- dovecot - dovecot.org

Log reopen broken in 2.2.33?
by David Zambonini 07 Nov '17

07 Nov '17

Has re-opening the logfiles broken between 2.2.32 and 2.2.33 releases? Using the same config that I've had for the past 10 or so point releases, /usr/bin/doveadm log reopen works perfectly up until 2.2.32, but with 2.2.33 (and .1 and .2) no new logfiles are created, file descriptors still have the original files open and keep writings to those logs. On an idling test instance, I get: master: Warning: Sent SIGKILL to 1 log processes I can see both SIGUSR1 and SIGKILL generated by the master process, but the current log process doesn't terminate - it receives SIGUSR1, but not SIGKILL. Anyone able to verify this on their own setup? Am I missing a required config change? Using epoll, which hasn't changed. -- David Zambonini

2 3

dovecot-lda without starting dovecot?
by Stephan von Krawczynski 07 Nov '17

07 Nov '17

Hello, we have a setup where SMTP/LDA and POP3/IMAP are on different physical hosts. They share the mail data via an external storage. Now we would like to use dovecot-lda on the smtp host, so we wonder if the lda binary works without starting dovecot from init. As there will be no POP3/IMAP usage on this host it seems unnecessary. Nevertheless we cannot judge if it is still needed for lda&sieve to work. Your opinion? -- Regards, Stephan

4 5

mail_crypt plugin, few questions
by Zbyszek Żółkiewski 06 Nov '17

06 Nov '17

Hi, I have few questions regarding mail_crypt: 1) Is mail_crypt_global_private_key file read upon dovecot start/restart only or it is/can be read in any other time? I have made few tests by starting dovecot and removing master key for decryption - therefore it is not available on the platform - it only reside in memory, removing one of attack vectors 2) Is there planned any “rollout” for key rotation in the feature ? 3) is there any better way to encrypt mails that were sent before enabling mail_crypt ? I have made some simple script to automate and in-place encryption: https://gist.github.com/kolargol/d551d132949068ce6efce7bc85a317cb but maybe there is better way? If someone want to use it, please read code before as it require updating magic(5) local database thanks! _ Zbyszek Żółkiewski

2 5

stats module
by Jeff Abrahamson 06 Nov '17

06 Nov '17

I'd like to monitor my dovecot instance (running on ubuntu 16.04) using telegraf. [T] jeff@nantes-1:log $ dovecot --version 2.2.22 (fe789d2) [T] jeff@nantes-1:log $ To do that, I think I need to use the stats module and get it to talk on port 24242. I've not found enough documentation on this module to feel really comfortable with it, so it doesn't surprise me that I don't have it working. But I'd much appreciate if someone could point me in the right direction. In particular, nothing listens on 24242. # This file is based on https://wiki2.dovecot.org/Statistics # Dovecot v2.1+ supports gathering statistics (CPU, disk usage, etc.) # from mail processes (IMAP, POP3, LMTP, etc.) to the stats # process. The stats process can later be queried what's going on in # the system. With imap_stats plugin you can get per-command level # statistics for IMAP commands. # # There are different "zoom levels" you can look at the statistics: # # * command: Per-IMAP command # * session: Per IMAP/POP3 connection # * user: Per user (all of user's sessions summed up) # * domain: Per domain (all of domain's users summed up) # * ip: Per IP address (all sessions from the IP summed up) # * global: Everything summed up (2.2.16+) mail_plugins = $mail_plugins stats protocol imap { mail_plugins = $mail_plugins imap_stats } plugin { # how often to session statistics (must be set) stats_refresh = 30 secs # track per-IMAP command statistics (optional) stats_track_cmds = yes } # You'll also need to give enough permissions for mail processes to be # able to write to stats-mail fifo. For example if you use a single # "vmail" user for mail access: service stats { fifo_listener stats-mail { user = vmail mode = 0600 } } # Memory usage configuration # The stats process attempts to keep memory usage below a specified # amount. This value is only approximate because of extra overhead # caused by malloc() itself. stats_memory_limit = 16 M # Once the memory limit is reached, oldest statistics are freed from # memory. Different statistics levels have different timeout limits, # which are configured in: stats_command_min_time = 1 mins stats_domain_min_time = 12 hours stats_ip_min_time = 12 hours stats_session_min_time = 15 mins stats_user_min_time = 1 hours service stats { inet_listener { address = 127.0.0.1 port = 24242 } } Thanks in advance. -- Jeff Abrahamson +33 6 24 40 01 57 +44 7920 594 255 http://p27.eu/jeff/

