- dovecot - dovecot.org

RHEL 8 key import error
by Gioele Pannetto 08 Sep '25

08 Sep '25

Hi, I'm having issues while installing Dovecot 2.4 on a Rocky Linux 8.10 server. This server was running Dovecot 2.3 but I wanted to upgrade it to 2.4. This is my repo file: [dovecot-2.4-latest] name=Dovecot 2.4 RHEL $releasever - $basearch baseurl=https://repo.dovecot.org/ce-2.4-latest/rhel/$releasever/RPMS/$basea… gpgkey=https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 gpgcheck=1 enabled=1 When I run dnf update I get a GPG error: Problem opening package dovecot-2.4.1-4.x86_64.rpm Problem opening package dovecot-lua-2.4.1-4.x86_64.rpm Problem opening package dovecot-mysql-2.4.1-4.x86_64.rpm The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED If I try to import the key manually with rpm --import https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 I get: error: https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4: key 1 import failed. I also tried it on a fresh Rocky Linux 8.10 installation and I get the same exact error, but running it on Rocky Linux 9.6 works just fine. This is my gpg --version on RHEL 8.10: gpg (GnuPG) 2.2.20 libgcrypt 1.8.5 Copyright (C) 2020 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: /root/.gnupg Supported algorithms: Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2 Any help is appreciated. Thanks! -- Gioele Pannetto

6 8

Is it possible to use literal %2F inside a dovecot.http.client request url?
by hmmmz1000＠gmail.com 07 Sep '25

07 Sep '25

Hello, I'm using dovecot (2.3) lua with dovecot.http.client but I need the request url to have an url encoded slash (/) as %2F (or %2f) but if I enter for example https://test.com/%2F/test it looks like it changes it to a slash (https://test.com///test) in the http debug log (also the request fails as it's not %2F). I've also tried with %252F to encode the % but that doesn't change at all (keeps being %252F) & also tried with %%2F and \%2F but that gets the errors "Expecting hex digit after '%', but found '%'" for %%2F and "invalid escape sequence" for \%2F. Does anyone have an idea how to solve this or if it's even possible?

2 1

2.3 to 2.4 /proc/self/io) failed: Permission denied
by Don Bowman 06 Sep '25

06 Sep '25

I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes I have a dovecot system running in my kubernetes cluster that i use to gateway some emails to imap that are in turn used by systems that poll for email. No people are involved. Its been running for sometime on 2.3, i've now updated the base container to 2.4 and i have two problems, perhaps related, perhaps not. I'm assuming its related to my config changes for 2.4, but I'm kind of at my wits end. The first issue: Sep 06 15:05:31 imap(support)<443><YIobSSM+MMoKIAIr>: Debug: open(/proc/self/io) failed: Permission denied (euid=1001(support) egid=1001(support) missing +r perm: /proc/self/io) I am seeing errors like this. I can't figure why. I tried "doveadm force-resync -u support /home/support/Maildir/" and it returns no errors. The 2nd error, again, perhaps related, the user doing the poll for new email doesn't see it (despite I see the email delivered to the 'new' dir, it doesn't get picked up and moved to 'cur'). Below is my config file. In /home/support/Maildir i have the new, cur, tmp etc. There's no mention of 'INBOX', which i think my previous had (mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir was previous) Any advice? I'm not sure where to go from here. dovecot_config_version = 2.4.1 dovecot_storage_version = 2.4.1 auth_mechanisms = plain login auth_allow_cleartext = yes #disable_plaintext_auth = no mail_privileged_group = mail #mail_location = maildir:/home/%u/Maildir:INBOX=/var/mail/%u/Maildir mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir userdb passwd { fields { home = /home/{%user | username} mail_driver = maildir mail_path = /var/mail/{%user | username}/Maildir mail_inbox_path = /var/mail/%{user | username}/Maildir } } passdb pam { service_name = dovecot } protocols = " imap" namespace inbox { inbox = yes mailbox Trash { auto = subscribe # autocreate and autosubscribe the Trash mailbox special_use = \Trash } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } } ssl=yes ssl_server_cert_file = /run/ca/tls.crt ssl_server_key_file = /run/ca/tls.key log_path = /tmp/dc.log mail_debug = yes ssl_min_protocol = TLSv1.2 log_debug = category=email # verbose_ssl=yes #auth_verbose=yes #auth_debug=yes

