- dovecot - dovecot.org

Empty response with userFile from doveadm HTTP API
by lab＠403.sk 18 Jun '21

18 Jun '21

Hi, I must be doing something terribly wrong, but I am not able to get a non empty response from doveadm HTTP API when using userFile parameter. E. g. in getQuota or search command. Single user or wildcard working as expected. ./doveadm_cli.py --apikey $key --apiurl http://localhost:8180/doveadm/v1 (doveadm) quotaGet userFile=/tmp/f [] Results: 0 cat /tmp/f box1(a)domain.tld box2(a)domain.tld Result with plain cURL is exactly the same. curl -X POST http://localhost:8180/doveadm/v1 -H "Content-Type: application/json" -H "Authorization: X-Dovecot-API xxx" -d '[["quotaGet",{"userFile":"/tmp/f"},"tag1"]]' [["doveadmResponse",[],"tag1"]] Doveadm binary has no problem of reading that file. In a debug log I can see request finishes after "Handling LIST request" and does not jump to "Handling USER request" as in doveadm (binary) case. Am I missing something? dovecot: doveadm(::1): Executing command quota get dovecot: doveadm: Debug: auth-master: userdb list: Started listing users (user_mask=*) dovecot: doveadm: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb: Connecting dovecot: doveadm: Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=13811,uid=0): Client connected (fd=8) dovecot: doveadm(::1): Debug: auth-master: userdb list: Finished listing users dovecot: doveadm(::1): Debug: auth-master: conn unix:/var/run/dovecot/auth-userdb (pid=13811,uid=0): Disconnected: Connection closed (fd=8) dovecot: auth: Debug: master in: LIST#0111#011user=* dovecot: doveadm(::1): doveadm: ::1 - - "POST /doveadm/v1 HTTP/1.1" 200 77 "http://localhost:8180/doveadm/v1" "python-requests/2.6.0 CPython/2.7.5" dovecot: auth-worker(13875): Debug: Loading modules from directory: /usr/lib64/dovecot/auth dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/lib20_auth_var_expand_crypt.so dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_mysql.so dovecot: auth-worker(13875): Debug: Module loaded: /usr/lib64/dovecot/auth/libdriver_sqlite.so dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): Server accepted connection (fd=15) dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): Sending version handshake dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: Handling LIST request dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): Performing userdb lookup dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): SELECT email AS user FROM mailbox WHERE active=1 dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: sql(*): Finished userdb lookup dovecot: auth-worker(13875): Debug: conn unix:auth-worker (pid=13839,uid=97): auth-worker<1>: Finished doveconf -n # 2.3.14 (cee3cbc0d): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.14 (1b5c82b2) # OS: Linux 3.10.0-862.2.3.el7.x86_64 x86_64 CentOS Linux release 7.5.1804 (Core) # Hostname: xxx auth_debug = yes auth_mechanisms = plain login cram-md5 auth_verbose = yes default_client_limit = 6000 default_process_limit = 512 disable_plaintext_auth = no doveadm_api_key = # hidden, use -P to show it mail_debug = yes mail_home = /h/v/%d/%n mail_location = maildir:~/Maildir mail_plugins = quota managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox "Deleted Items" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Items" { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = type = private } passdb { args = /etc/dovecot/local-sql.conf driver = sql } plugin { quota = maildir quota_grace = 10M quota_rule2 = Kos:storage=+100M quota_rule3 = Trash:storage=+100M quota_rule4 = Deleted Messages:storage=+100M quota_status_nouser = DUNNO quota_status_overquota = 552 5.2.2 Mailbox is full quota_status_success = DUNNO sieve = file:~/sieve;active=~/.dovecot.sieve } service auth-worker { idle_kill = 30 secs } service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0660 user = postfix } unix_listener auth-userdb { mode = 0600 user = vmail } } service doveadm { client_limit = 1 inet_listener http { address = localhost port = 8180 } process_min_avail = 1 unix_listener doveadm-server { mode = 0600 user = vmail } user = vmail } service imap-login { process_limit = 4096 process_min_avail = 10 service_count = 1 } service imap { process_limit = 4096 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = vmail } service pop3-login { client_limit = 2048 } service quota-status { client_limit = 1 executable = quota-status -p postfix process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-quota-status { group = postfix mode = 0600 user = postfix } user = vmail } ssl_ca = </etc/pki/tls/cert.pem ssl_cert = </etc/pki/o/default.pem ssl_cipher_list = HIGH:!aNULL:!SSLv2:!ADH:!EXP:!eNULL:!RC4:!MEDIUM:!LOW ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { driver = prefetch } userdb { args = /etc/dovecot/local-sql.conf driver = sql } verbose_proctitle = yes protocol lmtp { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 50 mail_plugins = quota imap_quota } Kind regards, Libor

