- dovecot - dovecot.org

domain email autoconfiguration
by David Mehler 02 Apr '18

02 Apr '18

Hello, If anyone has autoconfiguration going with their email domain please email me privately. I'd like to ask you some questions about your setup. What do you use? Thanks. Dave.

3 2

Replication fails with dsync-server(admin@asergis.com): Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory
by Vladimir Tiukhtin 31 Mar '18

31 Mar '18

Hello I have configured replication using dsync. It fails with a message Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory This directory predictably does not exist - all my users are supposed to be virtual. I can not find an option to switch this off. At the same time if I try manual replication I get segfault error Mar 30 17:17:24 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory Mar 30 17:17:54 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Error: sieve-storage: couldn't find storage root directory; sieve_dir was left unconfigured and autodetection failed Mar 30 17:17:54 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Fatal: master: service(doveadm): child 29133 killed with signal 11 (core dumps disabled) Mar 30 17:17:54 localhost.localdomain kernel: doveadm-server[29133]: segfault at 58 ip 00007fa0608c9ca1 sp 00007fffbf349480 error 4 in lib10_doveadm_sieve_plugin.so[7fa0608c2000+b000] Mar 30 17:22:25 localhost.localdomain dovecot[29063]: dsync-server(admin(a)asergis.com): Error: Couldn't create lock /home/admin/.dovecot-sync.lock: No such file or directory Mar 30 17:27:58 localhost.localdomain kernel: doveadm[29153]: segfault at 58 ip 00007fc1e65baca1 sp 00007ffd1a78b020 error 4 in lib10_doveadm_sieve_plugin.so[7fc1e65b3000+b000] ** *My OS*: # cat /etc/os-release NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" ID_LIKE="rhel fedora" VERSION_ID="7" PRETTY_NAME="CentOS Linux 7 (Core)" ANSI_COLOR="0;31" CPE_NAME="cpe:/o:centos:centos:7" HOME_URL="https://www.centos.org/" BUG_REPORT_URL="https://bugs.centos.org/" CENTOS_MANTISBT_PROJECT="CentOS-7" CENTOS_MANTISBT_PROJECT_VERSION="7" REDHAT_SUPPORT_PRODUCT="centos" REDHAT_SUPPORT_PRODUCT_VERSION=" *My dovecot:* # dovecot --version 2.2.10 *My config*: auth_cache_size = 12 M auth_cache_ttl = 1 days auth_debug = yes auth_mechanisms = plain login auth_username_chars = abcdefghijklmnopqrstuvwxyz.@ auth_verbose = yes base_dir = /var/run/dovecot/ default_client_limit = 1024 default_process_limit = 128 doveadm_password = mysecretpasswordsharedamongservers first_valid_uid = 1000 instance_name = powergate login_greeting = with a great power comes great responsibility mail_location = mdbox:/var/mail/%d/%n mail_plugins = replication notify mail_privileged_group = mail mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { auto = no special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = create special_use = \Junk } mailbox Trash { auto = no special_use = \Trash } mailbox virtual/All { auto = no special_use = \All } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { mail_replica = tcp:192.168.100.11:54321 } protocols = imap lmtp service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = $default_internal_user } unix_listener replication-notify { mode = 0666 user = $default_internal_user } } service auth { client_limit = 512 inet_listener auth-client { port = 12345 } unix_listener auth-userdb { mode = 0666 } } service doveadm { inet_listener { port = 54321 } } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 2 service_count = 1 } service imap { service_count = 1 } service lmtp { unix_listener lmtp { group = postfix mode = 0600 user = postfix } } ssl = required ssl_cert = </etc/pki/dovecot/certs/dovecot.pem ssl_dh_parameters_length = 2048 ssl_key = </etc/pki/dovecot/private/dovecot.pem userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql }

2 1

Issue with a bug with imap-login
by Grant Keller 31 Mar '18

31 Mar '18

Hello, Currently working on migrating our existing directors from 2.1.13 to 2.2.10. In 2.2.10 when issuing the logout command on an unauthenticated connection, the connection is closed before the server sends the BYE line to the client. The new version works as expected with a non-secure connection. I will include the strace output from the imap-login process that shows the connection closing before the message can be sent. # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-693.21.1.el7.x86_64 x86_64 CentOS Linux release 7.4.1708 (Core) auth_master_user_separator = * auth_username_format = %Ln auth_verbose = yes default_client_limit = 20000 director_mail_servers = removed director_servers = c.director.imapd.sonic.net d.director.imapd.sonic.net disable_plaintext_auth = no doveadm_port = 1842 login_trusted_networks = removed mbox_write_locks = fcntl passdb { args = /etc/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { args = proxy=y nopassword=y driver = static } service anvil { client_limit = 40103 } service auth { client_limit = 41704 } service director { fifo_listener login/proxy-notify { mode = 0666 } inet_listener { port = 9321 } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director process_limit = 20000 process_min_avail = 1 } service imap { process_limit = 20480 } service pop3-login { executable = pop3-login director process_limit = 20000 process_min_avail = 32 } ssl_ca = </etc/dovecot/ssl/gd_bundle.crt ssl_cert = </etc/dovecot/ssl/imap.sonic.net.crt ssl_cipher_list = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA ssl_key = </etc/dovecot/ssl/imap.sonic.net.key ssl_parameters_regenerate = 1 days ssl_protocols = !SSLv2 !SSLv3 syslog_facility = local0 protocol imap { imap_max_line_length = 128 k ssl_ca = </etc/dovecot/ssl/gd_bundle.crt ssl_cert = </etc/dovecot/ssl/imap.sonic.net.crt ssl_key = </etc/dovecot/ssl/imap.sonic.net.key } protocol pop3 { ssl_ca = </etc/dovecot/ssl/pop.sonic.net.ca-bundle ssl_cert = </etc/dovecot/ssl/pop.sonic.net.crt ssl_key = </etc/dovecot/ssl/pop.sonic.net.key } STRACE: 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2772983280, u64=94500643429872}}], 8, -1) = 1 263563 accept(9<TCP:[0.0.0.0:993]>, {sa_family=AF_INET, sin_port=htons(39552), sin_addr=inet_addr("64.142.18.25")}, [16]) = 18<TCP:[64.142.111.79:993->64.142.18.25:39552]> 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 write(5<pipe:[1445541]>, "\213\5\4\0\223\16\0\0\0\0\0\0", 12) = 12 263563 write(2<pipe:[1445512]>, "\1\010263563 ip=64.142.18.25\n", 25) = 25 263563 getsockname(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, {sa_family=AF_INET, sin_port=htons(993), sin_addr=inet_addr("64.142.111.79")}, [16]) = 0 263563 socket(AF_LOCAL, SOCK_STREAM, 0) = 19<UNIX:[1458853]> 263563 fcntl(19<UNIX:[1458853]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(19<UNIX:[1458853]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 connect(19<UNIX:[1458853]>, {sa_family=AF_LOCAL, sun_path="ssl-params"}, 110) = 0 263563 fcntl(19<UNIX:[1458853]>, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 263563 fcntl(19<UNIX:[1458853]>, F_SETFL, O_RDWR) = 0 263563 read(19<UNIX:[1458853]>, "\0\2\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "H\0\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "0F\2A\0\246@\4\253O,\222\10\300\237\334\240>\331\270\24K\261w\300\16\0076\230\2039\1"..., 72) = 72 263563 read(19<UNIX:[1458853]>, "\0\4\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "\212\0\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "0\201\207\2\201\201\0\213:7H\"\251}6d\371}\212\312\276\177p!