CA/certs/root_ca.pem' or 'ssl_client_ca_file = </etc/pki/CA/certs/root_ca.pem' does not help either. The certificate are NOT self-signed but signed the legit authorities. So I'm not sure why dovecot could not establish the connections. *Debug logs:* ---------------------------------------------------- Dec 5 14:32:07 mktst4 dovecot: auth: Debug: auth client connected (pid=16554) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: client in: AUTH#0111#011OAUTHBEARER#011service=imap#011secured#011session=QPwA/fmY+tqCx5Tr#011lip=130.199.148.187#011rip=10.0.2.1#011lport=993#011rport=56058#011resp=bixhPW1penVraQFob3N0PW1rdHN0NC5zZGNjLmJubC5nb3YBcG9ydD05OTMBYXV0aD1CZWFyZXIgZXlKaGJHY2lPaUpTVXpJMU5pSXNJblI1Y0NJZ09pQWlTbGRVSWl3aWEybGtJaUE2SUNKcmRHeE5TSFZtYkc1NFZUUmlSR1pLTm5kSGRteFBNVVYxWWxWd2FreEZVVmhIY25GTU5UYzNhSEJSSW4wLmV5SnFkR2tpT2lJNE5XSmxZV05tTkMxak1tTmxMVFJtTkRJdFltUTRNUzAxTnpWaU4yRmpZV05sT1RnaUxDSmxlSEFpT2pFMU56VTJNVEF5TURnc0ltNWlaaUk2TUN3aWFXRjBJam94TlRjMU5UYzBNakE0TENKcGMzTWlPaUpvZEhSd2N6b3ZMMnRsZVdOc2IyRnJNaTV6WkdOakxtSnViQzVuYjNZdllYVjBhQzl5WldGc2JYTXZiV0ZwYkNJc0ltRjFaQ0k2SW1GalkyOTFiblFpTENKemRXSWlPaUkyTmpWa05EVTNNeTA0WVdFMUxUUmtPRFl0WW1NelppMHlaVEpqTWpOaU16WTJORFVpTENKMGVYQWlPaUpDWldGeVpYSWlMQ0poZW5BaU9pSmtiM1psWTI5MElpd2lZWFYwYUY5MGFXMWxJam93TENKelpYTnphVzl1WDNOMFlYUmxJam9pT1RNNE5XRTVOakF0TUROa1pDMDBPR05sTFdFeU4yUXRZVFkzWkdZME5tUXhaRGcxSWl3aVlXTnlJam9pTVNJc0luSmxZV3h0WDJGalkyVnpjeUk2ZXlKeWIyeGxjeUk2V3lKdlptWnNhVzVsWDJGalkyVnpjeUlzSW5WdFlWOWhkWFJvYjNKcGVtRjBhVzl1SWwxOUxDSnlaWE52ZFhKalpWOWhZMk5sYzNNaU9uc2lZV05qYjNWdWRDSTZleUp5YjJ4bGN5STZXeUp0WVc1aFoyVXRZV05qYjNWdWRDSXNJbTFoYm1GblpTMWhZMk52ZFc1MExXeHBibXR6SWl3aWRtbGxkeTF3Y205bWFXeGxJbDE5ZlN3aWMyTnZjR1VpT2lKd2NtOW1hV3hsSUdWdFlXbHNJaXdpWlcxaGFXeGZkbVZ5YVdacFpXUWlPbVpoYkhObExDSnVZVzFsSWpvaVRXbDZkV3RwSUV0aGNtRnpZWGRoSWl3aWNISmxabVZ5Y21Wa1gzVnpaWEp1WVcxbElqb2liV2w2ZFd0cElpd2laMmwyWlc1ZmJtRnRaU0k2SWsxcGVuVnJhU0lzSW1aaGJXbHNlVjl1WVcxbElqb2lTMkZ5WVhOaGQyRWlMQ0psYldGcGJDSTZJbTFwZW5WcmFVQmlibXd1WjI5MkluMC5NZTRwNkl0dmx2T0VYRTIxM2pwSnJpa3FhZGNZb0ZsMnlMVlJzQTJvQTdmWDgteEtJYTR2ckZmamwwLXRwb2JodzIyRnBvVDZ2TWoxbXphLXBWWUxzNW1vM0w5Y0xKT2hVVnV2Tm9YSm5nZlRzLXk2TWxuTXVGV1NQemtidEhhOXJTUEVqZGFZQXBDQk52MG9CWEs2bmhIM0U5ZkNvTl9TQlUycWxaSWk2M1dWOUZXSjFrbHVGT2Iwc0xja2JfWGNGZzhUZ0dXOEdVUlRYTlg4bW1VM1dNLWJ5dnJuTkFyNmFjWW1ibXRaVzRhV0NwTk5FSHRZU29LSmgydHZuQjhHNnl5eWptWWJ5Q2ZhTmwwSnVZYU52VFEzTXhCX2FnLV9Pcy04VkwtTGFLdHBGYXBMNEVNWUJaXzFnZmNhSFdUSUV1VS0wSVdjTjlEa2xxcW1MN19jNlEBAQ== (previous base64 data may contain sensitive data) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: host example.com: Host created Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: host example.com: Performing asynchronous DNS lookup Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: request [Req1: GET https://example.com/auth/realms/mail/protocol/openid-connect/tokeneyJhbGciO…] Submitted Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: host example.com: DNS lookup successful; got 1 IPs Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: peer 10.0.2.2:443: Peer created Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: queue https://example.com"443: Setting up connection to 10.0.2.2:443 (SSL= example.com) (1 requests pending) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: peer 10.0.2.2:443: Linked queue https://example.com:443 (1 queues linked) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: queue https://example.com:443: Started new connection to 10.0.2.2:443 (SSL= example.com) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: peer 10.0.2.2:443: Creating 1 new connections to handle requests (already 0 usable, connecting to 0, closing 0) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: peer 10.0.2.2:443: Making new connection 1 of 1 Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn 10.0.2.2:443 [0]: HTTPS connection created (1 parallel connections exist) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn 10.0.2.2:443 [0]: Connected Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn 10.0.2.2:443 [0]: Starting SSL handshake Dec 5 14:32:22 mktst4 dovecot: auth: Received invalid SSL certificate: unable to get issuer certificate: /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: peer 10.0.2.2:443: Failed to make connection (connections=1, connecting=1) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: queue https://example.com:443: Failed to set up connection to 10.0.2.2:443 (SSL= example.com) SSL handshaking with 10.0.2.2:443 failed: read(SSL 10.0.2.2:443) failed: Received invalid SSL certificate: unable to get issuer certificate: /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority (1 peers pending, 1 requests pending) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: queue https://example.com:443: Failed to set up any connection; failing all queued requests Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: peer 10.0.2.2:443: Unlinked queue https://example.com:443 (0 queues linked) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: queue https://example.com:443: Dropping request [Req1: GET https://example.com/auth/realms/mail/protocol/openid-connect/tokeneyJhbGciO… ] Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: host example.com: Host is idle (timeout = 1799992 msecs) Dec 5 14:32:22 mktst4 dovecot: auth: Error: oauth2(mizuki,10.0.2.1,<QPwA/fmY+tqCx5Tr>): oauth2 failed: SSL handshaking with 10.0.2.2:443 failed: read(SSL 10.0.2.2:443) failed: Received invalid SSL certificate: unable to get issuer certificate: /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: request [Req1: GET https://example.com/auth/realms/mail/protocol/openid-connect/tokeneyJhbGciO…] Destroy (requests left=1) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: request [Req1: GET https://example.com/auth/realms/mail/protocol/openid-connect/tokeneyJhbGciO…] Free (requests left=0) Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn 10.0.2.2:443 [0]: SSL handshaking with 10.0.2.2:443 failed: read(SSL 10.0.2.2:443) failed: Received invalid SSL certificate: unable to get issuer certificate: /C=US/ST=New Jersey/L=Jersey City/O=The USERTRUST Network/CN=USERTrust RSA Certification Authority Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn 10.0.2.2:443 [0]: Connection close Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn 10.0.2.2:443 [0]: Connection disconnect Dec 5 14:32:22 mktst4 dovecot: auth: Debug: http-client: conn 10.0.2.2:443 [0]: Connection destroy ---------------------------------------------------- *#dovecot -n * ---------------------------------------------------- # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-1062.4.3.el7.x86_64 x86_64 Red Hat Enterprise Linux Server release 7.7 (Maipo) # Hostname: mktst4.sdcc.bnl.gov auth_debug = yes auth_debug_passwords = yes auth_mechanisms = oauthbearer xoauth2 auth_verbose = yes auth_verbose_passwords = yes first_valid_uid = 1000 mail_debug = yes mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-oauth2.conf.ext driver = oauth2 mechanisms = oauthbearer xoauth2 } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } ssl = required ssl_ca = </etc/pki/CA/certs/2.pem ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_cipher_list = ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!aNULL:!MD5:!DSS:!RSA ssl_client_ca_file = </etc/pki/CA/certs/2.pem ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes ssl_require_crl = no userdb { args = uid=vmail gid=vmail home=/var/vmail/%u driver = static } ---------------------------------------------------- *# cat /etc/dovecot/conf.d/auth-oauth2.conf.ext* ---------------------------------------------------- passdb { driver = oauth2 mechanisms = oauthbearer xoauth2 args = /etc/dovecot/dovecot-oauth2.conf.ext } userdb { driver = static args = uid=vmail gid=vmail home=/var/vmail/%u } ---------------------------------------------------- I wonder if anyone has experienced this possibly know what's going on. Thanks! Mizuki

