- dovecot - dovecot.org

Dovecot v2.4.1 released
by Aki Tuomi 31 Mar '25

31 Mar '25

Hi! We arey happy to release Dovecot v2.4.1! Some IMPORTANT things to notice (still): - We have changed the signing key for 2.4 going forward, releases are signed with EF0882079FD4ED32BF8B23B2A1B09EF84EDC5219, which can be found at https://repo.dovecot.org/DOVECOT-REPO-GPG-2.4 and is signed with the previous key. The old key has been renamed to https://repo.dovecot.org/DOVECOT-REPO-GPG-2.3. - New 2.4 packages **are not** compatible with old 2.3 configuration, please carefully review https://doc.dovecot.org/2.4.1/installation/upgrade/2.3-to-2.4.html before installing the new packages. - We are happy to provide experimental arm64 support in the form of a Docker image. There are now three kinds of images, latest, latest-dev and latest-root. - The latest docker image is now ran rootless, with UID 1000 as vmail. Please take this into consideration when upgrading. The latest-root image still runs as root. Latest 2.3 image can be used with tag 2.3-latest still We won't be sending separate mail about Pigeonhole anymore as we will release one anyways when we release Dovecot, and Pigeonhole versioning has been changed to match Dovecot versioning. Source codes available at - https://www.dovecot.org/releases/2.4/dovecot-2.4.1.tar.gz - https://www.dovecot.org/releases/2.4/dovecot-2.4.1.tar.gz.sig - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.1.tar.gz - https://pigeonhole.dovecot.org/releases/2.4/dovecot-pigeonhole-2.4.1.tar.gz… Binary packages in https://repo.dovecot.org/ Docker images in https://hub.docker.com/r/dovecot/dovecot Kind regards, Aki Tuomi Open-Xchange oy --- Dovecot Core NEWS ----------------- * auth: Change unix_listener/auth-userdb/group = $SET:default_internal_group This change needs dovecot_config_version=2.4.1. * auth: lua - Remove support for single string result. * imap: Unconditionally advertise SPECIAL-USE capability. * lib-dcrypt: Install dcrypt_openssl.so into dovecot modules directory. * lib-master: For glibc, default MALLOC_MMAP_THRESHOLD_=131072. * lib-storage: Change default mail_cache_fields to: hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order. This change needs dovecot_config_version=2.4.1. * lib-var-expand: Use moduledir instead of pkglibdir for crypt. * lmtp: Change the default lmtp_user_concurrency_limit to 10. This change needs dovecot_config_version=2.4.1. * lmtp: Change the default service_restart_request_count to 1. This change needs dovecot_config_version=2.4.1. + auth: Allow configuring passdb/userdb sql to use auth-workers. + config: Add default group @mailbox_defaults = english. + config: Improve "Unknown setting" error with more details and suggestions. + doveconf: Add -U parameter to ignore unknown settings in config file. + fts-flatcurve: Support lock files in VOLATILEDIR. + imap-acl: Add support for the IMAP LIST-MYRIGHTS capability (RFC 8440). + imap-client: Support ANONYMOUS authentication. + imap: Implement support for the REPLACE capability. - auth: ldap - Passdb fields were ignored with passdb_ldap_bind_userdn=yes. - auth: lua - Fix error result handling in lua passdb/userdb. - auth: oauth2 - When building oauth2 failure reply, memory would leak. - config: local_name handling would work wrong with multiple names and wildcards. - fts-flatcurve: A potential crash could occur when searching virtual mailboxes. Fixes: Panic: file fts-search.c: line 87 (level_scores_add_vuids): assertion failed: (array_count(&vuids_arr) == array_count(&br->scores)) - fts-flatcurve: Maybe queries were done wrong. - fts-flatcurve: Non-selectable mailboxes were not ignored when doing optimize/rescan. - fts-flatcurve: Signal 11 crash could happen with fts rescan. - fts: Fix crash caused by event object lifecycle mishandling. - imap-hibernate: Client counters would get reset on unhibernation, affecting imap_logout_format variables. - imap: Crash would occur with Maildir when trying to send INPROGRESS during mailbox syncing. - ldap: Dovecot could not be compiled without LDAP. - lib-dcrypt: Output stream encryption can cause assert crash if attempting to encrypt over 64 GiB of data with GCM. This is still not supported with GCM, but it fails better. - lib-http: HTTP client context memory usage was increasing. - lib-http: Pipeline corruption could happen after 100 Continue response. - lib-settings: Variable expansion initialization could crash with Panic: file settings.c: line 1560 (settings_var_expand_init_add): assertion failed: (I_MAX(num_tables, num_provs) == num_ctx) - lib-smtp: Pipelining initial SASL response after AUTH was broken. - lib-var-expand: If filter failed, memory leak would occur. - lib-var-expand: Older bison versions did not have error symbol for handling causing unexpected behaviour on the parser on error conditions. - quota: Quota calculations had minor bugs causing small errors. Pigeonhole NEWS --------------- - global: Fix settings handling bugs. Especially %variables weren't working in various settings. - ldap: Pigeonhole could not be built without LDAP.