1 0

Help: Sharing IMAP folder from a mdbox mailbox to a maildir mailbox
by Zhang Huangbin 05 Sep '25

05 Sep '25

Dear all, I'm configuring Dovecot 2.4.1 with per-user mailbox format support, but cannot get user shared mailbox working between different mailbox formats. - Account mdbox(a)domain.com is a mdbox format mailbox, access with webmail is ok. - Account maildir(a)domain.com is a maildir format mailbox, access with webmail is ok. - mdbox@ shares its Sent folder to maildir@ with Roundcube webmail, grants all privileges (`akxeilprwts`). The result is maildir@ cannot see the shared folder. - No error reported in Dovecot log file. - mysql logs the queries performed to get user shared mailbox, i ran the query manually and it returns correct result like this: ``` MariaDB [vmail]> SELECT dummy,from_user FROM share_folder WHERE to_user = 'maildir(a)domain.com' \G *************************** 1. row *************************** dummy: 1 from_user: mdbox(a)domain.com ``` dovecot.conf snippet attached below. I think the "mail_*" parameters inside `namespace shared {}` block are incorrect to handle mixed mailbox formats because it hard-codes the mail_driver and mail_path, tried all possible parameters i can imagine, but failed. Thanks for helping. :) # ------------------------ mail_plugins { acl = yes ... } protocol imap { mail_plugins { imap_acl = yes ... } ... } mail_driver = %{userdb:mail_driver | default("maildir") | lower} mail_path = %{userdb:mail_path | default("~/Maildir")} sql_driver = mysql mysql 127.0.0.1 { port = ... dbname = ... user = ... password = ... } userdb sql { # ... omit other lines ... query = SELECT \ LOWER('%{user | lower}') AS master_user, \ LOWER(CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir)) AS home, \ mailbox.mailboxformat AS mail_driver, \ CONCAT("~/", mailbox.mailboxfolder) AS mail_path, \ CONCAT('*:bytes=', mailbox.quota*1048576) AS quota_rule \ FROM ... } namespace shared { type = shared separator = / prefix = Shared/$user/ subscriptions = yes list = children mail_driver = maildir mail_path = %{owner_home}/Maildir mail_index_private_path = ~/Maildir/shared/%{owner_user} # not share the index files between users mail_index_path = ~/Maildir/shared/%{owner_user} } acl_driver = vfile acl_globals_only = no acl_sharing_map { dict proxy { name = acl } } dict_server { dict acl { driver = sql dict_map shared/shared-boxes/user/$to/$from { sql_table = share_folder value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } dict_map shared/shared-boxes/anyone/$from { sql_table = anyone_shares value_field dummy { } key_field from_user { value = $from } } } ... } # ------------------------

4 11

High Available (SoHo) dovecot setup using PVE+Ubuntu (+Docker)?
by Gerben Wierda 04 Sep '25