2 3

Supporting RFC 5466 (IMAP4 Extension for Named Searches (Filters))
by Jesus Cea 06 Dec '19

06 Dec '19

I wonder if Dovecot supports RFC 5466 (IMAP4 Extension for Named Searches (Filters)) or if there is any plan about it. -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

4 6

How to rewrite local_lmpt ipc to tcp port 24
by Marc Roos 05 Dec '19

05 Dec '19

How to change this line in sendmail.mc, to the tcp port 24 on eg 127.0.0.1? FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl

2 1

dovecot expunge
by soumitri＠iitk.ac.in 05 Dec '19

05 Dec '19

Hi, Do we have expunge command by UID. I have some duplicate messages (same Message-ID but different UID) to be deleted. doveadm search gives me folder GUID and file UID, I want to use this specific information to delete/expunge. E.g. Following command deletes all duplicates, but I want to keep just one. doveadm expunge -u user1 mailbox INBOX HEADER Message-ID '5de82b2d.6VWfTzsd/fEAxfV7%cytx(a)iitk.ac.in' The following does not help doveadm deduplicate -u user1 mailbox INBOX -- Sincerely, Soumitri Mishra

2 1

How do I set all my mailboxes to "subscribed"
by Steve Litt 05 Dec '19

05 Dec '19

Hi all, I've had a great deal of trouble accessing my Dovecot IMAP from most supposedly IMAP aware email clients, and have been advised that it might be because some of my email folders are not subscribed. Is there s way I can subscribe all my folders? I see no reason to have a folder not subscribed. Thanks, SteveT Steve Litt December 2019 featured book: Rapid Learning for the 21st Century http://www.troubleshooters.com/rl21

2 1

Email blocking emails
by Peter Nabbefeld 05 Dec '19

05 Dec '19

Hello, I had troubles getting emails, because this one caused a Sig 6: https://p.ip.fi/DGSP It might be important that I'm using SOLR. After I removed this mail, I could fetch emails again. Kind regards Peter

2 1

Dovecot 2.3.9 fails on FreeBSD
by Pascal Christen 04 Dec '19

04 Dec '19

Hi I've just tried to build the latest Dovecot 2.3.9 on FreeBSD 11.3. Without success...It fails on the following commit which was introduced in 2.3.9: https://github.com/dovecot/core/commit/c85f1bc3ce612c736c9d2c468cc08306db1b… Following output is the build log: https://pastebin.com/3nvSeDn8 So I guess it has to do with some changes FreeBSD made: https://reviews.freebsd.org/D18630 What do you guys think? Greetings Pascal

4 10

dovecot sieve duplicates detection
by André Rodier 04 Dec '19

04 Dec '19

Hello, I have tested the sieve duplicate script with success so far, but I have a question. I would like to know if the "duplicate" sieve flag in Dovecot is global to all folders, or specific to one folder only. For instance, if I copy an email from one folder to another, and I have a discard action on duplicate email, is this action will be applied (in this case, discard) or not. If the duplicate is global to all folders, is there a way to restrict the search in one folder only. Thanks for your help. André

3 10

About "received" header when using Dovecot proxy
by ml＠riku22.net 04 Dec '19

04 Dec '19

Hello. My name is Riku. Currently, I use Dovecot as a proxy for another SMTP server. However, this seems to cause the IP address of the "received" header to be that of the proxy server. Is it possible to change this so that the IP address of the sender is entered? The version of Dovecot is "2.3.8 (9df20d2db)". Sorry for the incomprehensible explanation. Thank you. Best regards.

4 6

Environment variables in pgsql connect string
by Eirik Rye 04 Dec '19

04 Dec '19

Hi, We are trying to set up a Dovecot Docker image with dynamic database configuration based on environment variables, however the variables do not appear to be expanded in the "connect=" string of the SQL config. The documentation states that environment variables, being listed under global variables, work "everywhere": https://doc.dovecot.org/configuration_manual/config_file/config_variables/#… However, the source code for driver-pgsql.c indicates that the connect string is never expanded: https://github.com/dovecot/core/blob/master/src/lib-sql/driver-pgsql.c#L297 For reference, this is my configuration. dovecot.conf: import_environment = PASSDB_USER PASSDB_DBNAME PASSDB_PASSWORD passdb { override_fields = proxy=y driver = sql args = /etc/dovecot/dovecot-sql.conf.ext } /etc/dovecot/dovecot-sql.conf.ext: driver = pgsql connect = host=mail-passdb dbname=%{env:PASSDB_DBNAME} user=%{env:PASSDB_USER} password=%{env:PASSDB_PASSWORD} Does anyone have any suggestions for how to connect to a database without hardcoding the connection parameters in the Dovecot config, which does not involve patching driver-pgsql.c to make the variable expansion? Best regards, Eirik Rye