\10\26\1[\241\265\254\216"..., 138) = 138 263563 read(19<UNIX:[1458853]>, "\0\0\0\0", 4) = 4 263563 read(19<UNIX:[1458853]>, "", 1) = 0 263563 close(19<UNIX:[1458853]>) = 0 263563 socketpair(AF_LOCAL, SOCK_STREAM, 0, [19<UNIX:[1401333->1401334]>, 20<UNIX:[1401334->1401333]>]) = 0 263563 fcntl(19<UNIX:[1401333->1401334]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(19<UNIX:[1401333->1401334]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 fcntl(20<UNIX:[1401334->1401333]>, F_GETFL) = 0x2 (flags O_RDWR) 263563 fcntl(20<UNIX:[1401334->1401333]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) 263563 fcntl(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, F_SETFL, O_RDWR|O_NONBLOCK) = 0 263563 fstat(20<UNIX:[1401334->1401333]>, {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0 263563 lseek(20<UNIX:[1401334->1401333]>, 0, SEEK_CUR) = -1 ESPIPE (Illegal seek) 263563 getsockname(20<UNIX:[1401334->1401333]>, {sa_family=AF_LOCAL, NULL}, [2]) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_ADD, 20<UNIX:[1401334->1401333]>, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=2773038880, u64=94500643485472}}) = 0 263563 write(20<UNIX:[1401334->1401333]>, "* OK [CAPABILITY IMAP4rev1 LITER"..., 103) = 103 263563 brk(NULL) = 0x55f2a549d000 263563 brk(0x55f2a54c2000) = 0x55f2a54c2000 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\1\0\253\1\0\0\247\3\3", 11) = 11 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\205\224\354\263zY\200p\240T\21\377\276\224\251(\343\255x\277\273.\223\304\"<R\222\16\3538s"..., 165) = 165 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0=\2\0\0009\3\0033\336\314\231\205\305\330\206M\361qQ\240\272\225\317^\331Ysc"..., 4096) = 4096 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "http://ocsp.usertrust.com0\r\6\t*\206H"..., 680) = 680 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x55f2a5498db3, 5) = -1 EAGAIN (Resource temporarily unavailable) 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_ADD, 18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=2773128976, u64=94500643575568}}) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 7<TCP:[0.0.0.0:143]>, 0x7ffcd4f4f270) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 8<TCPv6:[:::143]>, 0x7ffcd4f4f270) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 9<TCP:[0.0.0.0:993]>, 0x7ffcd4f4f270) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 10<TCPv6:[:::993]>, 0x7ffcd4f4f270) = 0 263563 close(7<TCP:[0.0.0.0:143]>) = 0 263563 close(8<TCPv6:[:::143]>) = 0 263563 close(9<TCP:[0.0.0.0:993]>) = 0 263563 close(10<TCPv6:[:::993]>) = 0 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773128976, u64=94500643575568}}], 10, 179981) = 1 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0f", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\20\0\0ba\4:tZW\323_&\31\205\274\254\242\246\203\342\324O\350\36\206uX\36@/\r"..., 102) = 102 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\24\3\3\0\1", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\1", 1) = 1 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0(", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\224\204\216\367\254\217z\253$S\325\242F\t\256<'vz\3\355\37\fmz\204\261li\307\23\225"..., 40) = 40 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\26\3\3\0\252\4\0\0\246\0\0\1,\0\240q/\300C\32\250\251\253I>\177\205A\3\331&\\"..., 