6 11

migrating from maildir to mdbox, preserving pop3 UIDL
by Jan-Pieter Cornet 03 Nov '17

03 Nov '17

Hi, I'm trying to migrate from maildir to mdbox while preserving the pop3 UIDL (and the imap UID). The problem is, for maildir we use (for compatiblity with qpopper): pop3_uidl_format = %f Problem is, as soon as I convert that to mdbox, then whenever a client issues the UIDL command via a POP connection, the connection is closed and this error is displayed in the log: Error: UIDL: File name not found (pop3_uidl_format=%f not supported by storage?) As a workaround, I enabled "pop3_reuse_xuidl = yes", and before conversion I put an X-UIDL: header in the mails. However, since the UIDL is the filename and the filename also contains S=<size>,W=<sizeOnWire>, I need to change the header in such a way that the size and number of lines stay the same. That's... tedious and error-prone. Is there an easier solution, eg teaching 'doveadm sync' to preserve pop3 UIDL somehow? For the record, I currently convert maildir to mdbox using: doveadm -D backup -u user@domain 'doveadm -o mail=mdbox:/path/to/storage:INDEX=/path/to/fast/storage -o plugin/zlib_save=gz -o mail_uid=$UID -o mail_gid=$GID dsync-server' Thanks for any help! -- Jan-Pieter Cornet <johnpc(a)xs4all.net> Systeembeheer XS4ALL Internet bv www.xs4all.nl

1 0

Enabling notification for all users
by Delisle, John 03 Nov '17

03 Nov '17

Hello, I have a domain populated with ~60 users who infrequently receive email. As a result, they rarely check their email, and miss important messages. The users are virtual LDAP users, and each user has an attribute "backupMailAddress" that contains their primary high-traffic email address that they check daily. (i.e. they have an address like John(a)lowtrafficdomain.com<mailto:John@lowtrafficdomain.com>, and a backupMailAddress attribute like john(a)primaryemailaddress.com<mailto:john@primaryemailaddress.com> ) I'm looking to enable new-email notification for all users, and have the notifications go to their high-traffic email address (their backupMailAddress). I know I can do this through individual user managesieve.sieve configurations and have a script that populates this with a notify rule, but this solution doesn't scale well, and doesn't handle new users/ departing users well. Is the a way I could apply this globally, so that if a user has a populated backupMailAddress attribute, a notification is sent there? Thanks John Delisle | Solution Architecture | Ceridian HCM | m: 204.294.5529 (preferred) | w: 204.975.5909 John.Delisle(a)ceridian.com<mailto:John.Delisle@ceridian.com> | www.ceridian.com<http://www.ceridian.com/> Ceridian. Makes Work Life Better(tm) This communication is intended to be received only by the individual[s] or entity[s] to whom or to which it is addressed, and contains information which is confidential, privileged and subject to copyright. Any unauthorized use, copying, review or disclosure is prohibited. Please notify the sender immediately if you have received this communication in error [by calling collect, if necessary] so that we can arrange for its return at our expense. Thank you in advance for your anticipated assistance and cooperation. Cette communication est destinée uniquement à la personne ou à la personne morale à qui elle est adressée. Elle contient de l’information confidentielle, protégée par le secret professionnel et sujette à des droits d'auteurs. Toute utilisation, reproduction, consultation ou divulgation non autorisées sont interdites. Nous vous prions d’aviser immédiatement l’expéditeur si vous avez reçu cette communication par erreur (en appelant à frais virés, si nécessaire), afin que nous puissions prendre des dispositions pour en assurer le renvoi à nos frais. Nous vous remercions à l’avance de votre coopération.

