- dovecot - dovecot.org

Key metrics to monitor for dovecot at CloudWatch
by Sivakumar Vadivel 24 Jul '24

24 Jul '24

Hello Team, Configured dovecot mail server and SES will receive and forward to SNS topic. Lambda subscribed to the topic and it will receive the mail and write to the EFS volume. EFS volume mounted on both dovecot and lambda. Also enabled AWS Cloudwatch to monitor overall infra. I'm going to enable anomaly detection at Cloudwatch and I want to know the list of key metrics to monitor. I'm thinking of the following metrics. 1. No of bounce 2. PublishFailed & Success 3. EFS disk storage Please suggest the other key metrics, so that I can enable anomaly detection to understand and create the cloudwatch alarm.

1 0

Dovecot Stats Plugin
by Adam Miller 23 Jul '24

23 Jul '24

Hello again everyone! I am trying to get the “doveadm stats dump” command to work and even though it does not error, there are no stats. When I try to enable the stats, I get the following error: “Error: Plugin 'stats' not found from directory /usr/lib/dovecot/modules” which is correct, the “stats” plugin does not exist. I do have “/usr/lib/dovecot/stats”. Here’s my configuration: Dovecot Version: 2.3.16 Operating System: Ubuntu 22.04.1 Packages Installed: - dovecot-antispam - dovecot-core - dovecot-imapd - dovecot-lmtpd - dovecot-mysql - dovecot-pop3d - dovecot-sieve Packages Available: - dovecot-auth-lua - dovecot-dev - dovecot-fts-xapian - dovecot-gssapi - dovecot-ldap - dovecot-lucene - dovecot-managesieved - dovecot-pgsql - dovecot-solr - dovecot-sqlite - dovecot-submissiond Dovecot Configuration (without stats enabled): # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.16 (09c29328) # OS: Linux 6.5.0-1020-aws x86_64 Ubuntu 22.04.4 LTS nfs4 # Hostname: ec2-us-east-1a-arda-mail-001.ardaemail.com auth_mechanisms = plain login auth_worker_max_count = 5 base_dir = /var/run/dovecot debug_log_path = /var/log/dovecot/debug.log default_internal_group = ardaemail default_internal_user = ardaemail dict { quota = mysql:/etc/dovecot/inc.d/inc.quota.user.sql.conf } hostname = = mail.ardaemail.com info_log_path = /var/log/dovecot/info.log instance_name = ec2-us-east-1a-arda-mail-001.ardaemail.com listen = 172.16.0.200 log_path = /var/log/dovecot/general.log login_greeting = Welcome to ArdaEmail mail_gid = ardaemail mail_location = maildir:/mnt/mail/%d/%n mail_max_userip_connections = 1000 mail_plugins = " quota mailbox_alias" mail_uid = ardaemail maildir_stat_dirs = yes namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { auto = no special_use = \Drafts } mailbox Junk { auto = no autoexpunge = 90 days special_use = \Junk } mailbox SPAM { auto = subscribe autoexpunge = 90 days } mailbox Sent { auto = no special_use = \Sent } mailbox Trash { auto = no autoexpunge = 30 days special_use = \Trash } prefix = } passdb { args = /etc/dovecot/inc.d/inc.sql.conf driver = sql } plugin { imapsieve_mailbox1_before = file:/etc/dovecot/sieve.d/spam/learn-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve.d/spam/learn-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * mailbox_alias_new = Junk Email mailbox_alias_new2 = Junk E-mail mailbox_alias_new3 = Sent Messages mailbox_alias_new4 = Sent Items mailbox_alias_new5 = Deleted Items mailbox_alias_old = Junk mailbox_alias_old2 = Junk mailbox_alias_old3 = Sent mailbox_alias_old4 = Sent mailbox_alias_old5 = Trash quota = dict:User Quota::proxy::quota quota_exceeded_message = Mailbox is full and cannot receive any more emails quota_status_nouser = DUNNO quota_status_success = DUNNO quota_warning = bytes=95%% quota-warning 95 %u quota_warning2 = bytes=85%% quota-warning 85 %u quota_warning3 = bytes=75%% quota-warning 75 %u recipient_delimiter = + sieve_after = /etc/dovecot/sieve.d/after/ sieve_before = /etc/dovecot/sieve.d/before/ sieve_extensions = +spamtest +spamtestplus +virustest +notify +imapflags sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_quota_max_storage = 0 sieve_spamtest_max_header = X-Spamd-Result: -?[[:digit:]]+\.[[:digit:]]+ / (-?[[:digit:]]+\.[[:digit:]]) sieve_spamtest_status_header = X-Spamd-Result: (-?[[:digit:]]+\.[[:digit:]]+) / -?[[:digit:]]+\.[[:digit:]] sieve_spamtest_status_type = score } postmaster_address = postmaster(a)ardaemail.com protocols = imap lmtp service auth-worker { group = ardaemail user = ardaemail } service auth { group = ardaemail unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } unix_listener auth-userdb { group = ardaemail mode = 0666 user = ardaemail } user = ardaemail } service imap-login { inet_listener imap { port = 0 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 8 service_count = 0 } service imap { vsz_limit = 4 G } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0666 user = postfix } } service pop3-login { inet_listener pop3 { port = 0 } inet_listener pop3s { port = 0 } } service quota-status { executable = /usr/lib/dovecot/quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { user = postfix } } service quota-warning { executable = script /etc/dovecot/bin/quota-warning.sh unix_listener quota-warning { group = ardaemail mode = 0666 user = ardaemail } } service submission-login { inet_listener submission { port = 0 } } ssl = required ssl_cert = </etc/letsencrypt/live/mail.ardaemail.com/fullchain.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes userdb { args = /etc/dovecot/inc.d/inc.sql.conf driver = sql } protocol imap { mail_plugins = " quota mailbox_alias imap_sieve imap_quota" } protocol lmtp { mail_plugins = " quota mailbox_alias sieve" } The “stats” plugin does not seem to be found anywhere from my searching. Any help is greatly appreciated. I would like to be able to turn on the INET listener to hit the stats via an HTTP request. Thank you!