2 1

some error about dovecot when compile
by Magiczero 04 Dec '19

04 Dec '19

when i build dovecot in my computer, something has occured like below: root@2030c8624e88:/dovecot-2.3.9# ./autogen.sh --2019-12-04 10:49:53-- https://www.dovecot.org/tmp/wiki2-export.tar.gz Resolving www.dovecot.org (www.dovecot.org) 94.237.12.234, 2a04:3545:1000:720:acc1:5bff:fe5e:4e9 Connecting to www.dovecot.org (www.dovecot.org)|94.237.12.234|:443... connected. HTTP request sent, awaiting response... 200 OK Length: 446263 (436K) [application/x-gzip] Saving to: 'wiki2-export.tar.gz' wiki2-export.tar.gz 100%[===============================>] 435.80K 152KB/s in 2.9s 2019-12-04 10:49:59 (152 KB/s) - 'wiki2-export.tar.gz' saved [446263/446263] configure.ac:298: warning: macro 'AM_ICONV' not found in library libtoolize: putting auxiliary files in '.'. libtoolize: copying file './ltmain.sh' libtoolize: putting macros in AC_CONFIG_MACRO_DIRS, 'm4'. libtoolize: copying file 'm4/libtool.m4' libtoolize: copying file 'm4/ltoptions.m4' libtoolize: copying file 'm4/ltsugar.m4' libtoolize: copying file 'm4/ltversion.m4' libtoolize: copying file 'm4/lt~obsolete.m4' configure.ac:298: warning: macro 'AM_ICONV' not found in library configure.ac:22: error: possibly undefined macro: AC_DEFINE If this token and others are legitimate, please use m4_pattern_allow. See the Autoconf documentation. configure.ac:127: error: possibly undefined macro: dnl configure.ac:298: error: possibly undefined macro: AM_ICONV configure.ac:429: error: possibly undefined macro: AC_CHECK_HEADER configure:24018: error: possibly undefined macro: AC_CHECK_LIB configure:25593: error: possibly undefined macro: AC_CHECK_FUNC autoreconf: /usr/bin/autoconf failed with exit status: 1 from the information, i think the problem is macro 'AM_ICONV', there are any problem in the setup script? i want you help me to solve this issue. Thank you. Best MagicZero Sent with [ProtonMail](https://protonmail.com) Secure Email.

2 2

Pigeonhole v0.5.9 released
by Aki Tuomi 04 Dec '19

04 Dec '19

Hi all! We are pleased to release v0.5.9 of Pigeonhole. Please find it from locations below --- Aki Tuomi Open-Xchange oy https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.9.ta… https://pigeonhole.dovecot.org/releases/2.3/dovecot-2.3-pigeonhole-0.5.9.ta… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot --- + Added events for Sieve and ManageSieve, see https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole + Pigeonhole: Implement the Sieve "special-use" extension described in RFC 8579. - duplicate: Test only compared the handles which would cause different values to be cached as the same duplicate test. Fix to also compare the actual hashes. - imap_sieve_filter: IMAP FILTER Command had various bugs in error handling. Errors may have been duplicated for each email, errors may have been missing entirely, command tag and ERRORS/WARNINGS parameters were swapped.

1 0

Fast searching from android device with Dovecot/Maildir
by John Gateley 03 Dec '19

03 Dec '19

Hello, I am using dovecot as an imap server, mail is stored in mail directories. Configuration is below. One mail directory has about 14 Gb of mail in the inbox and .Sent directories. Searching from an Android phone with gmail is slow or doesn't work (it times out). Is there a configuration for Dovecot that can improve this? A better e-mail client for Android? Thanks, John root@giraffe:~# dovecot --version 2.2.27 (c0f36b0) root@giraffe:~# doveconf -an # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-11-amd64 x86_64 Debian 9.11 ... mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } ... protocols = " imap" ...

3 3

fts_solr and # char
by Marcio Merlone 03 Dec '19

03 Dec '19

Hi, Dovecot wiki says the solr url is something like 'solr/dovecot/' but this gives a 404, if I install solr as per the docs I have a 'solr/#/dovecot/' url: https://wiki.dovecot.org/Plugins/FTS/Solr I have installed dovecot 2.3 from https://repo.dovecot.org/ and solr 8.3 as per the wiki on a Ubuntu 18.04. The problem and the guess work I did: fts_solr = url=http://localhost:8983/solr/#/dovecot/ doveconf: Warning: Configuration file /etc/dovecot/conf.d/90-plugin.conf line 13: Ambiguous '#' character in line, treating it as comment. Add a space before it to remove this warning. fts_solr = url="http://localhost:8983/solr/#/dovecot/" Error: fts: Failed to initialize backend 'solr': fts_solr: Failed to parse HTTP url: Path component contains invalid character fts_solr = url='http://localhost:8983/solr/#/dovecot/' Error: fts: Failed to initialize backend 'solr': fts_solr: Failed to parse HTTP url: Relative HTTP URL not allowed fts_solr = url=http://localhost:8983/solr/%23/dovecot/ Error: Failed to expand plugin setting fts_solr = 'url=http://localhost:8983/solr/%23/dovecot/': Unknown variable '%/' fts_solr = 'url=http://localhost:8983/solr/#/dovecot/' fts_solr: Failed to parse HTTP url: URL fragment not allowed for HTTP URL in this context Thanks for any help. -- *Marcio Merlone=*

2 1

running dovecot under different user
by Marc Roos 02 Dec '19

02 Dec '19

Did anyone ever managed to run dovecot as a non-root user?

2 2

Running dovecot proxy as different user
by Marc Roos 02 Dec '19

02 Dec '19

I thought, I read somewhere I could prevent chroot with[1] but I am still getting chroot errors[2]. drwxrwxr-x 2 10053 101 6 Dec 2 16:54 empty drwxr-x--- 2 10053 101 73 Dec 2 17:00 login drwxr-x--- 2 10053 101 44 Dec 2 17:00 token-login [1] service anvil { chroot = } [2] Dec 2 17:07:07 c04 dovecot: stats: Fatal: chroot(/var/dovecot/empty) failed: Operation not permitted Dec 2 17:07:07 c04 dovecot: master: Error: service(stats): command startup failed, throttling for 16 secs Dec 2 17:07:07 c04 dovecot: pop3-login: Fatal: setgid(101(dovenull)) failed with euid=10053(dovecot), gid=10053(dovecot), egid=10053(dovecot): Operation not permitted (This binary should probably be called with process group set to 101(dovenull) instead of 10053(dovecot)) Dec 2 17:07:07 c04 dovecot: master: Error: service(pop3-login): command startup failed, throttling for 16 secs

1 0

Mail-crypt won't encrypt emails
by Serveria Support 02 Dec '19

02 Dec '19

Hi, (Reposting as my previous post got zero replies.) We're running Dovecot 2.2.36 and we need to set up the mail-crypt plugin to encrypt all incoming and outgoing emails. Outgoing emails seem to get encrypted fine but the incoming ones don't. We tried everything including this config: mail_attribute_dict = file:%h/Maildir/dovecot-attributes mail_plugins = $mail_plugins mail_crypt plugin { mail_crypt_global_private_key = <ecprivkey.pem mail_crypt_global_public_key = <ecpubkey.pem mail_crypt_save_version = 2 } also this one: plugin { mail_crypt_curve = prime256v1 mail_crypt_save_version = 2 } but to no avail. There are no visible errors, Dovecot restarts fine and outgoing emails get encrypted. Any ideas? -- Kind Regards, Support Team SERVERIA.COM Riga, LV-1063, Latvia US: +1 (213) 224-7938 LV: + (371) 22330032 Skype: bighostlv support(a)serveria.com www.serveria.com