1 0

LDAP Filters as defined for dovecot UserDB and passDB
by Will Merkens 03 Nov '17

03 Nov '17

I have pretty much everything working fine. I have run into one issue with the filters that I am unsure where this a filter is being set. Dovecot 2.2.32 (dfbe293d4) I have setup dovecot-ldap.conf.ext to control my LDAP query's My current layout used filters based on looking at the posixAccount attributes user_filter = (&(objectClass=posixAccount)(uid=%u)) If I connect to a a ldap account that has no posixAccount attributes set I was getting a failure in the logs Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:15:48 mail2 dovecot[28715]: auth: Debug: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): no fields returned by the server Nov 02 14:15:48 mail2 dovecot[28715]: auth: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): unknown user Nov 02 14:15:48 mail2 dovecot[28715]: auth: Error: ldap(sales,192.168.123.39,<fd5mpwVddrvAqHsn>): user not found from userdb I changed the filters thinking I needed to look at the attributes seen by one of these accounts, I used the apache studio to find out what was visible. >From that I saw inetOrgPerson could be used. So I changed the filters. user_filter = (&(objectClass=inetOrgPerson)(uid=%u)) pass_filter = (&(objectClass=inetOrgPerson)(uid=%n)) iterate_filter = (objectClass=inetOrgPerson) Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client in: AUTH 1 PLAIN service=imap secured session=Y0GBzgVdlorAqHsn lip=192.168.123.236 Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): bind search: base=ou=People,dc=userful,dc=ca filter=(&(objectClass=inetOrgPerson)(uid=sales)) Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales; uid unused Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): result: uid=sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: ldap(sales(a)userful.com,192.168.123.39,<Y0GBzgVdlorAqHsn>): username changed sales(a)userful.com -> sales Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: client passdb out: OK 1 user=sales original_user=sales(a)userful.com so far so good but then I get Nov 02 14:26:44 mail2 dovecot[29047]: auth: Debug: master in: REQUEST 3851550721 29049 1 519189df600c24c010b57158ac01c867 session_pid=29073 request_auth_token Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user search: base=ou=People,dc=userful,dc=ca scope=subtree filter=(&(objectClass=posixAccount)(uid=sales)) fields=mail,user_filter Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): Debug: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): no fields returned by the server Nov 02 14:26:44 mail2 dovecot[29047]: auth-worker(29066): ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): unknown user Nov 02 14:26:44 mail2 dovecot[29047]: auth: Error: ldap(sales,192.168.123.39,<Y0GBzgVdlorAqHsn>): user not found from userdb The question then is where did it get filter=(&(objectClass=posixAccount) from since I changed the filters to inetOrgPerson I grep the dovecot settings directory and all My filters are in the one file. The file that hold the ldap settings -- William Merkens IT Support Analyst Userful Corporation +1 403.289.2177 ext.289 +1 866 USERFUL (1-866-873-7385) Suite 300, 736 8th Ave. SW Calgary AB T2P 1H4 Managed Desktops Done Right. http://www.userful.com

3 3

Bug: lmtp proxy does not quote local parts with spaces
by David Zambonini 03 Nov '17

