- dovecot - dovecot.org

Re: Dovecot's default password storage scheme is not GDPR compliant
by Michael Slusarz 12 Feb '25

12 Feb '25

GDPR applies to companies operating software, not the software itself. As Aki pointed out (somewhere) in this thread, Dovecot doesn't store passwords itself, and doesn't work unless an admin proactively configures at least one authentication mechanism, so it is "secure by default" under any definition I'm aware of. We might be open to a (short) MR on some language to add to the base authentication configuration page that would alert an admin to possible GDPR requirements. But the Dovecot configuration site is maintained to describe how the software works, not educate on what you might or might not need to do to operate a public mail platform, so the scope of such MR would need to be exceedingly narrow. michael > On 02/12/2025 9:16 AM MST infoomatic via dovecot <dovecot(a)dovecot.org> wrote: > > > On 12.02.25 01:25, Steven Varco via dovecot wrote: > > So, after my mandatory rant :D, the DEFAULT setup of dovecot should actually be as simple as possible. > > > I fully second that. There is no need to discuss whether dovecots > default password storage complies to GDPR or not. The administrator or > the liable person of a company is responsible for taking care about it, > just as Steven Varco mentioned, the same goes with web servers or any > publicly available service. The important point is: you can configure > dovecot complying to the GDPR. > > Because what's next - argue that a web framework is not GDPR compliant > in its standard configuration because there is no cookie consent popup > by default? This is ridiculous. > > Regards, > Robert > _______________________________________________ > dovecot mailing list -- dovecot(a)dovecot.org > To unsubscribe send an email to dovecot-leave(a)dovecot.org

1 0

Re: mailinglist (mailman) + dovecot
by Schulz 12 Feb '25

12 Feb '25

Hello, just have a look at the mailman documentation (hooking up the mail server). Yes, mailman receives mail via LMTP. No, the container is not stateless, mailman processes data on local queue directories that should be persistent. Maybe you want to switch over to the mailman list after consulting the detailed mailman3 documentation. Am 12. Februar 2025 um 15:43 schrieb "Marc" <Marc(a)f1-outsourcing.eu mailto:Marc@f1-outsourcing.eu?to=%22Marc%22%20%3CMarc%40f1-outsourcing.eu%3E >: > > Yes I also don't like to have this on the server. I was just looking at these Dockerfiles they have there. I prefer to have an external stateless container for this. This mailman seems to connect to a database. So I was just wondering how it should receive the emails. > > currently I have sendmail deliver to docker lmtp. > FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl > > I guess I should be able to deliver remotely with something like this. > dnl FEATURE(`local_lmtp',`[IPC]',`TCP [192.168.xx.xx] 24')dnl > > Just need to figure out how to configure sendmail for what to use when. > > Do you know if you can run mailman in stateless containers because it stores everything in the db? And this lmtp is only for temporary new mail processing? And does it indeed have an 'lmtp" port open? > > > > > we always prefer to separate things, for example in docker containers > > (https://github.com/maxking/docker-mailman is the official one), but > > when you use a python .venv, isolation is already halfway done > > > > > > Am 12. Februar 2025 um 14:38 schrieb "Marc via dovecot" > > <dovecot(a)dovecot.org > > <mailto:dovecot@dovecot.org?to=%22Marc%20via%20dovecot%22%20%3Cdovecot%4 > > 0dovecot.org%3E> >: > > > > I was think of adding a mailinglist for a few users. First I > > thought about maybe using separate container for this, but maybe I can > > just also add this to the server running dovecot. > > > > Anyone having experience with running mailman or something else > > next to dovecot? > > > > > > _______________________________________________ > > dovecot mailing list -- dovecot(a)dovecot.org > > To unsubscribe send an email to dovecot-leave(a)dovecot.org > > >

1 0

mailinglist (mailman) + dovecot
by Marc 12 Feb '25

12 Feb '25

I was think of adding a mailinglist for a few users. First I thought about maybe using separate container for this, but maybe I can just also add this to the server running dovecot. Anyone having experience with running mailman or something else next to dovecot?

