- dovecot - dovecot.org

Occasional service disruptions
by Nikolaos Milas 08 Jun '22

08 Jun '22

Hello, On a server with (Postfix and) Dovecot 2.3.18 (on a VM running CentOS 7 - 1 CPU, 5 GB RAM) with the config you will see below, we are facing occasional (infrequent) service disruptions: IMAP service seems unavailable to some users. Jun 6 12:01:25 vweb2 roundcube: <1eecb0d4> IMAP Error: Login failed for imaptester against vmail2.noa.gr from 195.251.202.xxx. Could not connect to ssl://vmail2.noa.gr:993: Connection rejected in /var/webs/webmail/rcube/program/lib/Roundcube/rcube_imap.php on line 211 (POST /?_task=login&_action=login) At that time there was no associated logged event in dovecot log. (Other users are logging in and out.) However, I see some warnings (I list the two of them closest to the above event): Jun 06 12:01:22 imap(user1)<29639><Vr0atcPg5M3BXBCl>: Warning: Inotify instance limit for user 500 (UID vmail) exceeded, disabling. Increase /proc/sys/fs/inotify/max_user_instances ... Jun 06 12:01:26 imap(user2)<29793><rZuSt8PgztoKyVSG>: Warning: Inotify instance limit for user 500 (UID vmail) exceeded, disabling. Increase /proc/sys/fs/inotify/max_user_instances (In above log excerpts I've only modified real usernames.) Restarting Dovecot returns things back to normal. I have tried to use "service_count = 100" in all configured services, to see how it goes. Most of the config is inherited from the past (older versions) and is not optimized. For example one can observe different "process_limit" values for different services, for no apparent reason I am aware of. Could anyone suggest changes and/or additions to the OS and/or Dovecot to resolve this issue? Any additional suggestions will also be welcome. Thanks in advance for your kind assistance. Here is the config (I've only changed postmaster address): ======================================================================= protocols = imap pop3 sieve lmtp login_greeting = Dovecot NOA ICXC-NIKA log_path = /var/log/dove.log mail_location = maildir:~/Maildir/ mail_gid = 500 mail_uid = 500 auth_mechanisms = plain login auth_username_format = %Ln auth_verbose = no auth_debug = no mail_debug = no disable_plaintext_auth = no mail_plugins = quota mail_log notify protocol imap { imap_client_workarounds = "delay-newmail" mail_plugins = quota imap_quota mail_log notify mail_max_userip_connections = 400 namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = quota notify pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %08Xu%08Xv namespace inbox { mailbox Trash { autoexpunge = 15d } } } protocol lda { auth_socket_path = /var/run/dovecot/auth-master mail_plugins = quota notify sieve postmaster_address = xxxxxxxxx(a)noa.gr sendmail_path = /usr/lib/sendmail } protocol lmtp { auth_socket_path = /var/run/dovecot/auth-master postmaster_address = xxxxxxxxx(a)noa.gr mail_plugins = quota notify sieve sendmail_path = /usr/lib/sendmail } protocol sieve { managesieve_max_line_length = 65536 mail_max_userip_connections = 10 managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 10 } userdb { args = /etc/dovecot/dovecot-usrdb-ldap.conf driver = ldap } passdb { args = /etc/dovecot/dovecot-passdb-ldap.conf driver = ldap } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename flag_change save mailbox_create mail_log_fields = uid box msgid size flags vsize from subject quota = maildir:User quota quota_rule = *:storage=15G quota_rule2 = Trash:storage=+3%% quota_warning = storage=75%% quota-warning 75 %u quota_warning2 = storage=90%% quota-warning 90 %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_max_script_size = 0 sieve_max_actions = 0 sieve_max_redirects = 2 } service quota-warning { executable = script /opt/mail1.sh user = vmail unix_listener quota-warning { user = vmail } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } user = root } service imap-login { service_count = 100 vsz_limit = 64 M process_limit = 500 } service pop3-login { service_count = 100 vsz_limit = 64 M } service managesieve-login { inet_listener sieve { port = 4190 } service_count = 100 process_min_avail = 0 vsz_limit = 64M } service managesieve { process_limit = 1024 } service imap { executable = imap postlogin process_limit = 2048 } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl = yes ssl_cert = </etc/pki/tls/certs/star_noa_gr-cert-with_CA-rev-754868755.crt ssl_key = </etc/pki/tls/private/star_noa_gr-1243437.key namespace inbox { separator = . prefix = inbox = yes mailbox Drafts { special_use = \Drafts auto = subscribe } mailbox Junk { special_use = \Junk auto = subscribe } mailbox Trash { special_use = \Trash auto = subscribe } mailbox Sent { special_use = \Sent auto = subscribe } } ======================================================================= Nick