5 8

Bug: Inconsistency in configuration between various clients.
by Louis Schmitz 27 Mar '25

27 Mar '25

We found out about this through a misconfiguration in our web panel. In the main config file the following line includes a subdirectory; !include conf.d/*.conf The web panel created the following two relevant configuration snippets in /etc/dovecot/conf.d/ 11-plesk-security-ssl.conf > ssl_dh=</opt/psa/etc/dhparams2048.pem > ssl_min_protocol=TLSv1.2 > ssl_cipher_list=EECDH+AESGCM+AES128:EECDH+AESGCM+AES256:EECDH+CHACHA20:EECDH+SHA256+AES128:EECDH+SHA384+AES256:EECDH+SHA1+AES128:EECDH+SHA1+AES256:EECDH+HIGH:AESGCM+AES128:AESGCM+AES256:CHACHA20:SHA256+AES128:SHA256+AES256:SHA1+AES128:SHA1+AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK:!KRB5:!aECDH:!kDH:!EDH > ssl_prefer_server_ciphers=yes > ssl=yes > ssl_cert=</etc/dovecot/private/dovecot.pem > ssl_key=</etc/dovecot/private/dovecot.pem This sets a server wide certificate as being the cert in /etc/dovecot/private/dovecot.pem. Let's say our main server domain is 'acme.com' for example, its 'hostname' (linux hostname) is for example 's02.acme.com'. Then it would also create 14-plesk-sni-mail.acme.com.conf, containing something akin to: > local_name mail.acme.com { > ssl_cert = </opt/psa/var/certificates/scf7b9lcY > ssl_key = </opt/psa/var/certificates/scf7b9lcY > } These point to the ssl cert and key configured for that specific vhost (not the entire server), which can be different from that configured for the server. When some clients connected to the server (connecting to mail.acme.com) it would serve the /etc/dovecot/private/dovecot.pem certificate. This was renewed and the clients would work without issue. Other clients, however, used the certificate at /opt/psa/var/certificates/scf7b9lcY. This certificate is supposed to be the same, but expired and wasn't renewed along with the other one. This was tricky to figure out since the problems did not appear on our side, only when looking at a client. Once I went around the panel GUI and into the actual dovecot configuration files I found the culprit(s). I think, but do not know, that it could be related to which IP protocol (V4 or V6) is used to connect to dovecot. All clients who failed happened to connect over V6. The cases that did not used V4. This seems entirely unrelated and strange behaviour that must be a bug of some kind. Either both should use the one certificate, or the other, or there should be an error or warning if local_name includes a variant subdomain of the server name, the latter in addition to making a consistent choice. It appears that sometimes the first relevant ssl_key and ssl_cert are used, and other times the second when the option is included twice in the configuration, pointing to different matching certificates/keys. It's not apparently a race condition: The behaviour is very consistent for the same client connecting.

