- dovecot - dovecot.org

crash on authentication to 2.3.21
by Eugene M. Zheganin 09 Feb '25

09 Feb '25

Hello, I'm trying to move a dovecot mail server from a remote Cpanel VPS to my site. I've set up the dovectot to my knowledge, but as soon as I try to authenticate, I got a crash: ===Cut=== Feb 9 11:15:12 freebsd dovecot[89257]: imap-login: Login: user=<gluck(a)kimlab.link>, method=CRAM-MD5, rip=92.255.139.77, lip=49.12.36.80, mpid=545, session=<O6+RtLMt1iBc/4tN> Feb 9 11:15:12 freebsd dovecot[89257]: imap(gluck(a)kimlab.link)<545><O6+RtLMt1iBc/4tN>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Feb 9 11:15:12 freebsd dovecot[89257]: imap(gluck(a)kimlab.link)<545><O6+RtLMt1iBc/4tN>: Fatal: master: service(imap): child 545 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps) ===Cut=== Thhe only reference I've fount to this error is that it seems to be an issue in 2.3.17, but I have 2.3.21 version, so I think there's something in my config. I've also hhave a bunch of old maildirs and I tried to do a force-resync on 'em, but that didn't help. Here's my config: ===Cut=== # 2.3.21.1 (d492236fa0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: FreeBSD 14.2-RELEASE amd64 # Hostname: mail.kimlab.link auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 scram-sha-1 scram-sha-256 default_client_limit = 40963 default_process_limit = 10240 disable_plaintext_auth = no first_valid_gid = 143 first_valid_uid = 143 hostname = mail.kimlab.link mail_gid = 143 mail_home = /var/imap/%d/%n mail_location = maildir:~/ mail_uid = 143 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace { inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace { location = maildir:/var/imap/%d/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = scheme=PLAIN username_format=%u /usr/local/etc/dovecot/users driver = passwd-file master = yes pass = yes } plugin { acl = vfile acl_shared_dict = file:/var/db/dovecot/shared-mailboxes fts = squat fts_autoindex = yes fts_squat = partial=4 full=10 quota = maildir:User quota quota_rule = *:storage=50G quota_rule2 = Trash:storage=+10%% quota_rule3 = Spam:storage=+20%% quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_after = /var/imap/sieve/sieve-after sieve_before = /var/imap/sieve/sieve-before/spam.sieve sieve_default = /var/imap/sieve/default.sieve sieve_dir = /var/imap/%d/%n/sieve sieve_global_dir = /var/imap/sieve sieve_max_script_size = 1M } postmaster_address = postmaster(a)kimlab.link protocols = imap pop3 lmtp sieve service auth { client_limit = 62464 unix_listener /var/imap/private/auth { group = dovecot mode = 0660 user = dovecot } unix_listener auth-userdb { group = dovecot mode = 0660 user = dovecot } } service imap-login { client_limit = 10000 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 10240 process_min_avail = 1 service_count = 0 vsz_limit = 512 M } service imap { drop_priv_before_exec = yes process_limit = 10240 } service lmtp { unix_listener lmtp { group = dovecot mode = 0660 user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = dovecot } user = dovecot } service stats { unix_listener stats-writer { group = dovecot mode = 0660 user = dovecot } } ssl_cert = </usr/local/etc/nginx/tls.d/kimlab.link.pem ssl_key = # hidden, use -P to show it syslog_facility = local6 userdb { args = username_format=%u /usr/local/etc/dovecot/users default_fields = uid=dovecot gid=dovecot home=/var/imap/%d/%n driver = passwd-file } protocol lmtp { mail_plugins = " quota acl sieve" } protocol lda { mail_plugins = " quota acl sieve" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 512 mail_plugins = quota imap_quota fts fts_squat } ===Cut=== here's my obfuscated users passdb file: ===Cut=== gluck@kimlab.link:{PLAIN}XXXXXXXXX:::::: emz@kimlab.link:{PLAIN}XXXXXXXXX:::::: ===Cut=== I'm totally open to any ideas. I can provide coredumps as well, but I tend to think that's something obvious since I have very little experience with dovecot. Thanks. Eugene.