1 0

Question Regarding The 'poolp' Guide On How To Deploy A Mail Server's Last Portion Regarding Dovecot With 'sieve' Scripts
by Samuel Banya 18 Jun '21

18 Jun '21

Hello everyone, I've been following the "poolp" guide on how to deploy an email server on OpenBSD: - https://poolp.org/posts/2019-09-14/setting-up-a-mail-server-with-opensmtpd-… I'm currently at the very end of the guide in which he is using sieve with Dovecot to do some final filtering. The unfortunate thing is that when I run these two commands in the '/usr/local/lib/dovecot/sieve' directory: sievec report-ham.sieve sievec report-spam.sieve I'm getting the following error: # sievec report-ham.sieve report-ham: line 1: error: require command: unknown Sieve capability `vnd.dovecot.pipe'. report-ham: line 1: error: require command: unknown Sieve capability `imapsieve'. report-ham: line 15: error: unknown command 'pipe' (only reported once at first occurrence). report-ham: error: validation failed. sievec(root): Fatal: failed to compile sieve script 'report-ham.sieve' # sievec report-spam.sieve report-spam: line 1: error: require command: unknown Sieve capability `vnd.dovecot.pipe'. report-spam: line 1: error: require command: unknown Sieve capability `imapsieve'. report-spam: line 7: error: unknown command 'pipe' (only reported once at first occurrence). report-spam: error: validation failed. sievec(root): Fatal: failed to compile sieve script 'report-spam.sieve' What's interesting is that this same post has the same exact error, and I tried his workaround which did NOT work unfortunately: - http://dovecot.2317879.n4.nabble.com/sieve-compile-error-td70414.html This is what was present BEFORE my changes in ' plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_name = Inbox imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve } This is what was present AFTER my changes in '/etc/dovecot/conf.d/90-plugin.conf' (aka I followed this post's workaround http://dovecot.2317879.n4.nabble.com/sieve-compile-error-td70414.html) plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_global_extensions = +vnd.dovecot.environment +vnd.dovecot.debug +vnd.dovecot.pipe imapsieve_mailbox1_name = Junk imapsieve_mailbox1_causes = COPY APPEND imapsieve_mailbox1_before = file:/usr/local/lib/dovecot/sieve/report-spam.sieve imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Junk imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve imapsieve_mailbox3_name = Inbox imapsieve_mailbox3_causes = APPEND imapsieve_mailbox3_before = file:/usr/local/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/local/lib/dovecot/sieve } Any ideas on what I can do? Please let me know if this is better suited for the OpenSMTPD mailing list instead though.

1 0

Multiple non-plaintext mechanisms using multiple passdbs.
by Jesús Ángel del Pozo Domínguez 17 Jun '21