1 0

Input Buffer Full with OAuth login
by Brad Koehn 26 Mar '25

26 Mar '25

I’m running Dovecot 2.3.21.1 using Authentik for OAuth authentication. I’m using SOGo 5.12.0 as a UI, also with OAuth authentication. When SOGo connects to Dovecot and authenticates with OAuth, it fails and the following is logged: imap-login: Info: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=10.42.1.1, lip=10.42.1.196, TLS, session=<NZnp7zMxQuMKKgEB> My dovecot-oauth2.conf.ext looks like this: openid_configuration_url = https://auth.koehn.com/application/o/dovecot-oauth2/.well-known/openid-conf… introspection_url = https://auth.koehn.com/application/o/introspect/ introspection_mode = post client_id = [redacted] client_secret = [redacted] username_attribute = email debug = yes rawlog_dir = /tmp/oauth2 And my auth-oauth2.conf.ext looks like this: passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/conf.d/dovecot-oauth2.conf.ext } I’m using the Dovecot Debian packages from repo.dovecot.org. I’ve tried auth for introspection_mode, to no avail. There’s nothing extra in the logs when I turn on debug, and there’s nothing logged in the /tmp/oauth2 directory either, FWIW. Any ideas? — Brad I’m running Dovecot 2.3.21.1 using Authentik for OAuth authentication. I’m using SOGo 5.12.0 as a UI, also with OAuth authentication. When SOGo connects to Dovecot and authenticates with OAuth, it fails and the following is logged: imap-login: Info: Disconnected: Input buffer full (no auth attempts in 0 secs): user=<>, rip=10.42.1.1, lip=10.42.1.196, TLS, session=<NZnp7zMxQuMKKgEB> My dovecot-oauth2.conf.ext looks like this: openid_configuration_url = https://auth.koehn.com/application/o/dovecot- oauth2/.well-known/openid-configuration introspection_url = https://auth.koehn.com/application/o/introspect/ introspection_mode = post client_id = [redacted] client_secret = [redacted] username_attribute = email debug = yes rawlog_dir = /tmp/oauth2 And my auth-oauth2.conf.ext looks like this: passdb { driver = oauth2 mechanisms = xoauth2 oauthbearer args = /etc/dovecot/conf.d/dovecot-oauth2.conf.ext } I’m using the Dovecot Debian packages from repo.dovecot.org. I’ve tried auth for introspection_mode, to no avail. There’s nothing extra in the logs when I turn on debug, and there’s nothing logged in the /tmp/ oauth2 directory either, FWIW. Any ideas? — Brad

3 3

Dovecot and IP check at the user connection (auth-worker problems: no IP...)
by ik7xja＠gmail.com 26 Mar '25

26 Mar '25

Hi to all, I'm using Postfix and Dovecot for my little server. I'm experimenting many false user caming fron the entire world to access to my account. I'm only in a country and I would like to restrict accesso to user coming from IPs located in my country. Since the access is granteg by mysql and SQL in passdb and userdb, I've created a table with only the IPs of my country and check the user remote IP. The trick is working well when I try to access to my account beacuse the variable "%r" is not empy... But... But when there is a delivery of a new message, the auth-worker have no IP and the check fail: auth-worker<5>: sql(user(a)my.domain): unknown user and the new message, coming in my box from other servers come back to the sender as "unknown user" There is a way to user a different query in this auth-worker process (I guess is using the same SQL with the IP-check)? Or "force" an IP (like 127.0.0.1) in the auth-worker invocation? Thanks in advance for any advice.

1 1

Indexer-worker panic and killed with signal 6 in 2.4 and Solr 9
by Zakaria 26 Mar '25