3 4

Distros based on OpenSSL 3 fail on lib-dcrypt/test-crypto
by Sloane Bernstein 08 Jun '22

08 Jun '22

Hello, I am getting our Dovecot packages preliminarily ready to support Linux distributions which rely on OpenSSL 3. I notice that even the main dev branch will build, but the test suite fails (among other places) at test_password_change in src/lib-dcrypt/test-crypto.c: -- [root@al9 lib-dcrypt]# ./test-crypto test_cipher_test_vectors ............................................. : ok test_cipher_aead_test_vectors ........................................ : ok test_hmac_test_vectors ............................................... : ok test_load_v1_keys .................................................... : ok test_load_v1_key ..................................................... : ok test_load_v1_public_key .............................................. : ok test_load_v2_key ..................................................... : ok test_load_v2_public_key .............................................. : ok test_get_info_v2_key ................................................. : ok test_gen_and_get_info_rsa_pem ........................................ : ok test_get_info_rsa_private_key ........................................ : ok test_get_info_invalid_keys ........................................... : ok test_get_info_key_encrypted .......................................... : ok test_get_info_pw_encrypted ........................................... : ok test-crypto.c:827: Assert failed: ret == TRUE Panic: file dcrypt-openssl.c: line 2636 (dcrypt_openssl_private_to_public_key): assertion failed: (priv_key != NULL && pub_key_r != NULL) Error: Raw backtrace: ./test-crypto(backtrace_append+0x42) [0x445332] -> ./test-crypto(backtrace_get+0x1e) [0x44544e] -> ./test-crypto() [0x42414b] -> ./test-crypto() [0x424181] -> ./test-crypto() [0x412b69] -> .libs/libdcrypt_openssl.so(+0x5f25) [0x7fb61954df25] -> ./test-crypto() [0x41cd9a] -> ./test-crypto() [0x4200af] -> ./test-crypto(test_run+0x4c) [0x420c5c] -> ./test-crypto(main+0x4b) [0x41717b] -> /lib64/libc.so.6(+0x44e50) [0x7fb6195a3e50] -> /lib64/libc.so.6(__libc_start_main+0x7c) [0x7fb6195a3efc] -> ./test-crypto(_start+0x25) [0x417295] Aborted (core dumped) -- Looking at how various distros handle this test failure when building packages, they all seem to apply the same patch developed by Red Hat to get this test to pass, attached to https://bugzilla.redhat.com/show_bug.cgi?id=1962035: -- diff -up dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c.opensslv3 dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c --- dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c.opensslv3 2021-06-03 18:56:52.573174433 +0200 +++ dovecot-2.3.14/src/lib-dcrypt/dcrypt-openssl.c 2021-06-03 18:56:52.585174274 +0200 @@ -73,10 +73,30 @@ 2<tab>key algo oid<tab>1<tab>symmetric algo name<tab>salt<tab>hash algo<tab>rounds<tab>E(RSA = i2d_PrivateKey, EC=Private Point)<tab>key id **/ +#if OPENSSL_VERSION_MAJOR == 3 +static EC_KEY *EVP_PKEY_get0_EC_KEYv3(EVP_PKEY *key) +{ + EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key); + EVP_PKEY_set1_EC_KEY(key, eck); + EC_KEY_free(eck); + return eck; +} + +static EC_KEY *EVP_PKEY_get1_EC_KEYv3(EVP_PKEY *key) +{ + EC_KEY *eck = EVP_PKEY_get1_EC_KEY(key); + EVP_PKEY_set1_EC_KEY(key, eck); + return eck; +} + +#define EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_EC_KEYv3 +#define EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_EC_KEYv3 +#else #ifndef HAVE_EVP_PKEY_get0 #define EVP_PKEY_get0_EC_KEY(x) x->pkey.ec #define EVP_PKEY_get0_RSA(x) x->pkey.rsa #endif +#endif #ifndef HAVE_OBJ_LENGTH #define OBJ_length(o) ((o)->length) -- I presume that either this patch or an equivalent is planned for eventual inclusion into upstream? -- Sloane Bernstein Developer I cPanel, L.L.C.