04 Sep '25

I currently run a HA postfix/dovecot setup that is failover behind a HAproxy. The two legs are a dovecot 2 on macOS (MacPorts) and a dovecot 2 on Ubuntu (PVE+Ubuntu+Docker), making the system somewhat antifragile. HA is realised via dovecot’s own syncing (which is not longer available in dovecot 3). This works OK. (In addition: there is rspamd as an important part of the setup, e.g. for DMARC). There are multiple virtual domains. Given that I have lost APNS (Apple Push Notification) as Apple has retired support for former Mac OS X Server users, there is not longer a reason to keep the macOS version running (apart from that antifragility thing, but that was more an added bonus). I am looking at moving to a different setup where the entire mail setup may move to a full Linux foundation. I am starting to look at future options (there is still time to actually create the setup somewhere the coming year or so. If I want to be future-dovecot proof, I need to move to HA for storage as dovecot syncing is deprecated. I wonder what my best way forward its, based on a 2 physical machine, PVE+Ubuntu+Docker setup. Build a HA NFSv4 cluster? Use Ceph? ZFS? Any tips, experiences, or ideas are welcome. Robustness/security/low-maintenance/own-your-own-data are my main objectives. I do not have high volumes, this is a setup for just a few users. G I currently run a HA postfix/dovecot setup that is failover behind a HAproxy. The two legs are a dovecot 2 on macOS (MacPorts) and a dovecot 2 on Ubuntu (PVE+Ubuntu+Docker), making the system somewhat antifragile. HA is realised via dovecot's own syncing (which is not longer available in dovecot 3). This works OK. (In addition: there is rspamd as an important part of the setup, e.g. for DMARC). There are multiple virtual domains. Given that I have lost APNS (Apple Push Notification) as Apple has retired support for former Mac OS X Server users, there is not longer a reason to keep the macOS version running (apart from that antifragility thing, but that was more an added bonus). I am looking at moving to a different setup where the entire mail setup may move to a full Linux foundation. I am starting to look at future options (there is still time to actually create the setup somewhere the coming year or so. If I want to be future-dovecot proof, I need to move to HA for storage as dovecot syncing is deprecated. I wonder what my best way forward its, based on a 2 physical machine, PVE+Ubuntu+Docker setup. Build a HA NFSv4 cluster? Use Ceph? ZFS? Any tips, experiences, or ideas are welcome. Robustness/security/low-maintenance/own-your-own-data are my main objectives. I do not have high volumes, this is a setup for just a few users. G

5 8

How to override mail_driver, mail_path, mail_index_path with SQL userdb
by Zhang Huangbin 04 Sep '25

04 Sep '25

Dear all, I'm migrating from Dovecot 2.3 to 2.4 on Debian 13, only one issue remains: How can i override global mail_driver, mail_path, mail_index_path parameters with a SQL userdb? I have these lines in dovecot.conf to use maildir format mailbox by default, also userdb and passdb with mariadb backend. We store mailbox format (e.g. "maildir", "mdbox", case insensitive) in SQL column `mailboxformat`, and mailbox folder name in `mailboxfolder` (e.g. "Maildir", "mdbox", case sensitive). I tried returning `mail_driver` + `mail_path`, or `userdb_mail_driver` + `userdb_mail_path`, neither works. So the question is, what should i return in userdb sql query to override global setting? Thanks for helping. :) # ------------------------------- mail_driver = maildir mail_path = ~/Maildir mail_index_path = ~/Maildir sql_driver = mysql mysql 127.0.0.1 { port = 3306 dbname = ... user = ... password = ... } userdb sql { iterate_query = ... query = SELECT \ LOWER('%{user | lower}') AS master_user, \ LOWER(CONCAT(mailbox.storagebasedirectory, '/', mailbox.storagenode, '/', mailbox.maildir)) AS home, \ LOWER(mailbox.mailboxformat) AS mail_driver, \ CONCAT("~/", mailbox.mailboxfolder) AS mail_path, \ CONCAT(LOWER(mailbox.mailboxformat), ":~/", mailbox.mailboxfolder) AS mail, \ CONCAT('*:bytes=', mailbox.quota*1048576) AS quota_rule \ FROM mailbox,domain \ WHERE ... } passdb sql { query = SELECT ... } # -------------------------------