226) = 226 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_ADD, 19<UNIX:[1401333->1401334]>, {EPOLLIN|EPOLLPRI|EPOLLERR|EPOLLHUP, {u32=2773039024, u64=94500643485616}}) = 0 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x55f2a5498db3, 5) = -1 EAGAIN (Resource temporarily unavailable) 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773039024, u64=94500643485616}}], 10, 179974) = 1 263563 read(19<UNIX:[1401333->1401334]>, "* OK [CAPABILITY IMAP4rev1 LITER"..., 1024) = 103 263563 setsockopt(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, SOL_TCP, TCP_CORK, [1], 4) = 0 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\27\3\3\0\177[\202'O\267-\354\\\301@\225\301\363YeQ\213\341\204!x\347\314\305\327\16\366"..., 132) = 132 263563 read(19<UNIX:[1401333->1401334]>, 0x55f2a5492a54, 1024) = -1 EAGAIN (Resource temporarily unavailable) 263563 setsockopt(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, SOL_TCP, TCP_CORK, [0], 4) = 0 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773128976, u64=94500643575568}}], 10, 179973) = 1 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\27\3\3\0!", 5) = 5 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\224\204\216\367\254\217z\254\366W\2765\27\22l\277\262\v\217f\323\254i\272\214\364\264#q\254n\323"..., 33) = 33 263563 sendto(19<UNIX:[1401333->1401334]>, "? logout\n", 9, 0, NULL, 0) = 9 263563 read(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x55f2a5498db3, 5) = -1 EAGAIN (Resource temporarily unavailable) 263563 epoll_wait(14<anon_inode:[eventpoll]>, [{EPOLLIN, {u32=2773038880, u64=94500643485472}}], 10, 177320) = 1 263563 read(20<UNIX:[1401334->1401333]>, "? logout\n", 863) = 9 263563 write(2<pipe:[1445512]>, "\1\010263563 prefix=imap-login: \n", 29) = 29 263563 write(2<pipe:[1445512]>, "\1\002263563 Aborted login (no auth "..., 131) = 131 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, 0x7ffcd4f4f2d0) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 19<UNIX:[1401333->1401334]>, 0x7ffcd4f4f2d0) = 0 263563 write(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>, "\25\3\3\0\32[\202'O\267-\354]\221\344\235?\351'\270g\262\2-\31\216V\236\364\314\253", 31) = 31 263563 close(18<TCP:[64.142.111.79:993->64.142.18.25:39552]>) = 0 263563 close(19<UNIX:[1401333->1401334]>) = 0 263563 setsockopt(20<UNIX:[1401334->1401333]>, SOL_TCP, TCP_CORK, [1], 4) = -1 EOPNOTSUPP (Operation not supported) 263563 write(20<UNIX:[1401334->1401333]>, "* BYE Logging out\r\n? OK Logout c"..., 43) = -1 EPIPE (Broken pipe) 263563 --- SIGPIPE {si_signo=SIGPIPE, si_code=SI_USER, si_pid=263563, si_uid=994} --- 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 20<UNIX:[1401334->1401333]>, 0x7ffcd4f4f2e0) = 0 263563 close(20<UNIX:[1401334->1401333]>) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 17<UNIX:[1347141->1423948]>, 0x7ffcd4f4f280) = 0 263563 close(17<UNIX:[1347141->1423948]>) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 13<UNIX:[1347139->1250858]>, 0x7ffcd4f4f400) = 0 263563 close(13<UNIX:[1347139->1250858]>) = 0 263563 close(11<UNIX:[1347138->1449033]>) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 6<pipe:[1445521]>, 0x7ffcd4f4f420) = 0 263563 epoll_ctl(14<anon_inode:[eventpoll]>, EPOLL_CTL_DEL, 15<pipe:[1347140]>, 0x7ffcd4f4f3f0) = 0 263563 close(15<pipe:[1347140]>) = 0 263563 close(16<pipe:[1347140]>) = 0 263563 close(14<anon_inode:[eventpoll]>) = 0 263563 exit_group(0) = ? 263563 +++ exited with 0 +++ Grant Keller System Operations grant.keller(a)sonic.com