1 0

Dovecot uses wrong separator after migration, modify sieve script
by Matthias Fechner 12 Feb '25

12 Feb '25

Dear all, I migrated a dovecot installation that was using pam to a virtual setup where users are stored in a SQL database. I see that my old pam based installation on the filesystem directories are starting with a dot. The new server does not have the leading dot. So even if the configuration is mostly equal, I cannot find a reason why dovecot changed its behavior here. I do not define a separator in the dovecot configuration and the same dovecot package on FreeBSD is used for both installations. My problem is now, that I use a rather complex sieve script to automatically sort mailinglist based emails automatically into subfolders. But as this script is using a dot it is now not moving the email into a nested directory like: github/haproxy/haproxy but is generating a flat directory (depth 1) as github.haproxy.haproxy I cannot change the behavior of dovecot, as I have several users running there and I do not want to cause problem for them changing the dovecot configuration. So I must modify the sieve script. As I do not really know the sieve syntax, I would like to ask if hopefully someone here can help me. I think is is necessary to change the dots to slashes before the fileinto is executed. The sievescript I use to sort mailing based emails into subfolder is: # # 2016-5-2 Script to sort mailing list mails automatically to folders # ## require [ "regex", "include", "variables", "fileinto", "envelope", "mailbox", "imap4flags", "vnd.dovecot.debug" ]; global ["sender_userpart", "sender_domain", "listname"]; # split out the various list forms # Mailman & other lists using list-id if exists "list-id" { fileinto :create "${listname}"; stop; } # Listar and mailman like elsif exists "x-list-id" { debug_log "Mailinglist: x-list-id found"; if header :regex "x-list-id" "<([a-z_0-9-]+)\\\\." { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # Ezmlm elsif exists "mailing-list" { debug_log "Mailinglist: mailing-list found"; if header :regex "mailing-list" "([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # York lists service elsif exists "x-mailing-list" { debug_log "Mailinglist: x-mailing-list found"; if header :regex "x-mailing-list" "^\\\\s*([a-z_0-9-]+)@?" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } # Smartlist elsif exists "x-loop" { debug_log "Mailinglist: x-loop found"; if header :regex "x-loop" "^\\\\s*(a-z_0-9-]+)@?" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop;} # poorly identified elsif envelope :contains "from" "owner-" { debug_log "Mailinglist: poorly identified matched"; if envelope :regex "from" "owner-([a-z_0-9-]+)-outgoing@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } elsif envelope :regex "from" "owner-([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } elsif header :regex "Sender" "owner-([a-z_0-9-]+)@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop;} # other poorly identified elsif envelope :contains "from" "-request" { if envelope :regex "from" "([a-z_0-9-]+)-request@" { set :lower "listname" "${1}"; fileinto :create "${listname}"; } else { keep; } stop; } Thanks a lot! Gruß Matthias -- "Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning." -- Rich Cook

1 0

Error in tests for Dovecot 2.4.0 aarch64
by Peter 11 Feb '25

11 Feb '25

When attempting to build Dovecot 2.4.0 on the aarch64 platform, when running tests... test-file-cache.c:268: Assert failed: file_cache_set_size(cache, 1024) == -1 Panic: file test-common.c: line 222 (test_expect_error_string_n_times): assertion failed: (expected_errors == 0) test-common.c:256: Assert failed: suppress == TRUE Error: Raw backtrace: #0 fatal_handler_real[0x7f73779dcca0] -> #1 default_fatal_handler[0x7f73779dcda0] -> #2 i_panic[0x7f73779766ec] -> #3 test_file_cache[0x7f7377997740] -> #4 main[0x7f7377977420] -> #5 __libc_start_call_main[0x4000008f4210] -> #6 __libc_start_main[0x4000008f42c0] -> #7 _start[0x7f7377977980] Any ideas on this one? Peter

4 7

How do I change the password encryption scheme?
by Ken Wright 10 Feb '25

10 Feb '25

Still working through difficulties upgrading to Dovecot 2.4. Right now I'm having trouble getting my mail client (Evolution) to connect; I keep getting "temporary authentication failures." Before upgrading I was using the ARGON2I encryption scheme, so all my users' passwords are stored that way. How do I tell 2.4 to use ARGON2I by default? There used to be a "default_pass_scheme" parameter but that's apparently gone now. Any help is greatly appreciated! Ken