2 1

suggestion: Argon2id example in `doveadm pw` examples
by Sean McBride 09 Feb '25

09 Feb '25

Hi all, It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... The docs here are very good: https://doc.dovecot.org/main/core/man/doveadm-pw.1.html but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet… So it would be nice to have an example corresponding to best practices, showing use of argon2id. I could attempt a PR on GitHub if you'd like. Cheers, Sean

1 0

how to set pop3_deleted_flag for one mailbox (email address)?
by krzf83＠gmail.com 08 Feb '25

08 Feb '25

How to set pop3_deleted_flag for one (email address)? I've tried using extra_fields in userdb. pop3_deleted_flag seems to be ignored there. It makes no sense for pop3_deleted_flag be to be global setting and yet it seems to be so.

2 2

Writing custom sieve plugins and extensions
by mb-dovecot＠mailroom.meme 08 Feb '25

08 Feb '25

I am a pretty heavy user of Sieve, and one of the services where I have extensive Sieve scripts is Protonmail. For my own mailserver setup, Dovecot's sieve-test has been excellent. I have a library of example email messages, and my own tooling setup for being able to test whether a given change has broken anything else unintentionally. If it does, I can trace the decision tree. With protonmail this has severe limitations. Most of those scripts apply expire, and what the expire is can change as it passes through the filters. But I cannot test any of that with sieve-test because that extension is unique to them. I always have to strip it out of sieve first, and that doesn't help me understand what's happening. I have some software engineering experience, so I was poking around at the pigeonhole source code, but since it's really focused on the RFC (understandably) there doesn't seem to be a friendly on-ramp to creating a one-off extension. What I'd really like to do though is make some kind of custom extension to sieve-test specifically which would allow the user to define custom vendor plugins/modules and appropriate messages. After all, I don't need sieve-test to know how to expire a message, I just need it to not throw an error on the extension when it's loaded, and to inform me in the output that it would have applied the expire action to a given message with a given value. I suspect the easiest way to do that is with a stubbed out extension that can handle that, but I'm open to other approaches that might work.