3 2

Cert for ip range?
by Marc Roos 01 Dec '19

01 Dec '19

Is it possible to configure a network for a cert instead of an ip? Something like this: local 192.0.2.0 { ssl_cert = </etc/ssl/dovecot/imap-02.example.com.cert.pem ssl_key = </etc/ssl/dovecot/imap-02.example.com.key.pem } Or local 192.0.2.0/24 { ssl_cert = </etc/ssl/dovecot/imap-02.example.com.cert.pem ssl_key = </etc/ssl/dovecot/imap-02.example.com.key.pem } https://wiki.dovecot.org/SSL/DovecotConfiguration

3 5

Error: proxy: Remote returned invalid banner: 220
by Marc Roos 01 Dec '19

01 Dec '19

I had a working proxy setup added sieve to it, and out of the blue I get this Error: proxy: Remote returned invalid banner: 220 No idea what to do, nothing even in the mail list archive

2 3

dovecot: auth: Error: DNS lookup for xxx failed: Name does not resolve
by Marc Roos 01 Dec '19

01 Dec '19

I had a working container with dovecot configured as proxy. And all of a sudden I am getting these messages 'dovecot: auth: Error: DNS lookup for roosit03 failed: Name does not resolve' Pinging/nslookup these hostnames is ok

2 3

Proxy GSSAPI + PLAIN authentication
by Sam 30 Nov '19

30 Nov '19

Hi, I try to configure a proxy accepting GSSAPI and PLAIN authentication. When authenticating with Kerberos, Dovecot uses master user and password to authenticate to backends (backends can be Cyrus or Exchange servers too) When authenticating with PLAIN passwords, Dovecot sends user's login and password to the backend. For GSSAPI, I use extrafields : k5principals=principal@REALM proxy=Y pass=masterpassword login_user=principal user=masteruser host=backend For PLAIN, I use a static driver : passdb { driver = static args = proxy=y host=cyrus password=%w } I can authenticate fine with Kerberos tickets and login/password on the backend. Trouble is that if I authenticate with PLAIN login/password, with a user known from the passdb lookup made for GSSAPI, I can authenticate with any password, it is not checked. The passdb with masteruser and nopassword=y is checked. I can't restrict the passdb with the k5principals extrafield. I tried static and ldap drivers, with the same wrong behaviour. pass_attrs = \ =proxy=Y, \ =nopassword=Y, \ =pass=masterpassword, \ =login_user=%{ldap:uid}, \ =user=masteruser, \ =host=backend, \ =k5principals=%{ldap:uid}@REALM With the ldap driver, I've got auth_bind = no The user is found in the ldap, and Dovecot logs him with the masterpassword. If I don't configure an ldap passdb, but a userdb only, the proxy try passdb that comes after for PLAIN logins. With a passwd-file driver, the k5principals works fine. The user isn't found if it authenticates with PLAIN. My question is : is it possible to restrict a ldap or static passdb for GSSAPI mechanism only ? Thanks for your help, Regards, Sam

2 2

ESEARCH is announced but it doesn't work
by Jesus Cea 29 Nov '19

29 Nov '19

I am using Dovecot 2.3.4. I could upgrade if necessary. I see this capabilities after login in: """ a OK [CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SNIPPET=FUZZY LITERAL+ NOTIFY SPECIAL-USE] Logged in """ ESEARCH (RFC 7377) seems to be available, but the command is not recognized: """ tag1 ESEARCH IN (mailboxes "folder1" subtree "folder2") unseen tag1 BAD Error in IMAP command ESEARCH: Unknown command (0.001 + 0.000 secs). """ What am I doing wrong? Thanks for your time and expertise. -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

2 2

sendmail -> lmtp 501 5.6.0 Data format error
by Marc Roos 29 Nov '19

29 Nov '19

When changing in a working setup sendmail.mc From this MAILER(smtp)dnl MAILER(procmail)dnl To this FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl MAILER(local)dnl I am getting these errors '501 5.6.0 Data format error' and ' Unrecognized host name'. What should I change in my lmtp config? Could this be related that messages are being relayed from other servers? lmtp_address_translate = lmtp_hdr_delivery_address = final lmtp_proxy = no lmtp_rcpt_check_quota = no lmtp_save_to_detail_mailbox = no lmtp_user_concurrency_limit = 0

2 3

Using dovecot Replication in a medium to large enterprise.
by Brent Clark 28 Nov '19

28 Nov '19

Good day Guys Just wanted to pick the communities brain and experience(s) for a second. At $CORP where I work. My team has inherited a single server mail solution. We need to look to building a standby / replicated solution. One of the things we were looking at is https://wiki.dovecot.org/Replication We have in excess of +/- 500 mail boxes and using just under 1TB of disk space. That is a lot of small files. Reading about this plugin / module, things that stick out and is concerning is the comments: "The replication in general is a bit resource intensive, so it's not recommended to be used in multi-million user installations." "WARNING: Shared folder replication doesn't work correctly right now –" I would like to ask the community (and anyone else in a similar enterprise) how and if this solution works and scales. In short, I am asking, is anyone else using Dovecot Replication in a medium to large enterprise? Can you please share your experiences, pitfalls and if you have any tips managing mail replication. Kindest regards and thanks in advance. Brent Clark

4 3

IMAP Migration Tools
by Julian Kippels 28 Nov '19

28 Nov '19

Hi, I am looking for tools to migrate Mails from one IMAP-Server to another. Until now I have always used imapsync, but it seems very slow. Even over a 2x10GB/s connection I only get speeds of about 600KiB/s, because the programm always pauses betweeen every single mail. Does anyone here have a suggestion for an alternative? Thanks in advance Julian

6 5

Sendmail + lmtp
by Marc Roos 28 Nov '19

28 Nov '19

Is there any guide like this https://wiki.dovecot.org/HowTo/PostfixDovecotLMTP for configuring sendmail?

1 0

Dovecot auth
by j.emerlik 27 Nov '19

27 Nov '19

Hi, is possible to configure post-login script for Service auth ? I would like to run post script after successful login to postfix (smtp). Regards, Jack

2 1

Dovecot FINs after sending "NO Not showing other users' quota"
by Gene Smith 27 Nov '19

27 Nov '19

When I do imap getquota on a shared folder I see the NO response. That's OK but then often dovecot disconnects (sends FIN) to the client right after this. The client acks the disconnect and creates a new connection and continues on. Should dovecot disconnect after this type of imap "NO" response? -gene

2 1

Performance mdbox vs mbox
by Marc Roos 26 Nov '19

26 Nov '19

If I do the same test[1] with mbox I can store around 31k messages and mdbox 16k messages. I noticed also that cpu and disk utilization with mdbox was not very high, while disk utilization on mbox was much higher. That makes me wonder if I can tune mdbox to have better performance? [1] imaptest - append=100,0 logout=0 host=svr port=143 user=test pass=xxx seed=100 secs=240 clients=1 mbox=64kb.mbox box=inbox/test [2] mail_location = mbox:~/mail:INBOX=/var/spool/mail/%u:CONTROL=~/mail/control:INDEX=/var/d ovecot/%u/index:LAYOUT=maildir++ mail_location = mdbox:~/mdbox:INDEX=/home/popindex/%u/index - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -. F1 Outsourcing Development Sp. z o.o. Poland t: +48 (0)124466845 f: +48 (0)124466843 e: marc(a)f1-outsourcing.eu