2 1

Dovecot 2.4.0 fails to start with exit code 89
by Ken Wright 10 Feb '25

10 Feb '25

I've been trying to upgrade to 2.4.0. I've gone through the conf files, changing variables per the upgrade instructions. When I try to run sudo systemctl start dovecot.service, I get error 89. Journalctl shows me the error in question is "File name too long." I think it's coming from where 10-ssl.conf looks for the certs, but I'm probably wrong. Can anyone make a suggestion? Ken

4 4

Different Replicator Crash??
by Kent Borg 09 Feb '25

09 Feb '25

I added the suggested "count--" and recompiled, and it now appears to work, the replication goes both ways, eyeballing the e-mail on the two servers they look the same. Good. But part of the time I am still getting what looks very much like the same crash, is there another "count--" I need to add to that file? > Jan 28 10:53:08 la dovecot[96175]: replicator: Panic: data stack: Out > of memory when allocating 268435496 bytes > Jan 28 10:53:08 la dovecot[96175]: replicator: Error: Raw backtrace: > #0 t_askpass[0x7fb404b0c0] -> #1 backtrace_append[0x7fb404b374] -> #2 > backtr\ > ace_get[0x7fb404b510] -> #3 execvp_const[0x7fb4057ba4] -> #4 > i_syslog_fatal_handler[0x7fb4058510] -> #5 i_panic[0x7fb3fa6808] -> #6 > t_pop_pass_st\ > r[0x7fb4050eb4] -> #7 connection_deinit[0x7fb4056430] -> #8 > pool_datastack_create[0x7fb407e7b0] -> #9 > array_bsearch_insert_pos_i[0x7fb40446d0] ->\ > #10 t_base64_scheme_decode[0x7fb404cb24] -> #11 > buffer_append[0x7fb404d3d0] -> #12 replicator_queue_push[0x558c4b4f40] > -> #13 replicator_brain_i\ > nit[0x558c4b53e4] -> #14 _start[0x558c4b3d70] -> #15 > _start[0x558c4b3f04] -> #16 io_loop_call_io[0x7fb4072f20] -> #17 > io_loop_handler_run_interna\ > l[0x7fb4075450] -> #18 io_loop_handler_run[0x7fb4075680] -> #19 > io_loop_run[0x7fb4075944] -> #20 master_service_run[0x7fb3fd84b0] -> > #21 main[0x5\ > 58c4b3930] -> #22 __libc_init_first[0x7fb3dd76d0] -> #23 > __libc_start_main[0x7fb3dd7780] -> #24 _start[0x558c4b3b80] > Jan 28 10:53:08 la dovecot[96175]: replicator: Fatal: master: > service(replicator): child 96714 killed with signal 6 (core dumps > disabled - https:\ > //dovecot.org/bugreport.html#coredumps) Thanks, -kb