2 1

debian lintian warn: hardening-no-fortify-functions
by A. Schulze 30 Mar '18

30 Mar '18

Hello, to build + packages dovecot I use the usual Debian tool chain. That includes build with selected GCC options and running lintian. I notice since a long time (read: many earlier versions, up to 2.2.35) this lintian warnings: I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/auth N: N: This package provides an ELF binary that lacks the use of fortified libc N: functions. Either there are no potentially unfortified functions called N: by any routines, all unfortified calls have already been fully validated N: at compile-time, or the package was not built with the default Debian N: compiler flags defined by dpkg-buildflags. If built using N: dpkg-buildflags directly, be sure to import CPPFLAGS. N: N: NB: Due to false-positives, Lintian ignores some unprotected functions N: (e.g. memcpy). N: N: Refer to https://wiki.debian.org/Hardening and N: https://bugs.debian.org/673112 for details. N: N: Severity: normal, Certainty: wild-guess N: N: Check: binaries, Type: binary, udeb N: I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/config I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/director I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/gdbhelper I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/imap I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/libdovecot-login.so.0.0.0 I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/libdovecot-storage.so.0.0.0 I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib10_quota_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib20_fts_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib20_replication_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/modules/lib99_welcome_plugin.so I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/quota-status I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/script I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/script-login I: dovecot-core: hardening-no-fortify-functions usr/lib/dovecot/xml2text As you may note, not all binaries are affected. doveadm, doveconf or dovecot aren't for example. My (simplyfied) debian/rules: #!/usr/bin/make -f export DEB_BUILD_MAINT_OPTIONS = hardening=+all DPKG_EXPORT_BUILDFLAGS = 1 include /usr/share/dpkg/buildflags.mk include /usr/share/cdbs/1/rules/debhelper.mk include /usr/share/cdbs/1/class/autotools.mk DEB_DH_STRIP_ARGS = --dbg-package=dovecot-core-dbg This result in that call to configure: CFLAGS="-g -O2 -fdebug-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security" CXXFLAGS="-g -O2 -fdebug-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security" CPPFLAGS="-Wdate-time -D_FORTIFY_SOURCE=2" LDFLAGS="-Wl,-z,relro -Wl,-z,now" /<<PKGBUILDDIR>>/./configure --build=x86_64-linux-gnu --prefix=/usr --includedir="\${prefix}/include" --mandir="\${prefix}/share/man" --infodir="\${prefix}/share/info" --sysconfdir=/etc --localstatedir=/var --libexecdir="\${prefix}/lib/dovecot" --srcdir=. --disable-maintainer-mode --disable-dependency-tracking --disable-silent-rules --libexecdir=/usr/lib --localstatedir=/var --with-statedir=/var/lib/dovecot --with-moduledir=/usr/lib/dovecot/modules --without-docs I may provide a full build log if that would be helpful. To me that looks like not all binaries are build with same CFLAGS / CXXFLAGS / CPPFLAGS / LDFLAGS Andreas

2 2

mail_max_userip_connections from userdb query
by Arkadiusz Miśkiewicz 30 Mar '18

30 Mar '18

Hello. Is still true that mail_max_userip_connections cannot be overriden in userdb query? Want lower global and raise for some logins. https://www.dovecot.org/pipermail/dovecot/2017-July/108520.html -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

2 1

Re: 2.3.1 from ghettoforge-testing causes auth failures
by Fabian A. Santiago 30 Mar '18

30 Mar '18

On March 28, 2018 8:23:42 PM EDT, "Fabian A. Santiago" <fsantiago(a)garbage-juice.com> wrote: >Hello, > >I updated today to v2.3.1 from @gf-testing and it broke my imap auth >mechanism. My dovecot-imap.log reported: > >Temporary auth service failure > >I needed it back up so I downgraded (immediately prior version also >from @gf-testing) and I was fine. > >Centos 7.4 > >I can plan some testing / debug logging time if anyone wishes. > >My doveconf -n is here: > >https://pastebin.com/WVV9JFkT > >Thanks. > > >-- > >Thanks, > >Fabian S. > >OpenPGP: 3C3FA072ACCB7AC5DB0F723455502B0EEB9070FC Resending due to msg not appearing after original send to list. -- Thanks, Fabian S. OpenPGP: 3C3FA072ACCB7AC5DB0F723455502B0EEB9070FC

