- dovecot - dovecot.org

Struggling with sieve, fileinto and variables.
by Barry Pearce 31 May '18

31 May '18

Hi, Im on Manjaro linux fully up to date running dovecot 2.3.1-2 pigeonhole 0.5.1-2 All is running well except I am having problems with fileinto - it refuses to use variables, and mailboxexists is also failing for me. Im just dealing with plus addressing - should be simple but the behaviour Im experiencing isnt right. require ["variables", "envelope", "fileinto", "subaddress", "mailbox"]; if envelope :matches :detail "to" "*" { set :lower "name" "${1}"; } fileinto :create "folder3"; This works, but changing the last line to: fileinto :create "${name}"; fails and files into inbox. As does: fileinto :create "${1}"; It makes no difference if the fileinto is placed inside the if statement or otherwise. Using sieve-test suggests the basic script it should work and traces show the right action. On a related matter the script Im actually trying to get to work is: require ["variables", "envelope", "fileinto", "subaddress", "mailbox"]; if envelope :matches :detail "to" "*" { set :lower "name" "${1}"; } if mailboxexists "${name}" { fileinto :create "${name}"; } But fails and files in the inbox. Modifying the script to: require ["variables", "envelope", "fileinto", "subaddress", "mailbox"]; if envelope :matches :detail "to" "*" { set :lower "name" "${1}"; } if mailboxexists "${name}" { fileinto :create "folder7"; } else { fileinto :create "folder8"; } Files into folder8. So the mailboxexists is failing. ## Started executing script 'plus-addressing' 3: envelope test 3: starting `:matches' match with `i;ascii-casemap' comparator: 3: getting `to' part from message envelope 3: extracting `detail' part from address <test+folder4(a)test.net> 3: matching value `folder4' 3: with key `*' => 1 3: finishing match with result: matched 3: jump if result is false 3: not jumping 4: set command 7: modify :lower "folder4" => "folder4" 7: assign `name' [0] = "folder4" 7: mailboxexists test 7: mailbox `folder4' cannot be opened 7: some mailboxes are unavailable 7: jump if result is false 7: jumping to line 9 10: fileinto action 10: store message in mailbox `folder8' ## Finished executing script 'plus-addressing' Here folder4 actually does exist - so the sieve-test confirms that issue. Im at a loss as to whats going on. Im particularly perplexed by the difference in behaviour between sieve-test and the result under the live server. Any ideas?

2 3

strange misflagging of incoming mail as trash
by Robb Aley Allan 31 May '18

31 May '18

Setting up postfix/dovecot on a clean FreeBSD cloud server, and have discovered a strange problem resulting from the interaction of Mac OS X Mail and dovecot (using the Maildir file structure). Essentially, under very specific circumstances, Mail somehow tells dovecot that a new incoming message is trash, dovecot marks it as such, and the message effectively vanishes. The specific circumstance is as follows: 1. A message is sent to a server running postfix. It is placed in the Maildir mail structure in the “new” directory. 2. OS X Mail is used to retrieve mail via IMAP, and dovecot transfers the message from “new” to “cur”. 3. OS X Mail has a rule that seeks to transfer an incoming message to a subfolder if the message sender belongs to a group created in the Contacts app (IOW the sender is matched against an OS-internal contacts database). 4. IF the sender is the user, AND the user is in the group against which the rule is compared, the message is marked as trash (suffix “T”) and is never loaded into the mail client, either in the inbox or in the trash folder. For all intents and purposes, it disappears. The connection log shows the following line: "WROTE May 30 23:38:11.960 [kCFStreamSocketSecurityLevelTLSv1_2] -- host:cloud.helical.com -- port:993 -- socket:0x6080004b6c80 -- thread:0x604000678e40 12.3 UID STORE 125 +FLAGS.SILENT (\Deleted)” which appears to be the client instructing dovecot to mark the message as deleted. I have the log files from the connection on both sides, and the console log from the Mac, but can’t understand 1. how Mail decides that the message should be deleted, and 2. why Mail “loses” the message (doesn’t appear in the Trash mailbox or anywhere else). _____ Robb Aley Allan