3 7

Dovecot proxy/director/replicator upgrade path
by Andrea Gabellini 23 Jul '24

23 Jul '24

Hello, I manage a Dovecot installation version 2.3.4.1 with a pair of proxy/director in front and two backends that use the replicator plugin to synchronize emails between them. I would like to update all 4 machines and would like to understand if I can directly jump to the latest version 2.3.21 and if there is a logical sequence to follow, such as updating the backends first and then the frontends or vice versa. Thanks, Andrea -- __________________________ E-mail Signatures are usually made to compensate for the boring contents of the letter. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

1 0

Seeking Guidance on Dovecot Configuration, Security, and Performance Optimization
by Selena Thomas 23 Jul '24

23 Jul '24

Hi everyone, I am setting up Dovecot for the first time and could use some guidance. I have a couple of questions::- -Configuration Basics: What are the essential configuration files I need to focus on for a basic setup: ?? -Security Best Practices: What steps should I take to ensure my Dovecot server is secure, especially regarding -authentication and SSL/TLS: ?? -Performance Tuning: Are there any tips for optimizing performance for a small to medium-sized deployment: ?? I appreciate any advice or resources you can point me towards. Thanks in advance for your help! With Regards, Selena [flutter/https://www.igmguru.com/digital-marketing-programming/flutter-train…]

2 1

Seeking Guidance on Dovecot Configuration, Security, and Performance Optimization
by Selena Thomas 23 Jul '24

23 Jul '24

Hi everyone, I am setting up Dovecot for the first time and could use some guidance. I have a couple of questions::- -Configuration Basics: What are the essential configuration files I need to focus on for a basic setup: ?? -Security Best Practices: What steps should I take to ensure my Dovecot server is secure, especially regarding -authentication and SSL/TLS: ?? -Performance Tuning: Are there any tips for optimizing performance for a small to medium-sized deployment: ?? I appreciate any advice or resources you can point me towards. Thanks in advance for your help! With Regards, Selena https://www.igmguru.com/digital-marketing-programming/flutter-training/