1 0

Frequentl failures to create /tmp/dovecot.imap
by Peter 29 Mar '18

29 Mar '18

I am using dovecot 2.2.27 with plesk 12 and I have made no modifications to the dovecot config. my log file frequently (but not always!) reports errors that /tmp/dovecot.imap could not be created. The errors don't appear for every imap connect but for about 5% to 10% of the time. I already attempted to solve the problem by adding the following line to /etc/dovecot/dovecot.conf but that did not remove the error: mail_temp_dir = /tmp So why does dovecot mostly work without errors but sometimes fails to create the /tmp/dovecot.imap? ..excerpt from /var/log/syslog... dovecot: service=imap, user=user1(a)mydomain1.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory]: 1 Time(s) dovecot: service=imap, user=users2(a)mydomain2.com, ip=[::1]. Error: Temp file creation to /tmp/dovecot.imap. failed: No such file or directory: 10 Time(s) --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

Release 2.3.1
by aki.tuomi＠dovecot.fi 29 Mar '18

29 Mar '18

Hi! We are releasing v2.3.1, which mostly consists of bug fixes for 2.3.0, and few improvements. This is also available via https://repo.dovecot.org if you want packages. libsodium support didn't get into this build, due to build environment issues, but 2.3.2 will contain it. * Submission server support improvements and bug fixes - Lots of bug fixes to submission server * API CHANGE: array_idx_modifiable will no longer allocate space - Particularly affects how you should check MODULE_CONTEXT result, or use REQUIRE_MODULE_CONTEXT. + mail_attachment_detection_options setting controls when $HasAttachment and $HasNoAttachment keywords are set for mails. + imap: Support fetching body snippets using FETCH (SNIPPET) or (SNIPPET (LAZY=FUZZY)) + fs-compress: Automatically detect whether input is compressed or not. Prefix the compression algorithm with "maybe-" to enable the detection, for example: "compress:maybe-gz:6:..." + Added settings to change dovecot.index* files' optimization behavior. See https://wiki2.dovecot.org/IndexFiles#Settings + Auth cache can now utilize auth workers to do password hash verification by setting auth_cache_verify_password_with_worker=yes. + Added charset_alias plugin. See https://wiki2.dovecot.org/Plugins/CharsetAlias + imap_logout_format and pop3_logout_format settings now support all of the generic variables (e.g. %{rip}, %{session}, etc.) -- Aki Tuomi Dovecot oy

4 9

murmurhash3 test failures on big-endian systems
by Apollon Oikonomopoulos 29 Mar '18

29 Mar '18

Hi, The dovecot 2.3.0.1 Debian package currently fails to build on all big-endian architectures[1], due to murmurhash3 tests failing. The relevant output from e.g. s390x is: test-murmurhash3.c:22: Assert(#8) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#11) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#12) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 murmurhash3 (murmurhash3_32) ......................................... : FAILED test-murmurhash3.c:22: Assert(#1) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#2) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#3) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#4) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#5) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#6) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#7) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#8) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#9) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#10) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#11) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#12) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 test-murmurhash3.c:22: Assert(#13) failed: memcmp(result, vectors[i].result, sizeof(result)) == 0 murmurhash3 (murmurhash3_128) ........................................ : FAILED Looks like the murmurhash3 implementation in Dovecot is currently broken on big-endian systems. Regards, Apollon [1] https://buildd.debian.org/status/package.php?p=dovecot&suite=experimental

3 9

[sieve][pigeonhole] Can't catch stdout for pipe script after upgrade Dovecot 2.2 -> 2.3
by Konstantin Shalygin 29 Mar '18

29 Mar '18

Hi. I use custom script: > require [ "vnd.dovecot.pipe", "variables" ]; > > if address :is :all "from" "snip@snap" > { > pipe "sieve_to_owncloud"; > } sieve_to_owncloud: > DATE=`date +%Y-%m-%d_%H-%M-%S` > PYTHONIOENCODING=utf8 python /opt/sieve-pipe/python-imap-to-owncloud.py \ > --owncloud-host https://<snip-snap> \ > --owncloud-user user \ > --owncloud-password secret \ > --owncloud-path /path/to/here &>/tmp/sieve_logger_py_${DATE} On dovecot 2.2 after script execution I will get plaintext log files on /tmp. After upgrade - don't. I also changed transport to lmtp when upgrade. Any ideas where is my stdout? k

2 2