1 0

imapsieve: mailbox Trash: FLAG event
by Peter Schiffer 30 May '18

30 May '18

Hi all, after upgrade from Dovecot 2.2 to 2.3 I started to see that emails from Trash folder are automatically deleted after ~7 days. Email clients are not configured to automatically expunge or empty trash on log out (I see this behavior for multiple mailboxes, with different clients). With mail_debug enabled, I see this log message for every email that gets deleted from Trash: May 29 08:02:17 hostname dovecot: imap(some@mail)<7725><xxb6+VFtL+JT0CE 8>: Debug: imapsieve: mailbox Trash: FLAG event (changed flags: \Deleted) I have Dovecot 2.3.1 (8e2f634) and Pigeonhole 0.5.1 for sieve. My configuration can be found here: https://github.com/pschiffe/mailcow-dockerized/tree/master/data/conf/dovecot There is enabled support for sieve config in sql, but all sieve tables are empty, and there are no sieve filters for Trash flagging. Do you know how to find the source of that Trash flag event? I need to disable it or to configure it so it deletes emails at least couple of months old. Thanks all, peter

2 1

Re: Fatal: nfs flush requires mail_fsync=always
by Juan C. Blanco 30 May '18

30 May '18

Hello, any news about the attached error? I'm preparing the 2.2 to 2.3 upgrade and having the same error. We have the mail stores in an NFS filer. Regards > On 19.01.2018 11:55, Søren Skou wrote: >> Hiya all, >> >> I'm seeing this "Fatal: nfs flush requires mail_fsync=always" error on >> my testbed. The issue is that from what I can see, mail_fsync is set >> to always : >> >> # doveconf -n | grep mail_fs >> mail_fsync = always >> >> The result is that the client does not connect at all, which is not >> really what I wanted to happen :) >> >> Any idea what is going wrong here? >> >> Best regards >> Søren P. Skou >> >> doveconf -n >> >> # 2.3.1.alpha0 (bdfa22623) [XI:2:2.3.1~alpha0-1~auto+14]: >> /etc/dovecot/dovecot.conf >> # Pigeonhole version 0.5.1.alpha0 (d5f710e0) >> # OS: Linux 4.9.0-4-amd64 x86_64 Debian 9.3 nfs >> auth_worker_max_count = 200 >> dict { >> expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >> quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >> sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext >> } >> disable_plaintext_auth = no >> lock_method = dotlock >> mail_fsync = always >> mail_location = maildir:/mnt/virtual_mail/%d/%n >> mail_nfs_index = yes >> mail_nfs_storage = yes >> mail_plugins = quota >> mailbox_list_index = no >> metric imap_select_no { >> event_name = imap_command_finished >> filter { >> name = SELECT >> tagged_reply_state = NO >> } >> } >> mmap_disable = yes >> namespace inbox { >> inbox = yes >> location = >> mailbox Drafts { >> special_use = \Drafts >> } >> mailbox Junk { >> auto = subscribe >> special_use = \Junk >> } >> mailbox Sent { >> special_use = \Sent >> } >> mailbox "Sent Messages" { >> special_use = \Sent >> } >> mailbox Trash { >> special_use = \Trash >> } >> prefix = >> } >> passdb { >> args = /etc/dovecot/dovecot-sql.conf.ext >> driver = sql >> } >> plugin { >> quota = dict:User quota::proxy::sqlquota >> quota_grace = 10%% >> quota_rule = *:storage=1000m:messages=300000 >> quota_rule2 = Trash:storage=+10%%:messages=+10%% >> quota_rule3 = Junk:storage=+20%%:messages=+20%% >> quota_status_nouser = DUNNO >> quota_status_overquota = 552 5.2.2 Mailbox is full >> quota_status_success = DUNNO >> quota_warning = storage=75%%:messages=75%% quota-warning 75 %u >> quota_warning2 = storage=95%%:messages=95%% quota-warning 95 %u >> quota_warning3 = -storage=100%%:messages=100%% quota-warning below %u >> sieve = /etc/dovecot/sieve/default.sieve >> sieve_global_dir = /etc/dovecot/sieve >> } >> protocols = " imap pop3" >> service dict { >> unix_listener dict { >> mode = 0600 >> user = vmail >> } >> } >> service imap { >> executable = imap >> } >> service quota-status { >> client_limit = 1000 >> executable = quota-status -p postfix >> inet_listener { >> address = 127.0.0.1 >> port = 12340 >> } >> } >> service quota-warning { >> executable = script /usr/local/bin/quota-warning.sh >> user = vmail >> } >> ssl_ca = /etc/ssl/certs/ca-root.crt >> ssl_cert = </etc/ssl/certs/stjerne.danskkabeltv.dk-2019.crt >> ssl_cipher_list = TLSv1+HIGH !SSLv2 !RC4 !aNULL !eNULL !3DES-CBC !3DES @STRENGTH >> ssl_dh = # hidden, use -P to show it >> ssl_key = # hidden, use -P to show it >> userdb { >> args = uid=2000 gid=2000 home=/mnt/virtual_mail/%d/%n >> driver = static >> } >> protocol lmtp { >> mail_plugins = quota >> } >> protocol lda { >> mail_plugins = quota >> } >> protocol imap { >> mail_plugins = quota imap_quota >> rawlog_dir = /tmp/rawlog/%u >> } > > Hi! > > Thanks, we'll look into it. > > Aki -- +-------------------------------------------------------------------+ | Juan C. Blanco | | | | Centro de Calculo | | | E.T.S. Ingenieros Informáticos | E-mail: jcblanco(a)fi.upm.es | | Universidad Politécnica de Madrid | | | Campus de Montegancedo | | | Boadilla del Monte | Tel.: (+34) 91 067 2771 | | 28660 MADRID (Spain) | Fax : (+34) 91 336 7412 | +-------------------------------------------------------------------+