2 1

Dovecot Master User: Access user's mailbox without owner's password
by Dav Rdrz 26 Nov '19

26 Nov '19

Hi, I hope you're all right. I describe below the scenario where the problem occurs. I'm trying to activate a master user [1] to be able to access all the boxes of all users by imap. I have configured the dovecot-master-users [2] file with the appropriate permissions. When I try to access, for example with roundcube, through user@mydomain.com*my_master_user@not-exist.com I see in the log, that it seems to ignore the master-user (*) and tries to authenticate the Active Directory but with the master user's password. Then it shows in the log the messages auth: Info: ldap(user(a)mydomain.com,127.0.0.1,<6sFGXE6XLwB/AAAB> ) invalid credentials auth: Debug: client passdb out: FAIL 1 user=user(a)mydomain.com I have other test cases, but I need to validate the master user login that way. I would appreciate any comments you can make and I am waiting to answer any questions. Regards, [1] https://doc.dovecot.org/configuration_manual/authentication/master_users/ [2] https://docs.iredmail.org/dovecot.master.user.html --------------------------------------------------------------------------------------- root@mail-01:/etc/dovecot# cat /etc/issue Ubuntu 14.04.5 LTS \n \l root@mail-01:/etc/dovecot# dpkg -l | grep dovecot | awk {'print $2" "$3'} dovecot-core 1:2.2.9-1ubuntu2.6 dovecot-imapd 1:2.2.9-1ubuntu2.6 dovecot-ldap 1:2.2.9-1ubuntu2.6 dovecot-lmtpd 1:2.2.9-1ubuntu2.6 dovecot-managesieved 1:2.2.9-1ubuntu2.6 dovecot-mysql 1:2.2.9-1ubuntu2.6 dovecot-pop3d 1:2.2.9-1ubuntu2.6 dovecot-sieve 1:2.2.9-1ubuntu2.6 root@mail-01:/etc/dovecot# cat dovecot.conf | grep -v '#' | grep -v -e '^$' | sed "s/REALDOMAIN/mydomain/g" listen = * [::] mail_plugins = quota mailbox_alias acl protocols = pop3 imap sieve lmtp mail_uid = 2000 mail_gid = 2000 first_valid_uid = 2000 last_valid_uid = 2000 log_path = /var/log/dovecot.log auth_verbose = yes auth_debug = yes ssl_protocols = !SSLv2 !SSLv3 ssl = required verbose_ssl = no ssl_ca = </etc/ssl/certs/mydomain.com.ca-bundle ssl_cert = </etc/ssl/certs/mydomain.com.crt ssl_key = </etc/ssl/private/mydomain.com.key ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_dh_parameters_length = 2048 ssl_prefer_server_ciphers = yes disable_plaintext_auth = no mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/ auth_default_realm = mydomain.com auth_mechanisms = PLAIN LOGIN service auth { unix_listener /var/spool/postfix/private/dovecot-auth { user = postfix group = postfix mode = 0666 } unix_listener auth-master { user = vmail group = vmail mode = 0666 } unix_listener auth-userdb { user = vmail group = vmail mode = 0660 } } service lmtp { user = vmail process_min_avail = 5 executable = lmtp -L unix_listener /var/spool/postfix/private/dovecot-lmtp { user = postfix group = postfix mode = 0600 } inet_listener lmtp { address = 127.0.0.1 port = 24 } } auth_master_user_separator = * passdb { driver = passwd-file args = /etc/dovecot/dovecot-master-users master = yes } userdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-ldap.conf driver = ldap } plugin { auth_socket_path = /var/run/dovecot/auth-master quota = dict:user::proxy::quotadict quota_rule = *:storage=3G quota_warning = storage=100%% quota-warning 100 %u quota_warning2 = storage=95%% quota-warning 95 %u quota_warning3 = storage=90%% quota-warning 90 %u quota_warning4 = storage=85%% quota-warning 85 %u quota_grace = 10%% acl = vfile acl_shared_dict = proxy::acl sieve_dir = %Lh/sieve sieve = %Lh/sieve/dovecot.sieve sieve_global_dir = /var/vmail/sieve sieve_before = /var/vmail/sieve/dovecot.sieve mailbox_alias_old = Sent mailbox_alias_new = Sent Messages mailbox_alias_old2 = Sent mailbox_alias_new2 = Sent Items } service quota-warning { executable = script /usr/local/bin/dovecot-quota-warning.sh unix_listener quota-warning { user = vmail group = vmail mode = 0660 } } service dict { unix_listener dict { mode = 0660 user = vmail group = vmail } } dict { quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf acl = mysql:/etc/dovecot/dovecot-share-folder.conf } protocol lda { mail_plugins = $mail_plugins sieve auth_socket_path = /var/run/dovecot/auth-master log_path = /var/log/dovecot-sieve.log lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes postmaster_address = it(a)mydomain.com } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log mail_plugins = quota sieve postmaster_address = postmaster lmtp_save_to_detail_mailbox = yes recipient_delimiter = + } protocol imap { mail_plugins = $mail_plugins imap_quota imap_acl imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 30 } protocol pop3 { mail_plugins = $mail_plugins pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv mail_max_userip_connections = 30 } service imap-login { service_count = 1 process_limit = 500 } service pop3-login { service_count = 1 } service managesieve-login { inet_listener sieve { address = 127.0.0.1 port = 4190 } } namespace { type = private separator = / prefix = inbox = yes mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox "Sent Items" { auto = no special_use = \Sent } mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Trash { auto = subscribe special_use = \Trash } mailbox "Deleted Messages" { auto = no special_use = \Trash } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Spam { auto = no special_use = \Junk } mailbox "Junk E-mail" { auto = no special_use = \Junk } mailbox Archive { auto = subscribe special_use = \Archive } mailbox Archives { auto = no special_use = \Archive } } namespace { type = shared separator = / prefix = Shared/%%u/ location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%u subscriptions = yes list = children } root@mail-01:/etc/dovecot# cat dovecot-ldap.conf | sed "s/realdomain/mydomain/g" hosts = active-directory:389 ldap_version = 3 auth_bind = yes dn = domain\vmail dnpass = Str0ngP4ssw0rd base = ou=Organizational Unit,dc=domain,dc=com scope = subtree deref = never user_filter = (&(userPrincipalName=%n@domain.com)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_filter = (&(userPrincipalName=%n@domain.com)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) #user_filter = (&(mail=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) #pass_filter = (&(mail=%u)(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) pass_attrs = userPassword=password default_pass_scheme = CRYPT user_attrs = \ #=mail=master_user, \ #mail=user, \ =user=%Ln(a)mydomain.com, \ =home=/var/vmail/vmail1/mydomain.com/%Ln/Maildir/, \ =mail=maildir:/var/vmail/vmail1/mydomain.com/%Ln/Maildir/, \ maxStorage=quota_rule=*:bytes=%$ root@mail-01:/etc/dovecot# ls -al dovecot-master-users -r-x------ 1 dovecot dovecot 120 Nov 13 14:45 dovecot-master-users