26 Mar '25

Hi there, I'm reporting what I think is a bug. I just configured dovecot 2.4 with fts_solr plugin running on solr 9.8 release and it throws this panic and sigfaults one after another. Mar 24 11:58:48 server dovecot: indexer-worker(hi(a)zakaria.website): Panic: settings_get() - event has no SETTINGS_EVENT_ROOT Mar 24 11:58:48 server dovecot: indexer-worker(hi(a)zakaria.website): Error: Raw backtrace: libdovecot.so.0(backtrace_append+0x39) [0x7f2fe692e549] -> libdovecot.so.0(backtrace_get+0x22) [0x7f2fe692e682] -> libdovecot.so.0(+0x13ccbc) [0x7f2fe693ccbc] -> libdovecot.so.0(+0x13cd51) [0x7f2fe693cd51] -> libdovecot.so.0(+0x6bfff) [0x7f2fe686bfff] -> libdovecot.so.0(+0x5ed08) [0x7f2fe685ed08] -> libdovecot.so.0(+0xba555) [0x7f2fe68ba555] -> libdovecot.so.0(settings_get+0x46) [0x7f2fe68bb576] -> libdovecot.so.0(ssl_client_settings_get+0x66) [0x7f2fe69196e6] -> libdovecot.so.0(http_client_init_ssl_ctx+0xa9) [0x7f2fe68d40a9] -> libdovecot.so.0(http_client_host_submit_request+0x9d) [0x7f2fe68d37dd] -> libdovecot.so.0(http_client_request_submit+0x34) [0x7f2fe68c70c4] -> libdovecot.so.0(+0xc7cf0) [0x7f2fe68c7cf0] -> libdovecot.so.0(http_client_request_send_payload+0x2e) [0x7f2fe68c7d3e] -> lib21_fts_solr_plugin.so(solr_connection_post_more+0x39) [0x7f2fe6e3af89] -> lib21_fts_solr_plugin.so(+0x4469) [0x7f2fe6e38469] -> lib20_fts_plugin.so(fts_backend_update_build_more+0x4a) [0x7f2fe6e5930a] -> lib20_fts_plugin.so(+0xa419) [0x7f2fe6e5a419] -> lib20_fts_plugin.so(+0xae8a) [0x7f2fe6e5ae8a] -> lib20_fts_plugin.so(fts_build_mail+0x57) [0x7f2fe6e5b827] -> lib20_fts_plugin.so(+0x119e1) [0x7f2fe6e619e1] -> libdovecot-storage.so.0(mail_precache+0x2c) [0x7f2fe6cd6b1c] -> indexer-worker(+0x3b8a) [0x559c6212fb8a] -> indexer-worker(+0x44b5) [0x559c621304b5] -> indexer-worker(+0x466b) [0x559c6213066b] -> libdovecot.so.0(connection_input_default+0x199) [0x7f2fe6933439] -> libdovecot.so.0(io_loop_call_io+0x67) [0x7f2fe69534d7] -> libdovecot.so.0(io_loop_handler_run_internal+0x12a) [0x7f2fe6954c0a] -> libdovecot.so.0(io_loop_handler_run+0x50) [0x7f2fe6953580] -> libdovecot.so.0(io_loop_run+0x48) [0x7f2fe6953758] Mar 24 11:58:48 server dovecot: indexer-worker(hi(a)zakaria.website): Fatal: master: service(indexer-worker): child 28216 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Mar 24 11:59:13 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 11:59:13 server dovecot: decode2text: Error: /usr/libexec/dovecot/decode2text.sh: line 59: 29469 Done find . -name "$name" -print0 Mar 24 11:59:13 server dovecot: decode2text: Error: 29470 Done(123) | xargs -0 cat Mar 24 11:59:13 server dovecot: decode2text: Error: 29471 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:40 server dovecot: decode2text: Error: /usr/libexec/dovecot/decode2text.sh: line 59: 32540 Done find . -name "$name" -print0 Mar 24 12:00:40 server dovecot: decode2text: Error: 32541 | xargs -0 cat Mar 24 12:00:40 server dovecot: decode2text: Error: 32542 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:40 server dovecot: decode2text: Error: /usr/libexec/dovecot/decode2text.sh: line 59: 32555 Done find . -name "$name" -print0 Mar 24 12:00:40 server dovecot: decode2text: Error: 32556 | xargs -0 cat Mar 24 12:00:40 server dovecot: decode2text: Error: 32557 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:49 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 12:00:49 server dovecot: decode2text: Error: /usr/libexec/dovecot/decode2text.sh: line 59: 32832 Done find . -name "$name" -print0 Mar 24 12:00:49 server dovecot: decode2text: Error: 32833 Done(123) | xargs -0 cat Mar 24 12:00:49 server dovecot: decode2text: Error: 32834 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:52 server dovecot: imap-login: Login aborted: Connection closed (disconnected during TLS handshake) (tls_handshake_not_finished): user=, rip=20.65.195.124, lip=77.68.117.221, TLS handshaking: Connection closed, session= Mar 24 12:00:53 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 12:00:53 server dovecot: decode2text: Error: /usr/libexec/dovecot/decode2text.sh: line 59: 32955 Done find . -name "$name" -print0 Mar 24 12:00:53 