03 Nov '17

There seems to be a bug with RFC822 processing in ltmp proxying that doesn't quote local parts that, for example, contain spaces. director config: director_username_hash = %Ln lmtp_proxy = yes recipient_delimiter = + protocol lmtp { auth_socket_path = director-userdb auth_username_chars = auth_username_format = %Ln passdb { driver = sql args = /etc/director/sql.d/lmtp.ext result_failure = return-fail result_internalfail = return-fail } } lmtp.ext: password_query = SELECT 'y' AS proxy, NULL AS password, 'y' AS nopassword FROM users WHERE userName='%Ln' from exim -> director LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<"deemzed.uk+Junk E-mail"@mailbox.localhost>\r\n DATA\r\n (etc) .\r\n 501 5.5.4 Invalid parameters\r\n QUIT\r\n from director -> dovecot LMTP network dump: MAIL FROM:<test(a)testdomain.com>\r\n RCPT TO:<deemzed.uk+Junk E-mail>\r\n 501 5.5.4 Invalid.parameters\r\n I'll try to pare down a full config for doveconf that displays this behaviour if required, as currently I have sensitive/extraneous information in there, but this seems fairly cut and dried as a bug to me. -- Dave

3 7

dovecot-2.3 (-git) Warning (Was Re: dovecot Digest, Vol 174, Issue 64)
by Reuben Farrelly 02 Nov '17