3 3

Shared Mailboxes
by Yousif Alkhateeb 26 Nov '19

26 Nov '19

Hello, I have a mail server linked to Freeipa server, so all users are UNIX users. i want to share the inbox of one user to another, but i can't figure it out how to do it. this is my dovecot -n output # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 3.10.0-957.21.3.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) xfs # Hostname: mail.yousifrrr.com doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem doveconf: Warning: You can generate it with: dd if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dhparam -inform der > /etc/dovecot/dh.pem auth_default_realm = YOUSIFRR.COM auth_username_format = %n auth_worker_max_count = 60 default_client_limit = 10000 default_process_limit = 1500 disable_plaintext_auth = no first_valid_uid = 1000 login_trusted_networks = 10.1.5.0/24 mail_access_groups = sharedusers mail_location = maildir:/MailUsers/%u mail_plugins = acl mail_shared_explicit_inbox = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl metric imap_select_no { event_name = imap_command_finished fields = name filter { name = SELECT tagged_reply_state = NO } } namespace { list = yes location = maildir:/MailUsers/%u:INDEXPVT=/Mailusers/%u/shared/%%u prefix = shared/%%u/ separator = / subscriptions = yes type = shared } namespace inbox { inbox = yes list = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { driver = pam } plugin { acl = vfile acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db sieve = /MailUsers/%u/default.sieve sieve_before = /etc/dovecot/default.sieve sieve_default = /etc/dovecot/sieve/default.sieve sieve_dir = /MailUsers/%u/sieve/ sieve_global_dir = /etc/dovecot/default.sieve } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh protocols = imap pop3 lmtp sieve service dict { unix_listener dict { group = dovecot mode = 01402 user = dovecot } } service imap-login { inet_listener imap { port = 143 } } service imap { vsz_limit = 512 M } service lmtp { inet_listener lmtp { port = 24 } } service pop3-login { inet_listener pop3 { port = 0 } } ssl = required ssl_cert = </etc/pki/dovecot/certs/mail.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol lmtp { mail_plugins = acl } protocol lda { mail_plugins = acl } protocol imap { mail_plugins = acl imap_acl } the shared folder is not appearing in the users mailboxes. can you please help figure out why it's not working. Thanks in advance.

1 0

Health check curl example
by Marc Roos 25 Nov '19

25 Nov '19

I am not understanding how this health check[1] script should work. From the commandline it works fine when I type a PING I get a PONG. But how do I do a curl to this 5001 port? Tried something like this: bash-5.0# curl http://localhost:5001/ curl: (56) Recv failure: Connection reset by peer bash-5.0# curl http://localhost:5001/PING curl: (56) Recv failure: Connection reset by peer [1] https://doc.dovecot.org/admin_manual/health_check/

3 11

Lmtp logging, does not log
by Marc Roos 25 Nov '19

25 Nov '19

Looks like dovecot is not sending stuff to syslog anymore I am getting some message in /tmp/dovecot.log. However the lmtp log files are not even created. bash-5.0# doveconf | grep log_ auth_policy_log_only = no debug_log_path = deliver_log_format = msgid=%m: %$ doveadm_http_rawlog_dir = imapc_rawlog_dir = info_log_path = lmtp_proxy_rawlog_dir = /tmp/lmtp-proxy.log lmtp_rawlog_dir = /tmp/lmtp.log log_core_filter = log_debug = log_path = /tmp/dovecot.log log_timestamp = "%b %d %H:%M:%S " login_log_format = %$: %s login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c session=<%{session}> mail_index_log_rotate_max_size = 1 M mail_index_log_rotate_min_age = 5 mins mail_index_log_rotate_min_size = 32 k mail_index_rewrite_max_log_bytes = 128 k mail_index_rewrite_min_log_bytes = 8 k mail_log_prefix = "%s(%u)<%{pid}><%{session}>: " pop3c_rawlog_dir = rawlog_dir = submission_relay_rawlog_dir = syslog_facility = mail

1 0

proxy dual server setup clarification
by Marc Roos 25 Nov '19

25 Nov '19

I want to migrate mail users to a new environment. If I setup a new server next to the old server, and enable proxy on both. Is this then enough to migrate user by user with the passdb host=newsvr option to the new environment? Eg. I do not need to configure a director setup? I only need to enable proxy for imap and lmtp on both servers? (messages on the oldsvr will be proxied to the newsvr?)

2 2

Lmtp proxy help assertion failed: (conn->remote_port != 0
by Marc Roos 24 Nov '19

24 Nov '19

I have this in my 20-lmtp.conf file and created passdb-file, this should be enough to route a message to svr1? The port 24 is reachable from the proxy. bash-5.0# cat 20-lmtp.conf lmtp_proxy = yes protocol lmtp { # Space separated list of plugins to load (default is global mail_plugins). passdb { driver = passwd-file args = /etc/dovecot/special-passdb default_fields = proxy=y host=svr1 } } bash-5.0# cat /etc/dovecot/special-passdb test:password:1000:1000:(gecos):home:/bin/false:host=svr1

1 0

[Sieve] Multiple email recipients, how?
by Robert 24 Nov '19

24 Nov '19

Hi, First, I am very new to using Pigeonhole/Sieve with Dovecot and I am struggling with a problem which could be easy to solve but is just a lack of understanding on my end... We use a simple system for routing emails to different email users by postfixing the addresses with the actual user: xxxJohn@domain; yyyJohn@domain etc all will be delivered to user John. (This way John can invent a new email address on-the-fly and that will be delivered to his email box.) Delivering these emails to the right mailbox is easy: if address :contains "to" "John" ... All mail not matched will go to the general (catchall) mail box. The problem occurs when the email is sent to more addresses at the same domain. Eg. if an email is sent to xxxJohn@domain, zzzAlex@domain and info@domain Either, all emails also end up in the catch-all, or the email is delivered to the first matching rule only. I do not understand how to use the different TO addresses in the match rules. How can I determine that there are recipients other than xxxJohn or zzzAlex? Any help in pointing me in the right direction is appreciated! Robert

5 10

Virtual mailboxes: errors after renaming a folder
by André Rodier 24 Nov '19

24 Nov '19

Hello, I have a dovecot server, running fine, on Debian Stretch. Virtual folders are set up, and works correctly. For instance, I have Unread, All and Conversations, and everything works fine. However, when I rename a folder, I have error messages from Dovecot. For instance, I had a folder INBOX/Bills, which I renamed INBOX/Invoices. After that, I have these error messages: > The reported error was “Failed to select mailbox: Backend mailbox INBOX/Bills' added by another session. Reopen the virtual mailbox. (for backend mailbox Search/All) (0.000 + 0.000 secs).”. How can I avoid these errors, for instance, how can I rebuild the indexes every night or so? Kind regards, André

1 0

Dovecot proxy with ldap, complains about 'host not given'
by Marc Roos 24 Nov '19

24 Nov '19

It looks like the dovecot proxy can authenticate correctly but fails then on with this message Nov 23 23:33:33 test2 dovecot: pop3-login: Error: proxy: host not given: user=<test>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<LDTlHguYJth/AAAB> I have configured a host= in ldap for this user

3 4

chown(/var/dovecot/login/ipc-proxy
by Marc Roos 22 Nov '19

22 Nov '19

Can we remove/change this in the source? So we do not have to add the CAP_CHOWN with containers. chown(/var/dovecot/login/ipc-proxy) When run as root this has user dovenull, maybe this can be resolved by using a group dovenull? bash-5.0# ls -arlt total 4 srw-rw-rw- 1 root root 0 Nov 21 22:27 pop3 srw-rw-rw- 1 root root 0 Nov 21 22:27 login srw------- 1 dovenull root 0 Nov 21 22:27 ipc-proxy srw-rw-rw- 1 root root 0 Nov 21 22:27 imap drwxr-xr-x 1 dovecot dovecot 4096 Nov 21 22:27 .. drwxr-x--- 1 root dovenull 60 Nov 21 22:27 . Maybe this would work srw-rw---- 1 root dovenull 0 Nov 21 22:27 ipc-proxy

1 1

Virtual folder auto creation
by sergio 22 Nov '19

22 Nov '19

After switching on Virtual Plugin and configuring it as specified on https://doc.dovecot.org/configuration_manual/virtual_plugin/ the virtual folder is created for each user. Is it possible do not creater virtual folder automatically, only manually, for specific users? lda_mailbox_autocreate set to yes, but hope it's not related. -- sergio.