server dovecot: decode2text: Error: 32956 Done(123) | xargs -0 cat Mar 24 12:00:53 server dovecot: decode2text: Error: 32957 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:57 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 12:00:57 server dovecot: decode2text: Error: /usr/libexec/dovecot/decode2text.sh: line 59: 33039 Done find . -name "$name" -print0 Mar 24 12:00:57 server dovecot: decode2text: Error: 33040 Done(123) | xargs -0 cat Mar 24 12:00:57 server dovecot: decode2text: Error: 33041 Segmentation fault | $libexec_dir/xml2text These are my relevant fts configuration:- mail_plugins = mail_compress fts fts_solr fts_autoindex = yes fts solr { url = SOLR_URL batch_size = 1000 } fts_decoder_driver = script fts_decoder_script_socket_path = decode2text service indexer-worker { vsz_limit = 4G } service decode2text { executable = script /usr/libexec/dovecot/decode2text.sh user = dovecot unix_listener decode2text { mode = 0666 } } language "en" { default = yes } I think anyone can reproduce the panic using following commands while targeting a mailbox which contains as many emails as possible maybe 20K. Commit and optimise dovecot core. /opt/solr-9.8.1/bin/solr api --solr-url "..../solr/dovecot/update?commit=true" /opt/solr-9.8.1/bin/solr api --solr-url "..../solr/dovecot/update?optimize=true" Rescan and index the mailbox. doveadm fts rescan -u hi(a)zakaria.website doveadm index -u hi(a)zakaria.website -q "*" I tested this on dovecot released solrconfig.xml for solr 9. Note, current solr 9 has breaking changes to the config, I rectified using the following, please refer to https://solr.apache.org/guide/solr/latest/upgrade-notes/major-changes-in-so…. Appending n solr deployment configuration following two lines:- SOLR_OPTS="$SOLR_OPTS -Dsolr.config.lib.enabled=true" SOLR_MODULES=extraction,ltr,analysis-extras Also, additional note there are some other minor log warning, but weren't problematic. With thanks. Zak. [https://api.zakaria.website/users/hi@zakaria.website/ f6ebf9ed031e93b5ed35f78ceb338278(a)zakaria.website/30db6adddb640dbc14bfad.png] Hi there, I'm reporting what I think is a bug. I just configured dovecot 2.4 with fts_solr plugin running on solr 9.8 release and it throws this panic and sigfaults one after another. Mar 24 11:58:48 server dovecot: indexer-worker(hi(a)zakaria.website)<28216>: Panic: settings_get() - event has no SETTINGS_EVENT_ROOT Mar 24 11:58:48 server dovecot: indexer-worker(hi(a)zakaria.website)<28216>: Error: Raw backtrace: libdovecot.so.0(backtrace_append+0x39) [0x7f2fe692e549] - > libdovecot.so.0(backtrace_get+0x22) [0x7f2fe692e682] -> libdovecot.so.0 (+0x13ccbc) [0x7f2fe693ccbc] -> libdovecot.so.0(+0x13cd51) [0x7f2fe693cd51] - > libdovecot.so.0(+0x6bfff) [0x7f2fe686bfff] -> libdovecot.so.0(+0x5ed08) [0x7f2fe685ed08] -> libdovecot.so.0(+0xba555) [0x7f2fe68ba555] - > libdovecot.so.0(settings_get+0x46) [0x7f2fe68bb576] -> libdovecot.so.0 (ssl_client_settings_get+0x66) [0x7f2fe69196e6] -> libdovecot.so.0 (http_client_init_ssl_ctx+0xa9) [0x7f2fe68d40a9] -> libdovecot.so.0 (http_client_host_submit_request+0x9d) [0x7f2fe68d37dd] -> libdovecot.so.0 (http_client_request_submit+0x34) [0x7f2fe68c70c4] -> libdovecot.so.0(+0xc7cf0) [0x7f2fe68c7cf0] -> libdovecot.so.0(http_client_request_send_payload+0x2e) [0x7f2fe68c7d3e] -> lib21_fts_solr_plugin.so(solr_connection_post_more+0x39) [0x7f2fe6e3af89] -> lib21_fts_solr_plugin.so(+0x4469) [0x7f2fe6e38469] - > lib20_fts_plugin.so(fts_backend_update_build_more+0x4a) [0x7f2fe6e5930a] - > lib20_fts_plugin.so(+0xa419) [0x7f2fe6e5a419] -> lib20_fts_plugin.so(+0xae8a) [0x7f2fe6e5ae8a] -> lib20_fts_plugin.so(fts_build_mail+0x57) [0x7f2fe6e5b827] - > lib20_fts_plugin.so(+0x119e1) [0x7f2fe6e619e1] -> libdovecot-storage.so.0 (mail_precache+0x2c) [0x7f2fe6cd6b1c] -> indexer-worker(+0x3b8a) [0x559c6212fb8a] -> indexer-worker(+0x44b5) [0x559c621304b5] -> indexer-worker (+0x466b) [0x559c6213066b] -> libdovecot.so.0(connection_input_default+0x199) [0x7f2fe6933439] -> libdovecot.so.0(io_loop_call_io+0x67) [0x7f2fe69534d7] - > libdovecot.so.0(io_loop_handler_run_internal+0x12a) [0x7f2fe6954c0a] - > libdovecot.so.0(io_loop_handler_run+0x50) [0x7f2fe6953580] -> libdovecot.so.0 (io_loop_run+0x48) [0x7f2fe6953758] Mar 24 11:58:48 server dovecot: indexer-worker(hi(a)zakaria.website)<28216>: Fatal: master: service(indexer-worker): child 28216 killed with signal 6 (core dumps disabled - https://dovecot.org/bugreport.html#coredumps) Mar 24 11:59:13 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 11:59:13 server dovecot: decode2text: Error: /usr/libexec/dovecot/ decode2text.sh: line 59: 29469 Done find . -name "$name" -print0 Mar 24 11:59:13 server dovecot: decode2text: Error: 29470 Done(123) | xargs - 0 cat Mar 24 11:59:13 server dovecot: decode2text: Error: 29471 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:40 server dovecot: decode2text: Error: /usr/libexec/dovecot/ decode2text.sh: line 59: 32540 Done find . -name "$name" -print0 Mar 24 12:00:40 server dovecot: decode2text: Error: 32541 | xargs -0 cat Mar 24 12:00:40 server dovecot: decode2text: Error: 32542 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:40 server dovecot: decode2text: Error: /usr/libexec/dovecot/ decode2text.sh: line 59: 32555 Done find . -name "$name" -print0 Mar 24 12:00:40 server dovecot: decode2text: Error: 32556 | xargs -0 cat Mar 24 12:00:40 server dovecot: decode2text: Error: 32557 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:49 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 12:00:49 server dovecot: decode2text: Error: /usr/libexec/dovecot/ decode2text.sh: line 59: 32832 Done find . -name "$name" -print0 Mar 24 12:00:49 server dovecot: decode2text: Error: 32833 Done(123) | xargs - 0 cat Mar 24 12:00:49 server dovecot: decode2text: Error: 32834 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:52 server dovecot: imap-login: Login aborted: Connection closed (disconnected during TLS handshake) (tls_handshake_not_finished): user=<>, rip=20.65.195.124, lip=77.68.117.221, TLS handshaking: Connection closed, session= Mar 24 12:00:53 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 12:00:53 server dovecot: decode2text: Error: /usr/libexec/dovecot/ decode2text.sh: line 59: 32955 Done find . -name "$name" -print0 Mar 24 12:00:53 server dovecot: decode2text: Error: 32956 Done(123) | xargs - 0 cat Mar 24 12:00:53 server dovecot: decode2text: Error: 32957 Segmentation fault | $libexec_dir/xml2text Mar 24 12:00:57 server dovecot: decode2text: Error: cat: write error: Broken pipe Mar 24 12:00:57 server dovecot: decode2text: Error: /usr/libexec/dovecot/ decode2text.sh: line 59: 33039 Done find . -name "$name" -print0 Mar 24 12:00:57 server dovecot: decode2text: Error: 33040 Done(123) | xargs - 0 cat Mar 24 12:00:57 server dovecot: decode2text: Error: 33041 Segmentation fault | $libexec_dir/xml2text These are my relevant fts configuration:- mail_plugins = mail_compress fts fts_solr fts_autoindex = yes fts solr { url = SOLR_URL batch_size = 1000 } fts_decoder_driver = script fts_decoder_script_socket_path = decode2text service indexer-worker { vsz_limit = 4G } service decode2text { executable = script /usr/libexec/dovecot/decode2text.sh user = dovecot unix_listener decode2text { mode = 0666 } } language "en" { default = yes } I think anyone can reproduce the panic using following commands while targeting a mailbox which contains as many emails as possible maybe 20K. Commit and optimise dovecot core. /opt/solr-9.8.1/bin/solr api --solr-url "..../solr/dovecot/update?commit=true" /opt/solr-9.8.1/bin/solr api --solr-url "..../solr/dovecot/ update?optimize=true" Rescan and index the mailbox. doveadm fts rescan -u hi(a)zakaria.website doveadm index -u hi(a)zakaria.website -q "*" I tested this on dovecot released solrconfig.xml for solr 9. Note, current solr 9 has breaking changes to the config, I rectified using the following, please refer to https://solr.apache.org/guide/solr/latest/upgrade- notes/major-changes-in-solr-9.html. Appending n solr deployment configuration following two lines:- SOLR_OPTS="$SOLR_OPTS -Dsolr.config.lib.enabled=true" SOLR_MODULES=extraction,ltr,analysis-extras Also, additional note there are some other minor log warning, but weren't problematic. With thanks. Zak.