2 1

Dovecot v2.4.0 released
by Aki Tuomi 07 Feb '25

07 Feb '25

Hi all, after a very long wait we are finally happy to release Dovecot v2.4.0! Some IMPORTANT things to notice: - We have changed the signing key for 2.4 going forward, releases are signed with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219, which can be found at https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 and is signed with the previous key. The old key has been renamed to https://repo.dovecot.org/DOVECOT-REPO-GPG-2.3. - New 2.4 packages **are not** compatible with old 2.3 configuration, please carefully review https://doc.dovecot.org/2.4.0/installation/upgrade/2.3-to-2.4.html before installing the new packages. - We are happy to provide experimental arm64 support in the form of a Docker image. - Docker images are now ran rootless, with UID 1000 as vmail using built sources. Please take this into consideration when upgrading. Latest 2.3 image can be used with tag 2.3-latest, if you are not ready for this change. We won't be sending separate mail about Pigeonhole anymore as we will release one anyways when we release Dovecot, and Pigeonhole versioning has been changed to match Dovecot versioning. Source codes available at - https://www.dovecot.org/releases/2.4/dovecot-2.4.0.tar.gz - https://www.dovecot.org/releases/2.4/dovecot-2.4.0.tar.gz.sig - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.0.tar.gz - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.0.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- Dovecot Core NEWS ----------------- * config: dovecot_config_version must be the first non-comment line in configuration file. * config: dovecot_storage_version must be in the configuration file. * config: Many configuration options have changed so old configuration files do not work without rewrite. See https://doc.dovecot.org/main/installation/upgrade/2.3-to-2.4.html * config: New variable expansion syntax has been introduced, see https://doc.dovecot.org/main/core/settings/variables.html * config: Some default settings have changed. * config: plugin {} section has been removed. * *-login: With ssl=required, connections from login_trusted_networks are now also required to be SSL/TLS encrypted. * acl: Use ACL settings instead of Global ACL Directories. * auth-worker: auth_worker_max_count is replaced with service auth-worker { process_limit }. * auth: Weak password schemes are disabled by default, use auth_allow_weak_schemes to enable them. * auth_debug, mail_debug: Use log_debug filter instead. * config: All sections require a name, for example passdb/userdb: passdb static { password=secret } * db2: Remove Berkeley DB support. * dict-memcached: This is removed, use Redis instead. * director: Feature has been removed. See potential replacement at https://github.com/dovecot/tools/blob/main/director.lua * doveadm: USER environment variable is only supported with --no-userdb-lookup. One of -u, -F or -A must be used otherwise. * doveconf: Option -n is now default when running doveconf. * dsync: Use doveadm sync instead, legacy symlink has been removed. * fs-sis: Feature is now deprecated and has been made read-only. It will be removed in future release. * fts-lucene, fts-squat: These have been removed, use fts-flatcurve or fts-solr instead. * imap-login: IMAP compression is now handled in proxies. * imap_quota: SETQUOTA / quota_set has been removed. * imap_zlib: This plugin is no longer needed, it's always enabled. * imapc: All features are enabled by default, imapc_features can be used to explicitly disable features that are not wanted. * lib-storage: mbox driver is now frozen. * mail_compress: XZ and LZMA algorithm support has been removed. * mailbox-alias: Plugin has been removed. * old_stats, auth_stats: These have been removed. * openssl: Minimum supported version of OpenSSL is now 1.1.1. * openssl: Add support for OpenSSL 3.x * quota-dict, quota-dirsize: These have been removed, use quota-count instead. You can use quota_clone to copy quota usage to some database. * replicator: Feature has been removed. Use NFS or some other shared filesystem instead, or run doveadm sync in crontab. * stats: The bytes_in and bytes_out field in several events have been renamed as net_in_bytes and net_out_bytes. * zlib: Renamed to mail_compress plugin. + Experimental SMTPUTF8 and IMAP UTF8=ACCEPT support has been added. Needs --enable-experimental-mail-utf8 configure option and mail_utf8_extensions=yes setting. + Long running mail commands can be aborted with Ctrl-C / doveadm kick. + auth: LDAP driver now supports multi-value attributes. + auth: Add support for SCRAM-SHA-1-PLUS and SCRAM-SHA-256-PLUS. + auth: Add support for TLS channel binding. + auth: Support sending JA3 hash to policy server. + configure: Detect latest Lua version. + *-login: Support for TLS Server Name has been improved to allow pre-login settings. For example capabilities to be changed based on TLS Server Name. + *-login: Support for TLS ALPN has been added, connections with mismatching application are now refused. Missing ALPN is accepted. + fts-flatcurve: New Xapian based FTS plugin has been added. + imap: Support for INPROGRESS untagged messages as per RFC 9585. + lib-lua: Expose Dovecot DNS client. + lib-lua: Expose Dovecot HTTP client. + lib-sasl: Support SCRAM-SHA mechanisms. + lmtp: SNI support has been added which allows settings to be applied based on TLS Server Name. + sqlite: Support WAL mode. + stats: Submetric name size has been increased. + submission: Add submission_add_received_header setting to protect sender identity by suppressing the Received: header. - Many bugs have been fixed. Pigeonhole NEWS --------------- * Change configuration syntax to match new Dovecot configuration syntax. * vacation: Reduce default days to 60 from infinity * vacation: vacation_max_period=0 is now an error. * Version has been changed to match Dovecot version. + Added i;unicode-casecmp comparator. - Lots of bugs have been fixed.

19 44

Dovecot 2.4 quota_storage_size override from userdb not working
by Andreas Oster 06 Feb '25

06 Feb '25

Hello, I am currently trying to migrate my Dovecot 2.3 server to version 2.4. Unfortunately I do not seem to get the basic per user quota to work. I am using LDAP for userdb and have used the "Override: LDAP" example from https://doc.dovecot.org/2.4.0/core/plugins/quota.html as a starting point. ( By the way, there is an error in the example: % is missing in front of "{ldap:quotaBytes}B" ) I have set the LDAP field according to my setup and validated with "doveadm auth test username" that the correct value is returned. In my case I get "quota_storage_size=3G" but this does not override the default value of 1G from the global quota config file: quota "User quota" { storage_size = 1G } Can someone please help with this issue ? Thank you very much. -- Best regards Andreas Oster

1 0

question from a newbie
by Zane B Stein 06 Feb '25

06 Feb '25

My mail was hosted by a site that no longer handles email. I asked them if they could send me a file with all my emails in it and they said sure. I was thinking maybe I would get something I could import into Outlook such as a .pst or .ost file, or perhaps a .csv file. What I received was a zipped file and when I opened it there were a bunch of folders with emails in them in some strange format (each one with a . in front of it, such as .NEWMAIL ), plus a bunch of files along with the folders such as dovecat.index, dovecatindex.cache, dovecot.index.log2, dovecot.list.inex, divecot.mailbox and others with a dovecot prefix, plus one called maildirsize and one called subscriptions. I have no idea how to read the emails in this format. Can someone tell me how I can access the emails in this set of files? Feel free to ask if you need more information before you can answer. If I need a special program to read the files, is there an easy one available that is user friendly for someone with no experience with dovecot files? Thank you. Zane B Stein