17 Jun '21

Hi there, Although I have set up TLS in my Dovecot installation, I would like to also set up some non-plaintext authentication mechanism, specifically CRAM-MD5 and SCRAM-SHA-1. As I read in the documents, "The problem with non-plaintext auth mechanisms is that the password must be stored either in plaintext, or using a mechanism-specific scheme that’s incompatible with all other non-plaintext mechanisms". I will not be storing the user's passwords in plaintext, so I will have to use different mechanism-specific hash schemes. I was wondering whether it would be possible to have several auth databases, one for each non-plaintext mechanism. Well, in reality, I will have just one database with multiple hashes: SHA512-CRYPT, CRAM-MD5 and SCRAM-SHA-1 but then I am going to set up three different passdb instances in dovecot, each one with its own SQL configuration. For example: passdb { driver = sql args = /etc/dovecot/dovecot-sql-plain.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-cram-md5.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext } Most users would use TLS and PLAIN as authentication mechanism so the last two password databases will not be used at all. However, those users using CRAM-MD5 or SCRAM-SHA-1 would try the other databases. My users table would be somewhat like this: CREATE TABLE users ( username VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(77) NOT NULL, password_cram_md5 VARCHAR(74) NOT NULL, password_scram_sha_1 VARCHAR(100) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL, active CHAR(1) DEFAULT 'Y' NOT NULL ); username: foo(a)bar.com domain: bar.com password: {SHA512-CRYPT}$6$Mih5.y90z...CqxX2LxfMJMqoC42NvBK1 password_cram_md5: {CRAM-MD5}a457...2a74f63442e7473e9576cf2e password_scram_sha_1: {SCRAM-SHA-1}4096,4...9AYjadouwXqiqc3UM= Obviously, the SQL query in each dovecot-sql-....ext file would be different. For instance: /etc/dovecot/dovecot-sql-plain.conf.ext default_pass_scheme = SHA512-CRYPT password_query = \ SELECT username, domain, password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-cram-md5.conf.ext default_pass_scheme = CRAM-MD5 password_query = \ SELECT username, domain, password_cram_md5 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext default_pass_scheme = SCRAM-SHA-1 password_query = \ SELECT username, domain, password_scram_sha_1 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' Could you please tell me whether this set up would work? Do you believe is worth the complexity or maybe I had better keep it more simple and use just PLAIN auth with TLS? Cheers, Jesús Ángel

1 0

Mapping usernames used for authentication to UNIX usernames
by Frank Volf 17 Jun '21

17 Jun '21

Hi, I'm looking for some advice or pointers how to best solve a small problem that I have. I have no doubt that this can be done in dovecot, but I'm struggling to find the easiest way to implement it. First of all, what I have: I have a relative small dovecot setup for a dozen domains, and about 50 users in total. All users use IMAP to retrieve mail, and SMTP submission protocol to submit email. Because of the small size, every user has its own UNIX account, authentication is done using PAM and mail is stored in a Maildir folder in their home directory. Works perfectly! There is one minor inconvenience. When a new mail client is configured, users (often guided by the auto config generator of the mail client) tend to use their email address as the username to authenticate instead of their UNIX account name, which fails of course. Would it be possible to configure something that will map an email address to the UNIX account name and use the account name for authentication and obtaining the related information (uid, gid, home dir)? I do have two concerns: 1) I do not want to break existing mail configurations, so authentication with the UNIX username should still be possible. 2) I cannot do a simple reg. exp for the translation because every email domain has e.g. an info(a)domain.com mailbox, and I do not want them all to go to UNIX user "info". As said, I would appreciate any advice on how this can be configured the easiest. Thanks in advance. Kind regards, Frank

4 3

Re: N-way replication, multiple masters
by Henry 17 Jun '21

17 Jun '21

1 GB data per day is very little volume ,I think dovecot replication, rsync also suitable. Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:30:23 [GMT+8] 寫道： #yiv6469694122 #yiv6469694122 -- _filtered {} _filtered {} _filtered {} _filtered {} _filtered {}#yiv6469694122 #yiv6469694122 p.yiv6469694122MsoNormal, #yiv6469694122 li.yiv6469694122MsoNormal, #yiv6469694122 div.yiv6469694122MsoNormal {margin:0cm;font-size:11.0pt;font-family:sans-serif;}#yiv6469694122 a:link, #yiv6469694122 span.yiv6469694122MsoHyperlink {color:blue;text-decoration:underline;}#yiv6469694122 span.yiv6469694122EmailStyle19 {font-family:sans-serif;color:#1F497D;font-weight:normal;font-style:normal;}#yiv6469694122 .yiv6469694122MsoChpDefault {font-size:10.0pt;} _filtered {}#yiv6469694122 div.yiv6469694122WordSection1 {}#yiv6469694122 Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond From: Henry <hl1723(a)yahoo.com.hk> Sent: Thursday, 17 June 2021 3:20 PM To: Raymond Sellars <raymond.sellars(a)orionhealth.com> Subject: Re: N-way replication, multiple masters How many data for mail replication ? and the link speed? Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:10:23 [GMT+8] 寫道：