3 3

Lost quota, maildirsize with value S0
by grupodecorreo10 21 Nov '19

21 Nov '19

Hi,We have installed dovecot 2.2.22. we have servers as director dovecot and servers as dovecot backend. The mailboxes are estored in maildir format, over nfs (Emc Isilon).The problem we have is that sometimes some aleatory users loss her quota and the maildirsze show ilimited cuota, with S0 value in maildirsive file.The mails are stored in the mailboxes with maildrop and postfix, but we have done some test with postfix stoped. Only Dovecot openning the mailbox and the maildirsize is corrupted.I do not known where to look. We have configured dovecot with all the recomendarions for nfs.Thank you

1 0

virtual folder index logs
by sergio 21 Nov '19

21 Nov '19

A virtual folder is just really a saved search, but index log files are created. dovecot.list.index.log for the virtual folder itself and dovecot.index.log for all subfolders. Is it correct? Is it possible to disable index logs for virtual folder or it will only make dovecot worse? -- sergio.

1 0

Dovecot can't log in Virtual user - please help
by Andrej Rehak 20 Nov '19

20 Nov '19

Hello Im having issues login to dovecot using imap through telnet. Im running Linux 4.9.0-11-amd64 #1 SMP Debian 4.9.189-3+deb9u1 (2019-09-20) x86_64 GNU/Linux Im totally new to setting up mailservers. I havesetup a postfix for SMTP and it can receive emails. Postfix version is mail_version = 3.1.12 I have also installed Dovecot version:2.2.27 (c0f36b0) My configuration is such that POSTFIX is configured to use DOVECOT SASL through local socket. My system is configured to store emails in /var/mail/owndomain.org/<username>. For each domain i have my own passwd file where dovecot is supposed to lookup usernames and passwords. /var/mail/owndomain.org/passwd. I have created virtualuser for accessing mails and authenticating users. My dovecot (dovecot -n output) configuration is: ------------------------------------------------------------- # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-11-amd64 x86_64 Debian 9.11 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log disable_plaintext_auth = no info_log_path = /var/log/dovecot-info.log listen = 192.168.2.2 log_path = /var/log/dovecot.log mail_home = /var/mail/home/%d/%n mail_location = mbox:~/mail:INBOX=/var/spool/mail/%d/%n mail_privileged_group = virtualmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = username_format=%n /var/mail/%d/passwd driver = passwd-file } pop3_uidl_format = %g protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = dovecot } ssl = no userdb { driver = passwd } userdb { args = username_format=%n /var/mail/%d/passwd default_fields = uid=virtualmail gid=virtualmail home=/var/mail/%d/%n driver = passwd-file } verbose_proctitle = yes ---------------------------------------- Now the problem: I was testing the configuration using telnet. POSTFIX receives email, stores it. No problem. When i tried to log in onto Dovecot IMAP using Telnet i get this message: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH-LOGIN] Dovecot ready. a login "username(a)owndomain.org" "test" a NO [UNAVAILABLE] Internal error occured. Refer to server log for more information. I have enabled verbose logging and this is the output of logs: /var/log/dovecot.log had this message: Nov 16 14:20:49 auth: Error: plain(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): user not found from any userdbs Nov 16 14:20:49 imap: Error: Authenticated user not found from userdb, auth lookup id=684589057 (client-pid=9601 client-id=1) /var/log/dovecot-debug.log had this message: Nov 16 14:20:18 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Nov 16 14:20:18 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Nov 16 14:20:18 auth: Debug: auth client connected (pid=9601) Nov 16 14:20:47 auth: Debug: client in: AUTH 1 PLAIN service=imap session=RF4llXaXisPAqAmD lip=192.168.2.2 rip=192.168.9.131 lport=143 rport=$ Nov 16 14:20:47 auth-worker(9603): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Nov 16 14:20:47 auth-worker(9603): Debug: pam(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup service=dovecot Nov 16 14:20:47 auth-worker(9603): Debug: pam(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): #1/1 style=1 msg=Password: Nov 16 14:20:49 auth: Debug: passwd-file /var/mail/owndomain.org/passwd: Read 2 users in 0 secs Nov 16 14:20:49 auth: Debug: passwd-file(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup: user=username file=/var/mail/owndomain.org/passwd Nov 16 14:20:49 auth: Debug: client passdb out: OK 1 user=username(a)owndomain.org Nov 16 14:20:49 auth: Debug: master in: REQUEST 684589057 9601 1 a61dd67ee43390596ddf86e6c08db6f9 session_pid=9604 request_auth_token Nov 16 14:20:49 auth-worker(9603): Debug: passwd(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup Nov 16 14:20:49 auth: Debug: passwd-file(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup: user=username file=/var/mail/owndomain.org/passwd Nov 16 14:20:49 auth: Debug: master userdb out: NOTFOUND 684589057 And i am completelly clueless what is the problem. Because it seems as if the password was found but the user is not? Password and user are looked up in the same passwd file. Have i forgotten something to setup? Any help or guidance is appreciated! I have also posted the issue on: https://serverfault.com/questions/992108/dovecot-cant-login-virtual-user Thanks A.

2 3

ios12 clients not getting correct certificate, sni supported not? or config error?
by Marc Roos 20 Nov '19

20 Nov '19

I am having an ios12.4.1 client whine about access problems. He is getting the 'default' self signed ceritificate instead of the hostname alias. openssl s_client -servername mail.xxxxx.com -connect x.x.x.x:pop3s gives a 'Verify return code: 0 (ok)' I can't imagine this sni support is not available in recent versions. Should I remove this default certificate in the main section of 10-ssl.conf? These lines I have added to 10-ssl.conf ssl_cert = </etc/pki/tls/certs/mail-wildcard.crt ssl_key = </etc/pki/tls/private/mail-wildcard.key local 192.168.10.43 { ssl_key = </etc/pki/tls/private/xxxxxxx.local.key ssl_cert = </etc/pki/tls/certs/xxxxxxx.local.crt } local_name mail.xxxxx.com { ssl_key = </etc/pki/tls/private/mail.xxxxx.com.key ssl_cert = </etc/pki/tls/certs/mail.xxxxx.com.crt } local_name imap.xxxxxxx.net { ssl_key = </etc/pki/tls/private/imap.xxxxxxx.net.key ssl_cert = </etc/pki/tls/certs/imap.xxxxxxx.net.crt } [@ conf.d]# doveconf | egrep 'ssl_cert|ssl_key' ssl_cert = </etc/pki/tls/certs/mail-wildcard.crt ssl_cert_username_field = commonName ssl_key = # hidden, use -P to show it ssl_key_password = ssl_cert = </etc/pki/tls/certs/xxxxxxx.local.crt ssl_key = # hidden, use -P to show it ssl_cert = </etc/pki/tls/certs/mail.xxxxx.com.crt ssl_key = # hidden, use -P to show it ssl_cert = </etc/pki/tls/certs/imap.xxxxxxx.net.crt ssl_key = # hidden, use -P to show it