5 7

solved my problem
by Zane B Stein 06 Feb '25

06 Feb '25

In my initial post I questioned, as a newbie, how to access the email files I was given that were in dovecot format, and a few people were kind enough to explain things to me a bit. But some of the solutions were a bit over my head. And then I found a solution. I downloaded an app called "SysTools Maildir Converter" and was able to convert the whole email file into a .pst file, and input it in Outlook. Now all my emails are accessible, and I can reply to them like any other emails in Outlook. The only thing I don't exactly understand is that each folder I had with emails in it has a subfolder called "cur" and that is where all the emails reside. It is not an issue, just not sure exactly why that is so. (If someone has an idea why the emails are in "cur" subfolders rather than directly in the folders, and can explain it to me without getting super technical, that would be great. But it isn't a big deal, I'm just curious.) Zane

2 1

Preventing message deletion
by dovecot＠iotti.biz 06 Feb '25

06 Feb '25

Hi all How may I disable message deletions via IMAP for some or all of my users? I read on the net that a possible solution would be to use the ACL IMAP plugin. But the examples I found were not so clear to me. We do not use shared mailboxes or namespaces. Only simple virtual users, each with it's own private mailbox. I would like to use the global acl file both for administration simplicity and because as I understood, global acl enrties take preference over any user setting. In the ACL page example there is a line: * user=foo lrw But in the comment it tells that doing so, every user' mailbox would be shared with the foo user, with the lrw permissions. Which is not what I would want. I don't need to share anything, just to restrict what the user, foo here, can do on his mailbox. Thank you, Luigi

2 3

Replicator Crash
by Kent Borg 05 Feb '25

05 Feb '25

I have replicator working well enough…to crash: > Jan 28 11:26:12 la dovecot[1187]: replicator: Panic: data stack: Out > of memory when allocating 268435496 bytes > Jan 28 11:26:12 la dovecot[1187]: replicator: Error: Raw backtrace: #0 > t_askpass[0x7fa59db0c0] -> #1 backtrace_append[0x7fa59db374] -> #2 > backtra\ > ce_get[0x7fa59db510] -> #3 execvp_const[0x7fa59e7ba4] -> #4 > i_syslog_fatal_handler[0x7fa59e8510] -> #5 i_panic[0x7fa5936808] -> #6 > t_pop_pass_str\ > [0x7fa59e0eb4] -> #7 connection_deinit[0x7fa59e6430] -> #8 > pool_datastack_create[0x7fa5a0e7b0] -> #9 > array_bsearch_insert_pos_i[0x7fa59d46d0] -> \ > #10 t_base64_scheme_decode[0x7fa59dcb24] -> #11 > buffer_append[0x7fa59dd3d0] -> #12 replicator_queue_push[0x556e8f4f40] > -> #13 replicator_brain_in\ > it[0x556e8f53e4] -> #14 _start[0x556e8f3d70] -> #15 > _start[0x556e8f3f04] -> #16 io_loop_call_io[0x7fa5a02f20] -> #17 > io_loop_handler_run_internal\ > [0x7fa5a05450] -> #18 io_loop_handler_run[0x7fa5a05680] -> #19 > io_loop_run[0x7fa5a05944] -> #20 master_service_run[0x7fa59684b0] -> > #21 main[0x55\ > 6e8f3930] -> #22 __libc_init_first[0x7fa57676d0] -> #23 > __libc_start_main[0x7fa5767780] -> #24 _start[0x556e8f3b80] > Jan 28 11:26:12 la dovecot[1187]: replicator: Fatal: master: > service(replicator): child 1185 killed with signal 6 (core dumps > disabled - https://\ > dovecot.org/bugreport.html#coredumps) This is on Debian 12. > # dovecot --version > 2.3.19.1 (9b53102964) There are gigabytes of free RAM, though it says it is trying to allocate 268,435,496 bytes--on the stack--and that does seem wrong in any case. The Maildir being synced is over 430MB, is that too much for dsync?? Suggestions? Thanks, -kb

3 4