1 1

Config Typos
by matthew1471＠matthew1471.co.uk 03 Sep '25

03 Sep '25

Hello, I submitted this issue to Debian with a patch https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112667 But I since found a lot of them have actually come directly from Dovecot via https://github.com/dovecot/tools/blob/main/dovecot-2.4.0-example-config.tar… which itself is referenced via https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html I see on that page "It's not being kept up-to-date afterwards".. so is there any interest in receiving corrections and if so where best to provide (Patch file is on the Debian page)? These are just typos, nothing breaking (although "# auth_username_format=%u" in auth-passwdfile.conf.ext if uncommented is of course incorrect and only in the Dovecot tools version, it's not in the Debian version). As an aside, I found on my instance (Debian 2.4.1-4 (7d8c0e5759)): root@IMAP:~# doveconf -d | grep -i sieve "sieve_script_path =" But the docs (https://doc.dovecot.org/2.4.1/core/plugins/sieve.html#sieve_script_path) state the default should be "~/sieve" This led to some funky "Leaked settings" errors: Sep 01 00:06:54 IMAP dovecot[5112]: sieve(x(a)x.co.uk)<5123><GEGcT7E9lfnAqAAD>: Error: sieve: file storage: Storage path cannot be empty for write access Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Error: Failed to open Sieve storage. Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-duplicate-common.c:36 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ntfy-mailto.c:166 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-variables-common.c:61 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-include-common.c:87 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-subaddress.c:75 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: ext-vacation-common.c:25 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Leaked settings: sieve.c:93 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e90507d38 leaked (parent=0x558e904ee688): sieve.c:84 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ee688 leaked (parent=0x558e904ed648): mail-user.c:90 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ed648 leaked (parent=0x558e904ec508): mail-storage-service.c:1088 Sep 01 00:06:54 IMAP dovecot[5112]: managesieve(5123): Warning: Event 0x558e904ec508 leaked (parent=(nil)): main.c:157 System is working well (and if the typos / inconsistencies aren't interesting then I completely understand), thank you for all your hard work. Kind Regards, Matthew