2 2

Second rule isn't apply when first rule matches
by daniel_1983＠protonmail.com 30 May '18

30 May '18

Dear list, I want to define two concurrent rules : 1. I want to flag an e-mail containing the word "cloud" in the body 2. I want to move mail sent explicitly to me (as opposed to mail sent to an alias I am part of) going to "INOBX.I must answere this" If I put rule (1) first, everything works as expected. If put rule (2) first, only that rule applies. Here's a small test case you should be able to reproduce on your setup. Let's work on this fake test e-mail : $ cat testmail.eml Date: Mon, 28 May 2018 12:41:53 +0100 From: friend(a)otherdomain.tld To: me(a)mydomain.tld Subject: dur dur la vie mon frère, le cloud c'est le top du top Here's the first, broken version of the script $ cat test.sieve require ["body","fileinto","imap4flags","vacation"]; # rule:[Mail about me] if anyof (header :contains "to" "me(a)mydomain.tld", body :text :contains "ahmed") { fileinto "INBOX.I must answere this"; } # rule:[Mail about the Cloud] if body :text :contains "cloud" { addflag "\\Flagged"; } Let's test it out, the two rules should be applied : $ sieve-test test.sieve testmail.eml Performed actions: * store message in folder: INBOX.I must answere Implicit keep: (none) sieve-test(root): Info: final result: success $ Notice that the last rule isn't applied although it matches. Now we invert the order of the rules and apply the script on the same test e-mail : $ cat test.sieve require ["body","fileinto","imap4flags","vacation"]; # rule:[Mail about the Cloud] if body :text :contains "cloud" { addflag "\\Flagged"; } # rule:[Mail about me] if anyof (header :contains "to" "me(a)mydomain.tld", body :text :contains "ahmed") { fileinto "INBOX.I must answere this"; } Running the test again : $ sieve-test test.sieve testmail.eml Performed actions: * store message in folder: INBOX.I must answere + add IMAP flags: \flagged Implicit keep: (none) sieve-test(root): Info: final result: success $ The IMAP flag was set ! Any ideas ?