02 Nov '17

Hi, On 30/10/2017 7:22 PM, dovecot-request(a)dovecot.org wrote: > Message: 6 > Date: Mon, 30 Oct 2017 10:22:42 +0200 > From: Teemu Huovila <teemu.huovila(a)dovecot.fi> > To: dovecot(a)dovecot.org > Subject: Re: dovecot-2.3 (-git) Warning and Fatal Compile Error > Message-ID: <7d2c0b5b-019a-067c-c6be-f36571ed9a96(a)dovecot.fi> > Content-Type: text/plain; charset=utf-8 > > > > On 30.10.2017 09:10, Aki Tuomi wrote: >> >> >> On 30.10.2017 00:23, Reuben Farrelly wrote: >>> Hi Aki, >>> >>> On 30/10/2017 12:43 AM, Aki Tuomi wrote: >>>>> On October 29, 2017 at 1:55 PM Reuben Farrelly >>>>> <reuben-dovecot(a)reub.net> wrote: >>>>> >>>>> >>>>> Hi again, >>>>> >>>>> Chasing down one last problem which seems to have been missed from my >>>>> last email: >>>>> >>>>> On 20/10/2017 9:22 PM, Stephan Bosch wrote: >>>>>> >>>>>> Op 20-10-2017 om 4:23 schreef Reuben Farrelly: >>>>>>> On 18/10/2017 11:40 PM, Timo Sirainen wrote: >>>>>>>> On 18 Oct 2017, at 6.34, Reuben Farrelly <reuben-dovecot(a)reub.net> >>>>>>>> wrote: >>>>> This problem below is still present in 2.3 -git, as of version >>>>> 2.3.devel >>>>> (6fc40674e) >>>>> >>>>>>>> Secondly, this ssl_dh messages is always printed from doveconf: >>>>>>>> >>>>>>>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: You can generate it with: dd >>>>>>>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>>>>>>> -inform der > /etc/dovecot/dh.pem >>>>>>>> >>>>>>>> Yet the file is there: >>>>>>>> >>>>>>>> thunderstorm conf.d # ls -la /etc/dovecot/dh.pem >>>>>>>> -rw-r--r-- 1 root root 769 Oct 19 21:55 /etc/dovecot/dh.pem >>>>>>>> >>>>>>>> And the config is there as well: >>>>>>>> >>>>>>>> thunderstorm dovecot # doveconf -P | grep ssl_dh >>>>>>>> ssl_dh = </etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>>>>>>> doveconf: Warning: You can generate it with: dd >>>>>>>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>>>>>>> -inform der > /etc/dovecot/dh.pem >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> ?? ssl_dh = -----BEGIN DH PARAMETERS----- >>>>>>>> thunderstorm dovecot # >>>>>>>> >>>>>>>> It appears that this warning is being triggered by the presence of >>>>>>>> the ssl-parameters.dat file because when I remove it the warning >>>>>>>> goes away. Perhaps the warning could be made a bit more specific >>>>>>>> about this file being removed if it is not required because at the >>>>>>>> moment the warning message is not related to the trigger. >>>>>>>> >>>>>>>> Thanks, >>>>>>>> Reuben >>>>> Thanks, >>>>> Reuben >>>> It is triggered when there is ssl-parameters.dat file *AND* there is >>>> no ssl_dh=< explicitly set in config file. >>>> >>>> Aki >>> >>> I have this already in my 10-ssl.conf file: >>> >>> lightning dovecot # /etc/init.d/dovecot reload >>> doveconf: Warning: please set ssl_dh=</etc/dovecot/dh.pem >>> doveconf: Warning: You can generate it with: dd >>> if=/var/lib/dovecot/ssl-parameters.dat bs=1 skip=88 | openssl dh >>> -inform der > /etc/dovecot/dh.pem >>> ?* Reloading dovecot configs and restarting auth/login processes >>> ...????? [ ok ] >>> lightning dovecot # >>> >>> However: >>> >>> lightning dovecot # grep ssl_dh conf.d/10-ssl.conf >>> # gives on startup when ssl_dh is unset. >>> ssl_dh=</etc/dovecot/dh.pem >>> lightning dovecot # >>> >>> and the file is there: >>> >>> lightning dovecot # ls -la /etc/dovecot/dh.pem >>> -rw-r--r-- 1 root root 769 Oct 19 19:06 /etc/dovecot/dh.pem >>> lightning dovecot # >>> >>> So it is actually configured and yet the warning still is present. >>> >>> Reuben >> >> Hi! >> >> I gave this a try, and I was not able to repeat this issue. Perhaps you >> are still missing ssl_dh somewhere? >> >> Aki >> > Hello > > Just a guess, but at this point I would recommend reviewing the output of "doveconf -n" to make sure the appropriate settings are present. > > br, > Teemu I still can't see anything amiss. Here's the output from doveconf -n: # 2.3.devel (65ef8330e): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.devel (f4659224) # OS: Linux 4.9.56-x86_64-linode87 x86_64 Gentoo Base System release 2.4.1 auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln doveadm_password = # hidden, use -P to show it first_valid_uid = 1000 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep last_valid_uid = 1100 login_log_format_elements = user=<%u> auth-method=%m remote=%r local=%l %k login_trusted_networks = 192.168.0.0/16 mail_location = maildir:~/Maildir mail_plugins = stats notify replication fts fts_lucene managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = failure_show_msg=yes %s driver = pam } plugin { fts = lucene fts_autoindex = yes fts_languages = en fts_lucene = whitespace_chars=@. mail_replica = tcps:inside-mail.reub.net:4813 replication_full_sync_interval = 4 hours sieve = file:~/sieve;active=~/.dovecot.sieve stats_refresh = 30 secs stats_track_cmds = yes } protocols = imap lmtp sieve recipient_delimiter = - service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = root } unix_listener replication-notify { mode = 0666 user = root } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { mode = 0777 } } service doveadm { inet_listener { address = 2400:8901:e001:3a::20 port = 4813 ssl = yes } user = root } service imap { executable = imap postlogin } service lmtp { inet_listener lmtp { address = ::1 port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } } service postlogin { executable = script-login -d rawlog } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } service stats { fifo_listener stats-mail { mode = 0666 } } ssl_ca = </etc/ssl/misc/alphassl_intermediate_ca.crt ssl_cert = </etc/ssl/dovecot/*.reub.net.crt ssl_cipher_list = DEFAULT:!EXPORT:!LOW:!MEDIUM:!MD5 ssl_client_ca_dir = /etc/ssl/certs ssl_client_ca_file = /etc/ssl/misc/alphassl_intermediate_ca.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_protocols = !SSLv2 !SSLv3 !TLSv1 userdb { driver = passwd } protocol lmtp { mail_plugins = stats notify replication fts fts_lucene sieve ssl_dh = # hidden, use -P to show it } protocol !indexer-worker { ssl_dh = # hidden, use -P to show it } protocol lda { mail_plugins = stats notify replication fts fts_lucene sieve ssl_dh = # hidden, use -P to show it } protocol imap { mail_plugins = stats notify replication fts fts_lucene imap_stats ssl_dh = # hidden, use -P to show it } protocol sieve { ssl_dh = # hidden, use -P to show it } protocol pop3 { ssl_dh = # hidden, use -P to show it } And showing with -P as an example: protocol pop3 { ssl_dh = -----BEGIN DH PARAMETERS----- MIIBCAKCAQEAo4NpFI4fpUe65FVv1hotVS9pTUbCKs1ypGRZcFMXzpsXPqHU+M4s ... AAAAAAAAAAAAAAAAAAAAAAAAAAA= -----END DH PARAMETERS----- There is a single set of valid DH parameters for every protocol as listed above. It seems odd that ssl_dh is defined all of these protocols specifically too. This specific per-protocol definition of ssl_dh isn't specified in any config file. Reuben