1 0

Segfault on dovecot reload
by Bogdan Vasilescu 03 Sep '25

03 Sep '25

Hi, While migrating my config from 2.3 to 2.4, I found out that if instance_name is set to any value (including the default 'dovecot') and I run "dovecot reload" twice, I get a segmentation fault. syslog: dovecot[18272]: segfault at 7fdd23b51442 ip 00007fdd237c4ac6 sp 00007ffd0420caa8 error 4 in libc-2.33.so[7fdd23742000+15e000] my config: # 2.4.1-4 (7d8c0e5759): /etc/dovecot/dovecot.conf # Pigeonhole version 2.4.1-4 (0a86619f) # OS: Linux 5.15.161-array x86_64 Slackware 15.0 # Hostname: my.host.name dovecot_config_version = 2.4.1 acl_defaults_from_inbox = yes acl_driver = vfile acl_globals_only = yes auth_cache_negative_ttl = 1 hour auth_cache_ttl = 1 hour auth_failure_delay = 3 secs auth_master_user_separator = * auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@* auth_verbose = yes base_dir = /var/run/dovecot/ debug_log_path = syslog default_client_limit = 640 default_process_limit = 128 default_vsz_limit = 256M deliver_log_format = %{message} [msgid=%{msgid}, size=%{size}] dovecot_storage_version = 2.4.1 first_valid_gid = 10000 first_valid_uid = 10000 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_logout_format = [session=<%{session}>, in=%{input}, out=%{output}] imap_max_line_length = 64k info_log_path = syslog last_valid_gid = 10999 last_valid_uid = 10999 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * login_greeting = IMAP/POP3 daemon login_log_format = %{message} %{elements} login_log_format_elements = [user=<%{user}> rip=%{remote_ip} lip=%{local_ip} session=<%{session}> method=%{mechanism} %{secured}] mail_log_prefix = "%{service}(%{user}): " mail_temp_scan_interval = 1 week mailbox_list_index_very_dirty_syncs = yes pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_logout_format = [session=<%{session}>, in=%{input}, out=%{output}] pop3_uidl_duplicates = rename protocols = imap lmtp pop3 rejection_reason = Your message to <%t> was automatically rejected:%n%r rejection_subject = Rejected: %s sieve_execute_bin_dir = /var/lib/dovecot/sieve sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.execute = yes } sieve_max_script_size = 1M sieve_pipe_bin_dir = /var/lib/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_redirect_envelope_from = sender sql_driver = mysql ssl_min_protocol = TLSv1 verbose_proctitle = yes ssl_server { cert_file = /etc/ssl/certs/server.pem cert_username_field = commonName dh_file = /var/lib/dovecot/dh.pem key_file = /etc/ssl/private/server.key prefer_ciphers = client request_client_cert = no require_crl = yes } namespace inbox { mail_driver = maildir mail_inbox_path = /srv/vhosts/%{user | domain}/mail/%{user}/INBOX mail_path = /srv/vhosts/%{user | domain}/mail/%{user} mailbox_list_layout = fs hidden = no inbox = yes list = yes prefix = separator = / subscriptions = yes type = private mailbox INBOX/* { acl "user=sysadmin(a)my.host.name" { rights = lrwstipekxa } } } maildir { broken_filename_sizes = yes copy_with_hardlinks = yes empty_new = no stat_dirs = no very_dirty_syncs = no } mbox { dirty_syncs = yes dotlock_change_timeout = 2 mins lazy_writes = yes lock_timeout = 5 mins md5 = all min_index_size = 0 read_locks = fcntl very_dirty_syncs = no write_locks = dotlock fcntl } mdbox { preallocate_space = no rotate_interval = 0 rotate_size = 10M } service imap-login { process_min_avail = 0 restart_request_count = 1 user = $SET:default_login_user vsz_limit = 256M inet_listener imap { port = 143 listen = 127.0.0.1 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { process_min_avail = 0 restart_request_count = 1 user = $SET:default_login_user vsz_limit = 256M inet_listener pop3 { port = 110 listen = 127.0.0.1 } inet_listener pop3s { port = 995 ssl = yes } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service imap { process_limit = 256 vsz_limit = 256M } service pop3 { process_limit = 256 vsz_limit = 256M } service auth { client_limit = 640 user = $SET:default_internal_user unix_listener auth-userdb { mode = 0666 } unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service auth-worker { user = $SET:default_internal_user } mysql 127.0.0.1 { dbname = vhosts password = # hidden, use -P to show it user = services } passdb sql { default_password_scheme = CRYPT driver = sql query = SELECT `u`.`password` AS `password`, '/srv/vhosts/%{user | domain }/mail/%{user}' AS `userdb_home`, `u`.`domain` AS `userdb_uid`, `u`.`domain` AS `userdb_gid` FROM `users` AS `u` LEFT JOIN `domains` AS `d` ON `u`.`domain` = `d`.`id` WHERE `u`.`user` = '%{user}' AND `u`.`enabled` = '1' AND FIND_IN_SET('U_%{protocol}', `u`.`permissions`) AND `d`.`enabled` = '1' AND FIND_IN_SET('U_%{protocol}', `d`.`permissions`) } passdb passwd:backup { auth_username_format = %{user} default_password_scheme = CRYPT driver = passwd-file passwd_file_path = /etc/dovecot/auth/passwd:backup } passdb passwd:master { auth_username_format = %{user} default_password_scheme = CRYPT driver = passwd-file master = yes result_success = continue passwd_file_path = /etc/dovecot/auth/passwd:master } userdb sql { driver = prefetch } userdb passwd:backup { auth_username_format = %{user} passwd_file_path = /etc/dovecot/auth/passwd:backup driver = passwd-file } userdb passwd:master { auth_username_format = %{user} passwd_file_path = /etc/dovecot/auth/passwd:master driver = passwd-file fields { master_user = %{user} } } protocol imap { mail_max_userip_connections = 10 mail_plugins { acl = yes } } protocol pop3 { mail_max_userip_connections = 10 mail_plugins { acl = yes } } protocol lda { mail_plugins { sieve = yes } } protocol lmtp { mail_plugins { sieve = yes } } sieve_script backup { driver = file path = /var/lib/dovecot/sieve/backup_%{user | username }.sieve type = personal } mailbox INBOX/Spam { sieve_script spam { cause = copy path = /var/lib/dovecot/sieve/learn_spam.sieve type = before } } imapsieve_from INBOX/Spam { sieve_script ham { cause = copy path = /var/lib/dovecot/sieve/learn_ham.sieve type = before } } mailbox INBOX/Junk { sieve_script spam { cause = copy path = /var/lib/dovecot/sieve/learn_spam.sieve type = before } } imapsieve_from INBOX/Junk { sieve_script ham { cause = copy path = /var/lib/dovecot/sieve/learn_ham.sieve type = before } } auth_policy { check_after_auth = no check_before_auth = yes hash_mech = sha256 hash_nonce = # hidden, use -P to show it hash_truncate = 12 log_only = no reject_on_fail = no report_after_auth = no request_attributes { device_id = %{client_id} fail_type = %{fail_type} login = %{requested_username} protocol = %{protocol} pwhash = %{hashed_password} remote = %{remote_ip} session_id = %{session} } server_url = http://127.0.0.1/authpolicy/ } Thanks, Bogdan