1 0

Seeking Guidance on Dovecot Configuration, Security, and Performance Optimization
by Selena Thomas 23 Jul '24

23 Jul '24

Hi everyone, I am setting up Dovecot for the first time and could use some guidance. I have a couple of questions::- -Configuration Basics: What are the essential configuration files I need to focus on for a basic setup: ?? -Security Best Practices: What steps should I take to ensure my Dovecot server is secure, especially regarding -authentication and SSL/TLS: ?? -Performance Tuning: Are there any tips for optimizing performance for a small to medium-sized deployment: ?? I appreciate any advice or resources you can point me towards. Thanks in advance for your help! With Regards, Selena [https://www.igmguru.com/digital-marketing-programming/flutter-training/flut…]

1 0

auth-worker doesn't systematically log the IP
by Yassine Chaouche 23 Jul '24

23 Jul '24

Dear list, look at this grep auth-worker | nl output from my dovecot log : 166 Jul 22 15:49:47 auth-worker(24409): Info: sql(hakim.boukhadra(a)domain.tld): unknown user 167 Jul 22 15:49:47 auth-worker(13026): Info: sql(prtg(a)domain.tld): unknown user 168 Jul 22 15:53:00 auth-worker(13026): Info: sql(feriel.abbas(a)domain.tld,10.10.10.19): Password mismatch 169 Jul 22 15:53:15 auth-worker(13026): Info: sql(feriel.abbas(a)domain.tld,10.10.10.19): Password mismatch 170 Jul 22 15:55:26 auth-worker(13026): Info: sql(it_sys(a)domain.tld): unknown user 171 Jul 22 15:59:30 auth-worker(13026): Info: sql(radioaintemouchent.domain.tld,10.10.10.19): unknown user 172 Jul 22 15:59:43 auth-worker(13026): Info: sql(mouadoussama(a)radioalgerie.dz): unknown user 173 Jul 22 16:00:38 auth-worker(13026): Info: sql(it_mam(a)domain.tld): unknown user 174 Jul 22 16:00:58 auth-worker(13026): Info: sql(it_mam(a)domain.tld): unknown user 175 Jul 22 16:02:01 auth-worker(13026): Info: sql(it_mam(a)domain.tld): unknown user 176 Jul 22 16:09:35 auth-worker(13026): Info: sql(it_mam(a)domain.tld): unknown user 177 Jul 22 16:09:42 auth-worker(13026): Info: sql(prtg(a)domain.tld): unknown user 178 Jul 22 16:10:11 auth-worker(13026): Info: sql(it_mam(a)domain.tld): unknown user 179 Jul 22 16:15:37 auth-worker(13026): Info: sql(it_sys(a)domain.tld): unknown user 180 Jul 22 16:26:55 auth-worker(13026): Info: sql(it_mam(a)domain.tld): unknown user 181 Jul 22 16:32:01 auth-worker(13026): Info: sql(it_mam(a)domain.tld): unknown user 182 Jul 22 16:35:37 auth-worker(19555): Info: sql(it_sys(a)domain.tld): unknown user As you can see, sometimes the IP addresses of the dubious login attempts are noted, other times this crucial piece of evidence is conspicuously absent. I am wondering what is the source of all those login attempts? or could those be mere username lookups instead to test for mail deliverability? Many thanks, -- yassine -- sysadm +213-779 06 06 23 http://about.me/ychaouche Looking for side gigs.

2 2

doveadm: SSL handshake failed - wrong version number
by Rachel Roch 19 Jul '24

19 Jul '24

When attempting a doveadm backup, e.g. : doveadm -D backup -Ru user tcp:foo.example.com:12345 I am getting the following error : Error: SSL handshake failed: SSL_accept() failed: error:0A00010B:SSL routines::wrong version number There is nothing wrong with my SSL config because, e.g. openssl s_client -connect localhost:993 works on the source host. So I don't know why doveadm doesn't work. My SSL config is: ssl = required ssl_cert = </etc/ssl/foo.example.com.pem ssl_key = </etc/ssl/foo.example.com.priv ssl_client_ca_dir = /etc/ssl/certs ssl_min_protocol = TLSv1.2 ssl_prefer_server_ciphers = yes ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305 service doveadm { inet_listener { port = 12345 ssl = yes } }