2 3

Problem in Pigeonhole sievec
by Thorsten Hater 30 May '18

30 May '18

Dear all, I stumbled upon the following behaviour of Pigeonhole, which I consider to be problematic. A user deployed a Sieve script similar to the following snippet if not anyof (address :is ["from","cc"] ["...", ..., "...@... GARBAGE", ...] { fileinto "inbox.Trash"; stop; } Note the extra line break before GARBAGE. This script is obviously broken, but gets accepted by sievec and only fails later, at runtime with line X: error: found stray carriage-return (CR) character in quoted string started at line X. So, the question is whether line breaks in strings are allowed in general and the runtime error is unavoidable, or should sievec return an error? Best regards, Thorsten

3 3

OAUTH2 + proxying [host=??]
by DevOps 30 May '18

30 May '18

All, We currently use a proxy configuration with an sql query to authenticate and discover which backend server an address belongs to and proxy the connection to that host to authenticate and retrieve mail. We are looking to move to OAUTH2 for authentication and am just trying to figure how how to get that extra host information as part of the passdb query when using this mechanism. Looking at doco if we were running a director setup (which we are not) that process seems to be able to poke that info into response but is there any other way of doing this ? Should we be getting or can we get OAUTH2 to return extra fields and configure the pass_attrs to be host=%{passdb:proxyToHost} or something like that ? Any information/thoughts would be good to hear. rgds Matt

2 1

Bug: Dovecot index loosing sync with FTS despite "fts_autoindex = yes"
by kfx 29 May '18

29 May '18

dovecot 2.2.34 solr 7.2 I only see new messages after typing on the server "doveadm fts rescan -u username" though I've followed the wiki and added "fts_autoindex = yes" in 90-plugin.conf . Subsequent search for the same pattern always gives the same result, ignoring new emails with that particular pattern. Solr is working correctly and the correct search results comes immediately (whatever the searched word) after a "doveadm fts rescan" # doveconf | grep fts mail_plugins = " quota stats fts fts_solr" fts = solr fts_autoindex = yes fts_solr = url=http://localhost:8983/solr/dovecot/ [POP] mail_plugins = " quota stats fts fts_solr sieve virtual" [IMAP] mail_plugins = " quota stats fts fts_solr imap_quota virtual imap_stats"

4 14

Search problem
by Federico Bartolucci 28 May '18

28 May '18

Hello, when doing a simple search through the lucene indexes in some mailboxes (with actually many subfolders) the search terminates after a few seconds with no result and the dovecot log shows this error: Fatal: master: service(imap): child 15433 killed with signal 6 (core not dumped) Any clue about the reasons? the lucene indexes have been already rebuilt and look OK. Regards -federico