3 2

update-apt-xapian-index on trixie fails
by Graham Eddy 03 Sep '25

03 Sep '25

update-apt-xapian-index relies upon module ‘imp’ that was removed from python 3.12 onwards, so fails with dovecot on trixie. updating /usr/lib/python3/dist-packages/axi/indexer.py by replacing imp.load_module per https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp, plus installing module ’six’, seems to fix it. i look forward to the proper fix to xapian-index. cheers ⊣GE⊢ update-apt-xapian-index relies upon module `imp' that was removed from python 3.12 onwards, so fails with dovecot on trixie. updating /usr/lib/python3/dist-packages/axi/indexer.py by replacing imp.load_module per [1]https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp, plus installing module 'six', seems to fix it. i look forward to the proper fix to xapian-index. cheers *GE* References Visible links 1. https://docs.python.org/3/whatsnew/3.12.html#whatsnew312-removed-imp

2 1

Crash in dovecot snippet when using imapc
by John van der Kamp 03 Sep '25

03 Sep '25

Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib-mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c:615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd-fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap-commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John Hello, I've found a crash in a very specific setup. A dovecot server with imapc connection needs to receive an email with no body contents for the intent of generating a preview/snippet. It crashes somewhere deep in the jungle of istream and snapshots. I've included a script which sets up the systems to reproduce the crash. I've tested this with several versions. 2.3.16 doesn't seem to be affected, but 2.3.20 and 2.3.21 are affect. For me it produces a traceback like this, using the ubuntu version from here: https://packages.ubuntu.com/noble/dovecot-core (gdb) bt #0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=140530132887360) at ./nptl/pthread_kill.c:44 #1 __pthread_kill_internal (signo=6, threadid=140530132887360) at ./nptl/ pthread_kill.c:78 #2 __GI___pthread_kill (threadid=140530132887360, signo=signo@entry=6) at ./ nptl/pthread_kill.c:89 #3 0x00007fcfb8842476 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/ raise.c:26 #4 0x00007fcfb88287f3 in __GI_abort () at ./stdlib/abort.c:79 #5 0x00007fcfb8b37fe5 in default_fatal_finish (status=0, type=LOG_TYPE_PANIC) at ../lib/failures.c:465 #6 fatal_handler_real (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:477 #7 0x00007fcfb8be50d7 in i_internal_fatal_handler (ctx=<optimized out>, format=<optimized out>, args=<optimized out>) at ../lib/failures.c:879 #8 0x00007fcfb8b37eea in i_panic (format=0x7fcfb8c29020 "file %s: line %d (%s): assertion failed: (%s)") at ../lib/failures.c:530 #9 0x00007fcfb8b3387b in i_stream_header_filter_snapshot_free (_snapshot=<optimized out>) at ../lib-mail/istream-header-filter.c:663 #10 i_stream_header_filter_snapshot_free (_snapshot=0x55dabe297a60) at ../lib- mail/istream-header-filter.c:655 #11 0x00007fcfb8bf25ac in i_stream_snapshot_free (_snapshot=_snapshot@entry=0x55dabe29b0d0) at ../lib/istream.c:253 #12 0x00007fcfb8bf2654 in i_stream_unref (stream=0x7ffc16cc7fa0) at ../lib/ istream.c:66 #13 0x00007fcfb8d96baa in index_mail_write_body_snippet (mail=0x55dabe292058) at index/index-mail.c:1151 #14 0x00007fcfb8d97e48 in index_mail_parse_bodystructure (mail=0x55dabe292058, field=MAIL_CACHE_BODY_SNIPPET) at index/index-mail.c:1551 #15 0x00007fcfb8d97fe2 in index_mail_fetch_body_snippet (value_r=0x7ffc16cc8050, mail=0x55dabe292058) at index/index-mail.c:1602 #16 index_mail_get_special (_mail=0x55dabe292058, field=<optimized out>, value_r=0x7ffc16cc8050) at index/index-mail.c:1730 #17 0x00007fcfb8d16ffe in mail_get_special (mail=mail@entry=0x55dabe292058, field=field@entry=MAIL_FETCH_BODY_SNIPPET, value_r=value_r@entry=0x7ffc16cc8050) at /home/ubuntu/dovecot/new/dovecot-2.3.21+dfsg1/src/lib-storage/mail.c:418 #18 0x000055dabc52645c in fetch_snippet (ctx=0x55dabe26e050, mail=0x55dabe292058, preview=0x55dabe28f1f8) at ./src/imap/imap-fetch-body.c: 615 #19 0x000055dabc52b5cc in imap_fetch_more_int (ctx=0x55dabe26e050, cancel=false) at ./src/imap/imap-fetch.c:562 #20 0x000055dabc52b8ad in imap_fetch_more (ctx=0x55dabe26e050, cmd=0x55dabe26de98) at ./src/imap/imap-fetch.c:617 #21 0x000055dabc51fd07 in cmd_fetch (cmd=0x55dabe26de98) at ./src/imap/cmd- fetch.c:382 #22 0x000055dabc528af4 in command_exec (cmd=0x55dabe26de98) at ./src/imap/imap- commands.c:201 #23 0x000055dabc52e9e2 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1237 #24 0x000055dabc52ea96 in client_command_input (cmd=<optimized out>) at ./src/ imap/imap-client.c:1307 #25 0x000055dabc52eeed in client_handle_next_command (remove_io_r=<synthetic pointer>, client=0x55dabe26d2c8) at ./src/imap/imap-client.c:1349 #26 client_handle_input (client=0x55dabe26d2c8) at ./src/imap/imap-client.c: 1363 #27 0x000055dabc52f2c4 in client_input (client=0x55dabe26d2c8) at ./src/imap/ imap-client.c:1407 #28 0x00007fcfb8bfe27d in io_loop_call_io (io=0x55dabe26e660) at ../lib/ ioloop.c:737 #29 0x00007fcfb8bff81a in io_loop_handler_run_internal (ioloop=0x55dabe243fd0) at ../lib/ioloop-epoll.c:222 #30 0x00007fcfb8bff8d4 in io_loop_handler_run (ioloop=0x55dabe243fd0) at ../ lib/ioloop.c:789 #31 0x00007fcfb8bffa90 in io_loop_run (ioloop=0x55dabe243fd0) at ../lib/ ioloop.c:762 #32 0x00007fcfb8b6ce57 in master_service_run (service=0x55dabe243e20, callback=callback@entry=0x55dabc533210 <client_connected>) at ../lib-master/ master-service.c:878 #33 0x000055dabc51ad37 in main (argc=<optimized out>, argv=<optimized out>) at ./src/imap/main.c:575 John

2 7