1 0

Error: Raw backtrace and index cache
by Maciej Milaszewski IQ PL 20 Nov '19

20 Nov '19

Hi I have "problem" with dovect 2.2.13 from repo debian8 and I don't know how to solve it ... Server is a virtual (kvm) with debian 8.11 (postfix + dovecot from repo) and storage is mounting via nfs (I have use only one dovecot with external storage) All works fine but sometime ( after a few hours ) I have got a problem with dovecot cache (i use indexes) logs -> http://paste.debian.net/1117072/ The store is mounted via nfs in /home/ index is local in /var/dovecot_indexes%h All go back to normal when i remove indexes like: find /var/dovecot_indexes/home/ -name 'dovecot*' -type f -delete but this is not good solution What am I doing wrong ? For tunning nfs in 10-mail.conf: --------- "mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h namespace inbox { inbox = yes } mmap_disable = yes dotlock_use_excl = no mail_fsync = always mail_nfs_storage = no mail_nfs_index = no lock_method = fcntl mail_temp_dir = /tmp mail_plugins = quota expire notify mail_log mailbox_idle_check_interval = 30 secs mail_temp_scan_interval = 1w maildir_very_dirty_syncs = no ------------- doveconf -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-9-amd64 x86_64 Debian 8.11 auth_mechanisms = plain login disable_plaintext_auth = no dotlock_use_excl = no lda_original_recipient_header = X-Original-To log_path = /var/log/dovecot/dovecot.mail133 mail_fsync = always mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h mail_plugins = quota expire notify mail_log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = ~/dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = %h/sieve sieve_global_dir = /var/lib/dovecot/sieve/ } protocols = " imap lmtp sieve pop3" service auth { unix_listener auth-master { group = users mode = 0666 user = virtual } unix_listener auth-userdb { group = users user = virtual } } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = virtual } service managesieve-login { inet_listener sieve { address = 127.0.0.1 94.124.15.58 port = 4190 } } ssl_ca = /etc/postfix/ssl/mail.maximail.pl.pem ssl_cert = </etc/postfix/ssl/mail.maximail.pl.pem ssl_key = </etc/postfix/ssl/mail.maximail.pl.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol lmtp { info_log_path = /var/log/dovecot/dovecot.mali133 lmtp_save_to_detail_mailbox = yes mail_plugins = quota sieve notify push_notification } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/dovecot/dovecot-lda.mail133 mail_plugins = sieve postmaster_address = root }

2 4

Junk virtual forder
by sergio 20 Nov '19

20 Nov '19

Is it possible to create a virtual folder that selects all mails with imap Junk flag (set by pigeonhole imap4flags' setflag "Junk")? -- sergio.

3 4

Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Hello, I have 2 Dovecot 2.3.8 servers running SSL with valid wildcard certificates. Email clients connect fine, https://www.immuniweb.com/ssl/ tests show certificates are ok. However I can't make replication work when I add ssl = yes. Without ssl it works ok. I added verbose_ssl in config and error log shows: dovecot: doveadm(149.x.x.x): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol >From the other server 149.x.x.x I tested with openssl: openssl s_client -connect 188.x.x.x:12333 -crlf -CAfile /etc/pki/tls/cert.pem CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Organization Validation Secure Server CA verify return:1 depth=0 C = FR, postalCode = 34980, ST = Occitanie, L = Montpellier, street = 123 Main str, O = My Company, OU = PremiumSSL Wildcard, CN = *.domain.com verify return:1 . . SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA384 Session-ID: 95CF7F07702A50CB7CDC5D478986B5A4682EA945C487E770550EE48BFEA53EBC Session-ID-ctx: Master-Key: ECC14F2EE03C04474992A651B3695D78A27A0B07529DB35F61F6FB5F5A5D51395432BDFF37F2 41BD4B3C4B9E1AB6A929 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574108251 Timeout : 300 (sec) Verify return code: 0 (ok) The configuration of the 2 servers below. 188.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: login.domain.com default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_replica = tcp:149.x.x.x:12333 sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap pop3 replication_full_sync_interval = 10 mins service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes local 91.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 91.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } 149.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: prime.domain.com auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_plugins = " notify replication" mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes setcred=yes failure_show_msg=yes dovecot driver = pam } plugin { mail_replica = tcp:188.x.x.x:12333 } protocols = imap pop3 replication_full_sync_interval = 10 mins replication_max_conns = 11 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local 178.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 178.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } Your help will be great appreciated.

2 2

[SOLVED] Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Solved, thank you. TCPS was the issue. From: Aki Tuomi <aki.tuomi(a)open-xchange.com> Sent: Wednesday, November 20, 2019 08:54 To: Miro Igov <miro.igov(a)gmail.com>; dovecot(a)dovecot.org Subject: Re: Doveadm replicator ssl issues On 18.11.2019 22.30, Miro Igov via dovecot wrote: Hello, I have 2 Dovecot 2.3.8 servers running SSL with valid wildcard certificates. Email clients connect fine, https://www.immuniweb.com/ssl/ tests show certificates are ok. However I can't make replication work when I add ssl = yes. Without ssl it works ok. I added verbose_ssl in config and error log shows: dovecot: doveadm(149.x.x.x): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol >From the other server 149.x.x.x I tested with openssl: openssl s_client -connect 188.x.x.x:12333 -crlf -CAfile /etc/pki/tls/cert.pem CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Organization Validation Secure Server CA verify return:1 depth=0 C = FR, postalCode = 34980, ST = Occitanie, L = Montpellier, street = 123 Main str, O = My Company, OU = PremiumSSL Wildcard, CN = *.domain.com verify return:1 . . SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA384 Session-ID: 95CF7F07702A50CB7CDC5D478986B5A4682EA945C487E770550EE48BFEA53EBC Session-ID-ctx: Master-Key: ECC14F2EE03C04474992A651B3695D78A27A0B07529DB35F61F6FB5F5A5D51395432BDFF37F2 41BD4B3C4B9E1AB6A929 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574108251 Timeout : 300 (sec) Verify return code: 0 (ok) The configuration of the 2 servers below. 188.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: login.domain.com default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_replica = tcp:149.x.x.x:12333 sieve = file:~/sieve;active=~/.dovecot.sieve <file://~/sieve;active=~/.dovecot.sieve> } protocols = imap pop3 replication_full_sync_interval = 10 mins service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes local 91.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 91.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } 149.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: prime.domain.com auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_plugins = " notify replication" mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes setcred=yes failure_show_msg=yes dovecot driver = pam } plugin { mail_replica = tcp:188.x.x.x:12333 } protocols = imap pop3 replication_full_sync_interval = 10 mins replication_max_conns = 11 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local 178.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 178.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } Hi! You need to use tcps in mail_replica. Aki

1 0

[SOLVED] Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Solved, thank you! TCPS was the problem. Hi! You need to use tcps in mail_replica. Aki

1 0

http API for IMAP
by Thomas Güttler 20 Nov '19

20 Nov '19

10 22