2 1

The meaning of "tarpit" as used in the auth policy docs?
by Hippo Man 08 Jun '22

08 Jun '22

I'm trying to understand what is meant by "tarpit" in the ffollowing quote of the Dovecot auth policy docs for the "before" check ... First query is done *before* password and user databases are consulted. This means that any userdb/passdb attributes are left empty. The command used here is ‘allow’ and will appear on the URL as command=allow. status result values: - -1: Reject - 0: Accept - (Any other positive value): *Tarpit for this number of seconds.* What actually happens if a positive status value is returned here? Does it mean that the client will not receive any response for the given number of seconds, but that the given login attempt will still continue after that delay? Or does it mean that the client will not receive a response for the given number of seconds, and then the login will be rejected after that delay? What if the client has connected via pop3 and is sending multple "user" and "pass" combinations? If the "before" check returns, for example, the integer "5" as the status, does this mean there will be a 5-second delay between each login attempt that is being sent to this connection? Ideally, I'd like the following to occur, but I don't know if it is possible: * Client connects via pop3 and intends to send a large batch of "user"/"pass" commands via this connection. * The first "user"/"pass" command is made to wait for many seconds. * Then, the connection is dropped, so that the subsequent "user"/"pass" commands do not even hit the dovecot server. I'm thinking that this is *not* what is meant by "tarpit" in the auth policy docs, correct? Thank you for any clarification. -- hippoman(a)gmail.com Take a hippopotamus to lunch today.

2 1

Extremely long line
by Dmitriy Fitisov 07 Jun '22

07 Jun '22

Hello everyone, I’m using https://github.com/karastojko/mailio <https://github.com/karastojko/mailio> to get messages from dovecot-2.3.7.2 (3c910f64b) and 1 of the messages which is 2.5 mbytes in size and has an image attached, has a half megabyte of <80> (0x80) characters at the end. And that is with default encoding of 7 bit (meaning there is no part headers at the end), right after the message those characters. I got a feeling that max length was 998 characters. On other hand, looks like dovecot is replacing NULL chars with 0x80. Is that is correct behavior, should I expect that half meg of bytes in 1 line? Is it a known issue? Thank you. Dmitriy

2 1

Sieve configuration for roundcube
by Jeremy Hansen 07 Jun '22

07 Jun '22

Any pointers to get dovecot configured with sieve for Roundcube filters? Things I’ve found through search seem a bit all over the place. I’m using CentOS 8/Rocky Linux hosts. Thanks

4 6

Hiding imap account and still using it for outgoing email
by Hippo Man 07 Jun '22