3 4

Replication to wrong mailbox
by Ralf Becker 02 Nov '17

02 Nov '17

It happened now twice that replication created folders and mails in the wrong mailbox :( Here's the architecture we use: - 2 Dovecot (2.2.32) backends in two different datacenters replicating via a VPN connection - Dovecot directors in both datacenters talks to both backends with vhost_count of 100 vs 1 for local vs remote backend - backends use proxy dict via a unix domain socket and socat to talk via tcp to a dict on a different server (kubernetes cluster) - backends have a local sqlite userdb for iteration (also containing home directories, as just iteration is not possible) - serving around 7000 mailboxes in a roughly 200 different domains Everything works as expected, until dict is not reachable eg. due to a server failure or a planed reboot of a node of the kubernetes cluster. In that situation it can happen that some requests are not answered, even with Kubernetes running multiple instances of the dict. I can only speculate what happens then: it seems the connection failure to the remote dict is not correctly handled and leads to situation in which last mailbox/home directory is used for the replication :( When it happened the first time we attributed it to the fact that the Sqlite database at that time contained no home directory information, which we fixed after. This first time (server failure) took a couple of minutes and lead to many mailboxes containing mostly folders but also some new arrived mails belonging to other mailboxes/users. We could only resolve that situation by rolling back to a zfs snapshot before the downtime. The second time was last Friday night during a (much shorter) reboot of a Kubernetes node and lead only to a single mailbox containing folders and mails of other mailboxes. That was verified by looking at timestamps of directories below $home/mdbox/mailboxes and files in $home/mdbox/storage. I can not tell if adding the home directory to the Sqlite database or the shorter time of the failure limited the wrong replication to a single mailbox. Can someone with more knowledge of the Dovecot code please check/verify how replication deals with failures in proxy dict. I'm of cause happy to provide more information of our configuration if needed. Here is an exert of our configuration (full doveconf -n is attached): passdb { args = /etc/dovecot/dovecot-dict-master-auth.conf driver = dict master = yes } passdb { args = /etc/dovecot/dovecot-dict-auth.conf driver = dict } userdb { driver = prefetch } userdb { args = /etc/dovecot/dovecot-dict-auth.conf driver = dict } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } dovecot-dict-auth.conf: uri = proxy:/var/run/dovecot_auth_proxy/socket:backend password_key = passdb/%u/%w user_key = userdb/%u iterate_disable = yes dovecot-dict-master-auth.conf: uri = proxy:/var/run/dovecot_auth_proxy/socket:backend password_key = master/%{login_user}/%u/%w iterate_disable = yes dovecot-sql.conf: driver = sqlite connect = /etc/dovecot/users.sqlite user_query = SELECT home,NULL AS uid,NULL AS gid FROM users WHERE userid = '%n' AND domain = '%d' iterate_query = SELECT userid AS username, domain FROM users -- Ralf Becker EGroupware GmbH [www.egroupware.org] Handelsregister HRB Kaiserslautern 3587 Geschäftsführer Birgit und Ralf Becker Leibnizstr. 17, 67663 Kaiserslautern, Germany Telefon +49 631 31657-0

3 5