3 3

Re: Best mail encryption solution for per-user
by Aki Tuomi 27 May '18

27 May '18

> On 26 May 2018 at 10:36 mail(a)sjemm.net wrote: > > > May 23, 2018 10:10 AM, mail(a)sjemm.net wrote: > > May 23, 2018 9:46 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > > > >> On 23.05.2018 10:15, mail(a)sjemm.net wrote: > >> > >>> May 23, 2018 8:31 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >> > >> On 23.05.2018 09:13, mail(a)sjemm.net wrote: > >>> May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: > >>> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: > >>> > >>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: > >>> > >>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: > >>> > >>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: > >>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: > >>> > >>> Hi Tai74 and Aki, > >>> I followed your conversation with interest on how to setup per user encryption in dovecot. > >>> I have setup my dovecot with the following in a conf file: > >>> > >>> ============== > >>> > >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes > >>> mail_plugins = $mail_plugins mail_crypt > >>> plugin { > >>> > >>> mail_crypt_curve = secp521r1 > >>> > >>> mail_crypt_save_version = 2 > >>> > >>> } > >>> > >>> ============== > >>> > >>> This works nice, all emails are being encrypted and every user/folder has keys. > >>> But as I understood from your conversation these keys are not protected. And I want them to be > >>> protected by the users password used by imap. > >>> > >>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up > >>> the DB and postfix/dovecot) > >>> > >>> but how would i set it so, that the users password from the DB is used to encrypt the keys? > >>> > >>> should i use mail_crypt_private_password = ? > >>> how do i point it to the mysql db then? > >>> im unsure about this > >>> > >>> Do you have any hints on this? > >>> > >>> Kind regards, > >>> Zjemm > >>> > >>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your > >>> user's keys using user's login password, you must have a TOOL that manages this. > >>> > >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >>> a good option. > >>> > >>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time > >>> user changes his password. > >>> > >>> Also note that if you go down this road, and the user forgets his password, you will not be able to > >>> recover the emails without backup copy of the private key. > >>> > >>> Aki > >>> > >>> Hi Aki > >>> > >>> I used the following command: > >>> dovecot pw -s SHA256-CRYPT > >>> > >>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ > >>> > >>> This output is used to store in the password fields in the database. So no plain text passwords no > >>> :) > >>> > >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login > >>> password as private password. > >>> > >>> can you explain this a bit more for me? > >>> > >>> for now i have in the 10-auth.conf file the following: > >>> ============== > >>> passdb { > >>> driver = sql > >>> > >>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext > >>> args = /etc/dovecot/dovecot-sql.conf.ext > >>> } > >>> > >>> and: > >>> > >>> userdb { > >>> driver = static > >>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n > >>> } > >>> ============== > >>> > >>> then i have in dovecot-sql.conf.ext > >>> ============== > >>> driver = mysql > >>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample > >>> default_pass_scheme = SHA256-CRYPT > >>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; > >>> ============== > >>> Where do i need to set : mail_crypt_private_password = %w ? > >>> > >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be > >>> a good option. > >>> > >>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. > >>> so this step isnt nesesary anymore am i right? > >>> > >>> Thank you for your quick response, very helpfull > >>> > >>> Zjemm > >>> > >>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the > >>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed > >>> password is.. > >>> > >>> So: > >>> > >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >>> virtual_users WHERE email='%u' > >>> > >>> Aki > >>> > >>> Hi Aki, > >>> > >>> Thank you very much for your help, i realy appreciate that. > >>> > >>> Ok so if i understand it correctly i'll have to use: > >>> > >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >>> virtual_users WHERE email='%u' > >>> > >>> in my dovecot-sql.conf.ext file > >>> > >>> This query selects the user, the password, and %w > >>> > >>> if i run a little query myself: > >>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password > >>> FROM virtual_users; > >>> +------------------+----------------------------------+------------------------------------+ > >>> | user | password | userdb_mail_crypt_private_password | > >>> +------------------+----------------------------------+------------------------------------+ > >>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | > >>> +------------------+----------------------------------+------------------------------------+ > >>> > >>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as > >>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that > >>> is typing in the password when authenticating. > >>> > >>> is this correct? > >>> > >>> yes. > >>> > >>> so then i have the username the hashed password en the plaintext password as a result of the query. > >>> > >>> yes > >>> > >>> now userdb_mail_crypt_private_password = the plaintext password > >>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by > >>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? > >>> > >>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin > >>> {} section. > >>> > >>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge > >>> > >>> Thanks again and have a great weekend. > >>> > >>> Zjemm > >>> > >>> Aki > >>> > >>> Hi Aki, > >>> > >>> Cool i'm testing it right now. > >>> I have set up a new mailserver (life is great with lxc containers :) ) > >>> > >>> postfix and dovecot are working like normal > >>> > >>> next i enable mail_crypt > >>> > >>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf > >>> ========================== > >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes > >>> > >>> mail_plugins = $mail_plugins mail_crypt > >>> > >>> plugin { > >>> mail_crypt_curve = secp521r1 > >>> mail_crypt_save_version = 2 > >>> } > >>> ========================== > >>> > >>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext > >>> > >>> so the query is now the new query: > >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM > >>> virtual_users WHERE email='%u'; > >>> > >>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in > >>> there. > >>> > >>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email > >>> the mutt client drops the connection. > >>> > >>> in the log i can see: > >>> > >>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, > >>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> > >>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() > >>> failed: > >>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, > >>> =571:2,) failed: Private key not available: Cannot decrypt key > >>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum > >>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) > >>> > >>> i think i missed a step, but witch one? > >>> > >>> the userpassword hasnt been changed (that would be the next step in the testing process) > >>> > >>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that > >>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin > >>> > >>> please let me know your thougts > >>> Zjemm > >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. > >>> > >>> mail_crypt_private_password is used when key is created, but if you have created it before using > >>> password, you'll need to encrypt it before turning the setting on. > >>> > >>> Aki > >>> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) > >>> > >>> are you a dovecot devoloper? or a enthusiastic user? > >>> > >>> anyway, i managed to get it working now with all your help :) > >>> > >>> to start fresh i did a: > >>> rm -rf /var/vmail/example.org > >>> > >>> so all email is gone, and i assume all dovecot keys are gone that way. > >>> > >>> Then i tried to set a password first: > >>> > >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun > >>> result: Changed password for 0 key(s) > >>> > >>> (summersun = the password for this user) > >>> > >>> but then it says there are 0 keys, so then i send the test user an email and try to open the > >>> mailbox, i'll get: > >>> > >>> imap(john(a)example.org): Error: read() failed: > >>> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, > >>> =561:2,) failed: Private key not available: Cannot decrypt key > >>> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum > >>> routines:BN_mpi2bn:encoding error > >>> > >>> but hey, now the key's are created, so i tried to set the password again: > >>> > >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun > >>> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) > >>> failed: password missing > >>> ========= > >>> > >>> Lets start over again, i did a new: > >>> rm -rf /var/vmail/example.org > >>> > >>> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. > >>> now again new keys are generated. > >>> > >>> then i did set the password via doveadm: > >>> > >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun > >>> result: Changed password for 1 key(s) > >>> > >>> i enabled the mail_crypt_private_password again in the sql query part and now it works :) > >>> > >>> YESSS!!! > >>> > >>> if i now change the password for the user, i cannot read the email anymore. that is what should > >>> happen. > >>> so now i changed the password for this user also with doveadm: > >>> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun > >>> > >>> and now i'm able to read the emails again. so it all works now as expected. > >>> > >>> i have now only one thing remaining. > >>> > >>> when i want to add a new user, i have to somehow: > >>> - create the new user in the mysql DB > >>> - start with dovecot not using mail_crypt_private_password (so disabled) > >>> - send an initial email to let the users mailbox be created and generate the keys > >>> - set the users password with doveadm > >>> - restart dovecot again with mail_crypt_private_password (so enabled) > >>> > >>> but this would be disruptive to existing users, and i would have to script the whole thing as a > >>> "add-new-user" script to make it usable i guess. > >>> > >>> do you know of a more easy way of acomplishing this? > >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? > >>> > >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that > >>> column with %w for users that allready exist, and empty for new users. > >>> when being empty, it might not set the mail_crypt_private_password for new users > >>> > >>> or is this the wrong way of thinking? > >>> > >>> let me know your thoughts on this. > >>> > >>> And last but not least, i really want to thank you for all your help. It is a really nice > >>> experience. > >>> Bless you! > >>> > >>> Zjemm > >>> Hi Aki, > >>> > >>> You did fix the posting on the mail archive, i can see our conversation on there, all but the last > >>> email i send to you. > >>> Maybe you did not received the last email? > >>> > >>> would you be willing to take a look at my last question in the email See below: > >>> Thank you very much. > >>> > >>> ================================ > >>> i have now only one thing remaining. > >>> > >>> when i want to add a new user, i have to somehow: > >>> - create the new user in the mysql DB > >>> - start with dovecot not using mail_crypt_private_password (so disabled) > >>> - send an initial email to let the users mailbox be created and generate the keys > >>> - set the users password with doveadm > >>> - restart dovecot again with mail_crypt_private_password (so enabled) > >>> > >>> but this would be disruptive to existing users, and i would have to script the whole thing as a > >>> "add-new-user" script to make it usable i guess. > >>> > >>> do you know of a more easy way of acomplishing this? > >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? > >>> > >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that > >>> column with %w for users that allready exist, and empty for new users. > >>> when being empty, it might not set the mail_crypt_private_password for new users > >>> > >>> or is this the wrong way of thinking? > >>> > >>> let me know your thoughts on