2 1

dovecot.list.index.log
by Joan Moreau 19 Jul '24

19 Jul '24

HI Is it safe to delete the file dovecot.list.index.log (as I am still struggling with using any protocol for network storage of the emails (dbox), and now dovecot complains that my dovecot.list.index.log is corrupted) Thank you

3 3

AD authentication with dovecot not working.
by hkhk_exact10 19 Jul '24

19 Jul '24

Hi All, I am trying to setup AD auth with dovecot and have tried a lot of options but still no success. I am using a bind account for AD authentication and the users are not posix accounts. I am not using the ssl cert as its not available, so disabling it. I have used the similar settings with saslauthd+postfix and it worked, not sure what am I doing wrong with configurations.. My configuration is as follows: # dovecot --version 2.3.16 (7e2e900c1a) # dovecot -n # 2.3.16 (7e2e900c1a): /etc/dovecot/dovecot.conf # OS: Linux 5.14.0-474.el9.x86_64 x86_64 CentOS Stream release 9 # Hostname: mail-centos.example.com auth_mechanisms = plain login first_valid_uid = 1000 listen = * mail_location = maildir:~/Maildir mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } } service pop3-login { process_limit = 500 } service submission-login { inet_listener submission { port = 587 } } ssl_cert = </etc/ssl/example.com/server.pem ssl_cipher_list = PROFILE=SYSTEM ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } ------------------ # cat /etc/dovecot/dovecot-ldap.conf.ext uris = ldaps://10.1.85.11 dn = CN=s_linux_bind,OU=Global,OU=Services,OU=Accounts,OU=root,DC=example,DC=com dnpass = xxxxx auth_bind = yes tls_require_cert = never debug_level = 1 ldap_version = 3 base = dc=example,dc=com scope = subtree deref = never user_filter = (&(objectClass=user)(sAMAccountName=%u)) --------------- Error logs: dovecot[6600]: auth: Error: ** ld 0x556695138d90 Outstanding Requests: dovecot[6600]: auth: Error: * msgid 2, origid 2, status RequestCompleted dovecot[6600]: auth: Error: outstanding referrals 2, parent count 2 dovecot[6600]: auth: Error: * msgid 3, origid 2, status InProgress dovecot[6600]: auth: Error: outstanding referrals 0, parent count 2 dovecot[6600]: auth: Error: * msgid 5, origid 2, status InProgress dovecot[6600]: auth: Error: outstanding referrals 0, parent count 1 dovecot[6600]: auth: Error: ld 0x556695138d90 request count 3 (abandoned 0) dovecot[6600]: auth: Error: ** ld 0x556695138d90 Response Queue: dovecot[6600]: auth: Error: Empty dovecot[6600]: auth: Error: ld 0x556695138d90 response count 0 dovecot[6600]: auth: Error: ldap_chkResponseList ld 0x556695138d90 msgid -1 all 0 dovecot[6600]: auth: Error: ldap_chkResponseList returns ld 0x556695138d90 NULL dovecot[6600]: auth: Error: ldap_int_select postfix/submission/smtpd[6602]: warning: unknown[10.1.70.75]: SASL LOGIN authentication failed: Connection lost to authentication server postfix/submission/smtpd[6602]: disconnect from unknown[10.1.70.75] ehlo=2 starttls=1 auth=0/1 quit=1 commands=4/5 Attaching the detailed error logs. --------- saslauthd settings which worked: # cat /etc/saslauthd.conf ldap_servers: ldaps://10.1.85.11 ldap_search_base: dc=wtg,dc=zone ldap_filter: (sAMAccountName=%u) ldap_bind_dn: CN=s_linux_bind,OU=Global,OU=Services,OU=Accounts,OU=root,DC=example,DC=com ldap_password: xxxx ldap_tls_reqcert: never Regards, Sandeep

4 4