07 Jun '22

I'm using dovecot 2.3.18 with a fairly recent version of postfix on my Debian-11 box. I have a question, and I'm not sure whether it pertains to dovecot, postfix, or both. I'm asking first here, but I'm glad to go to a postfix forum if it turns out that my question doesn't pertain to dovecot. On my server, account management in both dovecot and postfix is managed by the same mysql database, and postfix is configured to use dovecot's authentication mechanism. I have an email address which I do not want to be seen as one which can be accessed for imap nor pop3. However, I want to receive email to that address, and I, myself, still do want to be able to use imap or pop3 in order to access email that is sent to that address. I have something I want to try in order to accomplish this, but before I do, I want to make sure that no one can see any issues or "gotchas" with the following approach, or perhaps that there is an easier, more straightforward way to accomplish what I want to do: Assume the email address in question is "myemail(a)domain.com", and assume that I own and manage the "domain.com" domain. (1) Create another email address called "other(a)domain.com", and set it up with the same configuration as is currently set up for "myemail(a)domain.com" (2) In all my email clients, set the outgoing mail address and reply-to address for "other(a)domain.com" to be "myemail(a)domain.com". This way, all outgoing email from "other(a)domain.com" will look like it is being sent from "myemail(a)domain.com". (3) Change "myemail.com" (in the database used by dovecot and postfix) from being a bona-fide email address into becoming simply a forwarding email alias for "other(a)domain.com". (4) In all my email clients, change the inbox that I previously used for "myemail(a)domain.com" to now be associated with "other(a)domain.com". So ... if anyone sends email to "myemail(a)domain.com", it will automatically go to the "other(a)domain.com" inbox. And when I reply to those emails, the sender and reply-to addresses will still be "myemail(a)domain.com". And now, dovecot will no longer see "myemail(a)domain.com" as a mailbox from which email can be retrieved. And I will still be able to retrieve that email via imap or pop3 from the "other(a)domain.com" account. Do you folks think this will work? And again, is there perhaps a simpler way to accomplish this? Thank you in advance for any thoughts and suggestions. -- hippoman(a)gmail.com Take a hippopotamus to lunch today.

1 1

Random behavior with sieve extprograms
by Thomas Sommer 04 Jun '22

04 Jun '22

Hi I have a random behavior with dovecot and sieve extprograms. Here is my sieve file: require ["fileinto", "vnd.dovecot.pipe", "copy", "imap4flags"]; # rule:[DABS] if header :contains "X-Original-To" "dabs(a)mydomain.ch" { pipe "sieve-dabs-execute.sh"; setflag "\\Seen"; fileinto "acme.DABS"; stop; } Emails matching the condition are processed by a laravel (php) artisan command. See service sieve-pipe-script below. The exit code of this php command is 0. I randomly get the following in my postfix logs: Sieve thinks that the command failed, but the email was always processed correctly. In that case I get a copy in my Inbox. I'm wondering what could be the cause for this random behavior. My guess is that approximately 70% are processed correctly, 30% is as below. May 31 13:50:38 star dovecot[99425]: lda(user)<99425><kma+MC4dlmJhhAEAzJBnyA>: sieve: msgid=<62961d1c.5y4hr0Vqi97JFnyb%DABS.zsmsvp02(a)example.com>: fileinto action: stored mail into mailbox 'acme.DABS' May 31 13:50:39 star dovecot[99425]: lda(user)<99425><kma+MC4dlmJhhAEAzJBnyA>: sieve: msgid=<62961d1c.5y4hr0Vqi97JFnyb%DABS.zsmsvp02(a)example.com>: stored mail into mailbox 'INBOX' May 31 13:50:39 star dovecot[99425]: lda(user)<99425><kma+MC4dlmJhhAEAzJBnyA>: sieve: Execution of script /home/user/sieve/.dovecot.sieve failed, but implicit keep was successful (user logfile /home/user/sieve/.dovecot.sieve.log may reveal additional details) .dovecot.sieve.log: sieve: info: started log at May 31 13:50:39. error: failed to pipe message to program `sieve-dabs-execute.sh': refer to server log for more information. [2022-05-31 13:50:39]. It's weird. "failed to pipe message to program" is simply not true. The command was processed correctly. Any ideas where to look for clues or how to debug this? Regards Thomas config: # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: Linux 5.17.5-x86_64-linode154 x86_64 Ubuntu 20.04.4 LTS auth_mechanisms = plain login auth_username_format = %n auth_verbose = yes mail_location = maildir:~/Maildir mail_plugins = " quota" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vnd.dovecot.pipe vnd.dovecot.execute namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { quota = fs:User quota quota_grace = 1%% quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = file:~/sieve;active=~/sieve/.dovecot.sieve sieve_execute_socket_dir = sieve_extensions = +vnd.dovecot.pipe +vnd.dovecot.execute sieve_pipe_exec_timeout = 30s sieve_pipe_socket_dir = sieve_plugins = sieve_extprograms sieve_redirect_envelope_from = recipient sieve_trace_debug = no sieve_trace_dir = ~/sieve/trace sieve_trace_level = matching } protocols = imap sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service quota-status { client_limit = 1 executable = /usr/lib/dovecot/quota-status -p postfix inet_listener { address = 127.0.0.1 port = 8881 } } service sieve-pipe-script { executable = script /usr/bin/php /srv/www/mydomain/status/artisan dabs:processEmail unix_listener sieve-dabs-execute.sh { mode = 0660 user = user } user = www-data vsz_limit = 512 M } ssl = required ssl_cert = </etc/letsencrypt/live/star.mydomain.ch/fullchain.pem ssl_cipher_list = AES128+EECDH:AES128+EDH ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes userdb { driver = passwd } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = " quota sieve" postmaster_address = postmaster(a)mydomain.ch quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { mail_max_userip_connections = 20 mail_plugins = " quota mail_log notify imap_quota" }