1 0

N-way replication, multiple masters
by Raymond Sellars 17 Jun '21

17 Jun '21

Hi Looking for some guidance on how to setup a dovecot cluster with more than 2 servers. Ideally as multiple masters so I don't have the complexity of back recovery/synchronisation in failover situations. And I can utilised upstream load balancers (director or other) to automatically move between available nodes. Current pattern is: High availability at one site (AWS availability zone) with two active servers behind dovecot directors and an AWS network load balancer in front of the directors. A third dovecot server as a disaster recovery instance (another availability zone or region), with ideally real time and bidirectional replication. Behind a different network and NLB access path. Dovecot --version = 2.3.14 Centos 7 Previously for the HA pair we utilised NFS but the AWS EFS equivalent doesn't perform ( very high latency and NFS meta data caching required). And then for DR we utilised the dovecot replication. 2 way so I have automated recovery and could do active active testing/verification as required with no down time. This help verify recovery pathways. https://doc.dovecot.org/configuration_manual/replication/# - reading the documentation is seems clear that replication only supports a PAIR of masters. Any ideas on how I can add in a 3rd replication node? Two pairs? I'm happy to utilise a star pattern. HA 1 <-> HA2, HA 1 <-> DR. Not possible? Can I run more than one replicator? Or should I utilise doveadm sync via cron jobs and 2-way sync. Any thoughts, suggestions most welcome. How are others achieving > 2 clusters for dovecot servers supporting the same domain? Most of this is for availability rather than purely performance scaling. Thanks Raymond

1 0

working locally not externally, how to check what failed?
by Voytek Eymont 17 Jun '21

17 Jun '21

this morning I noticed not getting any email on remote to server mail client, though, in webmail/squirellmail on mail host there were new emails restarting with doveadm stop/dovecot 'fixed it' what could've gone wrong, what to look for in the logs ? thanks for any pointers long running dovecot/postfix/mysql setup dovecot --version 2.3.14 (cee3cbc0d)

1 0

Piping to doveadm pw
by Kevin N. 16 Jun '21

16 Jun '21

Hello everybody, I am using 'doveadm pw' from inside a bash script to generate the salted hash for a user provided password. I call it like: doveadm pw -s SHA256-CRYPT -u $user -p $password Is there any possible way to use piping (so it won't show up in ps for example) to pass the username and password to 'doveadm pw' instead of using arguments? Dovecot version: 2.3.14 Many thanks, Kevin

3 4

LMTP with hardlinks ?
by Vladislav Kurz 16 Jun '21

16 Jun '21

Hello, I'm looking for deduplication of mails via hardlinks during delivery. I.e. a mail that is sent to multiple recipients (to, cc, bcc) should be stored only once. I did some search and found only some non-complete information. dovecot-lda has a "-p path" option that does the delivery using symlinks if possible (i.e. same uid/gid and same filesystem). This is working by hand, but could not find any hints how to use this with postfix. Found only suggestion of a wrapper, that was probably never implemented - in this thread: https://dovecot.org/pipermail/dovecot/2008-June/031158.html In this message: https://dovecot.org/list/dovecot/2013-February/088540.html there is statement that: LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. I was not able to get this in my setup, and I'd like to know if this statement is really true. I have all mail in /var/vmail, all owned by vmail user, but still mail delivered to multiple users is duplicated. If this is really supposed to make hardlinks (which would be great), is there any way to debug it? E.g. see if the hardlink was attempted but failed for some reason, or if the message was delivered in the same LMTP session ? -- Best Regards Vladislav Kurz

1 1

lda to lmtp
by Laura Steynes 14 Jun '21

14 Jun '21

Hi, Although dovecot-lda serves us fine, we only average 8k messages an hour, peaking at 11k, over 4 machines (mostly for redundancy, we've run this fine on just 1 machine, but sometimes clamav makes things get upset, so we added some more especially since we are growing rapidly, we decided to see if lmtp would be of benefit, so far, we cant tell any difference, I guess it is only 120-130 messages a minute, maybe if we were doing 200 a minute we might see gain? The question is with lda we used postfix settings destination_recipient_limit=1, we have not added this with lmtp,is this needed?

6 9