4 4

crash on authentication to 2.3.21
by Eugene M. Zheganin 09 Feb '25

09 Feb '25

Hello, I'm trying to move a dovecot mail server from a remote Cpanel VPS to my site. I've set up the dovectot to my knowledge, but as soon as I try to authenticate, I got a crash: ===Cut=== Feb 9 11:15:12 freebsd dovecot[89257]: imap-login: Login: user=<gluck(a)kimlab.link>, method=CRAM-MD5, rip=92.255.139.77, lip=49.12.36.80, mpid=545, session=<O6+RtLMt1iBc/4tN> Feb 9 11:15:12 freebsd dovecot[89257]: imap(gluck(a)kimlab.link)<545><O6+RtLMt1iBc/4tN>: Panic: file array.c: line 10 (array_idx_modifiable_i): assertion failed: (idx < array->buffer->used / array->element_size) Feb 9 11:15:12 freebsd dovecot[89257]: imap(gluck(a)kimlab.link)<545><O6+RtLMt1iBc/4tN>: Fatal: master: service(imap): child 545 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps) ===Cut=== Thhe only reference I've fount to this error is that it seems to be an issue in 2.3.17, but I have 2.3.21 version, so I think there's something in my config. I've also hhave a bunch of old maildirs and I tried to do a force-resync on 'em, but that didn't help. Here's my config: ===Cut=== # 2.3.21.1 (d492236fa0): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.21.1 (49005e73) # OS: FreeBSD 14.2-RELEASE amd64 # Hostname: mail.kimlab.link auth_debug = yes auth_debug_passwords = yes auth_mechanisms = plain login cram-md5 scram-sha-1 scram-sha-256 default_client_limit = 40963 default_process_limit = 10240 disable_plaintext_auth = no first_valid_gid = 143 first_valid_uid = 143 hostname = mail.kimlab.link mail_gid = 143 mail_home = /var/imap/%d/%n mail_location = maildir:~/ mail_uid = 143 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace { inbox = yes list = yes location = prefix = separator = / subscriptions = yes type = private } namespace { location = maildir:/var/imap/%d/public prefix = Public/ separator = / subscriptions = no type = public } namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%u/ separator = / subscriptions = no type = shared } passdb { args = scheme=PLAIN username_format=%u /usr/local/etc/dovecot/users driver = passwd-file master = yes pass = yes } plugin { acl = vfile acl_shared_dict = file:/var/db/dovecot/shared-mailboxes fts = squat fts_autoindex = yes fts_squat = partial=4 full=10 quota = maildir:User quota quota_rule = *:storage=50G quota_rule2 = Trash:storage=+10%% quota_rule3 = Spam:storage=+20%% quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_after = /var/imap/sieve/sieve-after sieve_before = /var/imap/sieve/sieve-before/spam.sieve sieve_default = /var/imap/sieve/default.sieve sieve_dir = /var/imap/%d/%n/sieve sieve_global_dir = /var/imap/sieve sieve_max_script_size = 1M } postmaster_address = postmaster(a)kimlab.link protocols = imap pop3 lmtp sieve service auth { client_limit = 62464 unix_listener /var/imap/private/auth { group = dovecot mode = 0660 user = dovecot } unix_listener auth-userdb { group = dovecot mode = 0660 user = dovecot } } service imap-login { client_limit = 10000 inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_limit = 10240 process_min_avail = 1 service_count = 0 vsz_limit = 512 M } service imap { drop_priv_before_exec = yes process_limit = 10240 } service lmtp { unix_listener lmtp { group = dovecot mode = 0660 user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { user = dovecot } user = dovecot } service stats { unix_listener stats-writer { group = dovecot mode = 0660 user = dovecot } } ssl_cert = </usr/local/etc/nginx/tls.d/kimlab.link.pem ssl_key = # hidden, use -P to show it syslog_facility = local6 userdb { args = username_format=%u /usr/local/etc/dovecot/users default_fields = uid=dovecot gid=dovecot home=/var/imap/%d/%n driver = passwd-file } protocol lmtp { mail_plugins = " quota acl sieve" } protocol lda { mail_plugins = " quota acl sieve" } protocol imap { imap_client_workarounds = tb-extra-mailbox-sep mail_max_userip_connections = 512 mail_plugins = quota imap_quota fts fts_squat } ===Cut=== here's my obfuscated users passdb file: ===Cut=== gluck@kimlab.link:{PLAIN}XXXXXXXXX:::::: emz@kimlab.link:{PLAIN}XXXXXXXXX:::::: ===Cut=== I'm totally open to any ideas. I can provide coredumps as well, but I tend to think that's something obvious since I have very little experience with dovecot. Thanks. Eugene.

2 1

suggestion: Argon2id example in `doveadm pw` examples
by Sean McBride 09 Feb '25

09 Feb '25

Hi all, It says here https://www.dovecot.org/bugreport-mail/ that bug reports should go to this list. Does that apply to suggestions too? Assuming so... The docs here are very good: https://doc.dovecot.org/main/core/man/doveadm-pw.1.html but it's always nice to have examples of current best practice. As I understand it, the best password hashing algorithm these days is Argon2id, according to: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet… So it would be nice to have an example corresponding to best practices, showing use of argon2id. I could attempt a PR on GitHub if you'd like. Cheers, Sean

1 0