2 4

dovecot 2.3.19 source tarball build failed
by Dmitriy Fitisov 03 Jun '22

03 Jun '22

Hello all again, building from 2.3.19 src tarball on Darwin Kernel Version 21.5.0: Tue Apr 26 21:08:29 PDT 2022; root:xnu-8020.121.3~4/RELEASE_ARM64_T8101 arm64 got failure: ioloop-notify-kqueue.c:70:2: error: implicit declaration of function 'i_gettimeofday' is invalid in C99 [-Werror,-Wimplicit-function-declaration] i_gettimeofday(&ioloop_timeval); ^ ioloop-notify-kqueue.c:70:2: note: did you mean 'gettimeofday'? /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/sys/time.h:197:9: note: 'gettimeofday' declared here int gettimeofday(struct timeval * __restrict, void * __restrict); ^ 1 error generated. Not sure what is a proper way to report patches. Seem source generated by bison? Anyway, just added one liner added to src/lib/ioloop-notify-kqueue.c: 13a14 > #include "time-util.h” Builds fine. Thank you. Dmitriy

2 2

Openmetrics label truncation
by Daniel Sabotta 03 Jun '22

03 Jun '22

Hello, I'm using dovecot 2.3.18 and want to collect metrics with prometheus via openmetrics. I need to label the metrics with the destination host name. The configuration works fine, but the label value is truncated after 32 chars (and a '...' is added). My config: service stats { inet_listener http { port = 9323 } } metric my_metric { filter = event=smtp_client_transaction_finished group_by = dest_host status_code } I wrote a simple patch, that fixes that for me: diff --git a/src/stats/stats-metrics.c b/src/stats/stats-metrics.c index 877c142546..30126563ff 100644 --- a/src/stats/stats-metrics.c +++ b/src/stats/stats-metrics.c @@ -357,7 +357,7 @@ stats_metric_sub_metric_alloc(struct metric *metric, const char *name, pool_t po array_append_zero(&fields); sub_metric = stats_metric_alloc(pool, metric->name, metric->set, array_idx(&fields, 0)); - sub_metric->sub_name = p_strdup(pool, str_sanitize_utf8(name, 32)); + sub_metric->sub_name = p_strdup(pool, str_sanitize_utf8(name, 63)); array_append(&metric->sub_metrics, &sub_metric, 1); return sub_metric; } Why are labels truncated after 32? Is there a reason I do not see? I found no reasons in the openmetrics specification [1]. Thanks in advance Daniel

2 2

Restrict IMAP login, but allow Postfix SASL
by lutz.niederer＠gmx.net 03 Jun '22

03 Jun '22

Hi, we have a very simple user-/passdb (like passwd) to authenticate virtual IMAP users. We also use this for Postfix authentication. Nothing special. But, we need to exclude some of the users from IMAP login. This means, some users should be allowed to send mail via Postfix (submission) and therefore authenticate via SASL against dovecot successfully, but they should not be allowed to login to their IMAP mail box. How could this be done? Thanks! -lutzn

9 9