this. > >>> > >>> And last but not least, i really want to thank you for all your help. It is a really nice > >>> experience. > >>> Bless you! > >>> > >>> Zjemm > >> > >> If you have mail_crypt_private_password set *when* keys are generated, > >> dovecot should use that password to encrypt the user key. > >> > >> Aki > >>> Hi Aki, > >>> > >>> well, if there is a new email user setup in the mysql DB, and no email has been send to that new > >>> user. at that point there are no keys. > >>> > >>> So trying to set a password on those key's wont work. see: > >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n > >>> qwerty > >>> result: Changed password for 0 key(s) > >>> > >>> the keys need to be generated first. And that only happens when sending a mail to that new user. > >>> Also, at the point of creating the keys, the mail_crypt_private_password should be disabled > >>> otherwise the keys are generated and also encrypted with no user password, and then im unable to > >>> set a new pasword for that key > >>> > >>> How can i set the password before the keys are generated? > >>> or can i manually generate key's and then set the password? > >>> > >>> so at this point i have to do the following: > >> > >> You can use doveadm mailbox cryptokey generate -u user -U > >> > >> to generate a user key. > >> > >> Aki > >> > >>> - create the new user in the mysql DB > >>> - start with dovecot not using mail_crypt_private_password (so disabled) > >>> - send an initial email to let the users mailbox be created and generate the keys > >>> - set the users password with doveadm > >>> - restart dovecot again with mail_crypt_private_password (so enabled) > >>> can i somehow enable the mail_crypt_private_password per user? > >>> because this mysql query always returns: %w > >>> and thus allways sets: userdb_mail_crypt_private_password > >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; > > > > Hi Aki, > > > > You are correct > > > > doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: > > '%w' AS userdb_mail_crypt_private_password > > from dovecot configuration and restart dovecot. > > > > if i don't do that, the keys are generated, but also somehow encrypted using: no > > password/empty/something else (i don't know) > > > > here you can see that happening: > > > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U > > Folder Public ID > > ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n > > qwerty > > result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) > > failed: password missing > > > > it expects an old password wich is never set in my opinion. > > > > so the last part of this setup would be to figure out a way to disable '%w' AS > > userdb_mail_crypt_private_password for new users without manually removing that part from the query > > and restarting dovecot. As that would mean connection interruption while adding new users > > > > if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password > > for that new user in the query, we can add the password afterward, and then enable '%w' AS > > userdb_mail_crypt_private_password in the query for this user > > > > could we add a column in the user db lets say called: encrypted (yes/no) > > > > and then change the existing query: SELECT email as user, password, '%w' AS > > userdb_mail_crypt_private_password FROM virtual_users; > > > > to firrt check if encryption is set to 'yes', if so retrun: > > SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; > > > > if not return: > > SELECT email as user, password FROM virtual_users; > > > > but then in one mysql query so dovecot can work with it > > > > ? > > > Hi Aki, > > would you be willing to respond to my last question i had send to you last week? > its this one: > ================================== > > doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: > > '%w' AS userdb_mail_crypt_private_password > > from dovecot configuration and restart dovecot. > > > > if i don't do that, the keys are generated, but also somehow encrypted using: no > > password/empty/something else (i don't know) > > > > here you can see that happening: > > > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U > > Folder Public ID > > ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 > > root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n > > qwerty > > result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) > > failed: password missing > > > > it expects an old password wich is never set in my opinion. > > could this be a bug? or am i doing it wrong? if needed i could send in a bug report? > > or might we need to enable the userdb_mail_crypt_private_password "per user" ? > > > > > so the last part of this setup would be to figure out a way to disable '%w' AS > > userdb_mail_crypt_private_password for new users without manually removing that part from the query > > and restarting dovecot. As that would mean connection interruption while adding new users > > > > if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password > > for that new user in the query, we can add the password afterward, and then enable '%w' AS > > userdb_mail_crypt_private_password in the query for this user > > > > could we add a column in the user db lets say called: encrypted (yes/no) > > > > and then change the existing query: SELECT email as user, password, '%w' AS > > userdb_mail_crypt_private_password FROM virtual_users; > > > > to firrt check if encryption is set to 'yes', if so retrun: > > SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; > > > > if not return: > > SELECT email as user, password FROM virtual_users; > > > > but then in one mysql query so dovecot can work with it > > Please let me know your thougts, after this last thing im done :) > also let me know if i can support this project in some way, im willing to contribute > > Zjemm You can select it as userdb_mail_crypt_save_version=0 to disable encryption (it won't disable decryption). You can use value '2' for enabling encryption. DO NOT USE 1. Also I tried the SQL based thing, and if you had EMPTY mail_crypt_private_password, try these to change the password. If the one that works is the second one, let me know =) doveadm mailbox cryptokey password -u testuser -nnewpass -o "" doveadm mailbox cryptokey password -u testuser -nnewpass -o "yes" Aki

1 0