2 2

Dovecot 2.4: Segfault for "doveadm proxy kick foo bar"
by Michael Goth 25 Mar '25

25 Mar '25

Hi! The following command segfaults on Dovecot 2.4: #> doveadm proxy kick foo bar Segmentation fault (core dumped) Giving only one user (doveadm proxy kick foo) works: #> doveadm proxy kick foo 0 connections kicked It does not matter if the users actually exist on the server (so the above command can be used verbatim). This used to work in Dovecot 2.3. I'm running Dovecot 2.4 on Ubuntu 24.04, installed from repo.dovecot.org. Regards, Michael

2 1

Re: lost emails - Opened mail because: snippet ?
by Michael Slusarz 24 Mar '25

24 Mar '25

> On 03/24/2025 9:41 AM MDT Arkadiusz Miśkiewicz via dovecot <dovecot(a)dovecot.org> wrote: > > Debug: Mailbox INBOX: saving UID 0: Opened mail because: snippet (Mail > not cached, highest cached seq=20 uid=31: reset_id=1742577355) > > "Opened mail because: snippet " - what does this mean? It is reading the mail to create the preview text, which is then stored in the indexes. michael

2 1

lost emails - Opened mail because: snippet ?
by Arkadiusz Miśkiewicz 24 Mar '25

24 Mar '25

Hello. I'm tracking a weird case where dovecot (it's 2.3.21.1) looses incoming emails. Email is delivered over LMTP with full success (in theory). From lmtp raw log: 1742822341.735762 250 2.0.0 <examplelogin@mbox> +LpAG8Vb4Wc9OAAA9fPEKQ Saved 1742822341.735918 221 2.0.0 Bye Log says it got saved: Mar 24 14:19:01 mbox dovecot[22785]: lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, msgid=<XYZ...1611.EURP189.PROD.OUTLOOK.COM>, storage_id=1742822341.M462393P14397.mbox,S=139039,W=141006, delivery_status=saved mail to INBOX There is a file name but # find /var/mail/examplelogin/ -name '1742822341.M462393P14397.mbox*' # nothing. Well, someone could delete or move this email, right? But no, that's not the case, only pop3 sessions around: > Mar 24 14:18:43 mbox dovecot[22785]: pop3(examplelogin): pid=<24041> session=<rX98cRYxIvlTDCet>, Disconnected: Logged out top=0/0, retr=0/0, del=0/20, size=5204114, in=24, out=1002 > Mar 24 14:19:01 mbox dovecot[22785]: lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, msgid=<XYZ...1611.EURP189.PROD.OUTLOOK.COM>, storage_id=1742822341.M462393P14397.mbox,S=139039,W=141006, delivery_status=saved mail to INBOX > Mar 24 14:19:43 mbox dovecot[22785]: pop3-login: Login: user=<examplelogin>, method=PLAIN, rip=1.1.1.1, rport=63799, lip=2.2.2.2, lport=110, mpid=27238, session=<GPgZdRYxN/lTDCet> > Mar 24 14:19:44 mbox dovecot[22785]: pop3(examplelogin): pid=<27238> session=<GPgZdRYxN/lTDCet>, Disconnected: Logged out top=0/0, retr=0/0, del=0/20, size=5204114, in=24, out=1002 Note the same number of total mails in del log before and after problematic mail delivery - "del=0/20", so dovecot doesn't see that new mail (there are few pop3 logins after that - all with del=0/20) So the conclusion is that the file, with email, was not created on the filesystem. LMTP raw session log, debug session log, nothing weird - below. BUT there is one thing: Debug: Mailbox INBOX: saving UID 0: Opened mail because: snippet (Mail not cached, highest cached seq=20 uid=31: reset_id=1742577355) "Opened mail because: snippet " - what does this mean? Out of 50k mails delivered only 160 have that "Opened mail because: snippet" and by that I mean that logged for lmtp like: Mar 24 07:25:18 lmtp(xyz): pid=<28535> session=<SPx6Ds764Gd3bwAA9fPEKQ>, Debug: Mailbox INBOX: saving UID 0: Opened mail because: snippet (Mail not cached, highest cached seq=291 uid=4094: reset_id=1579231568) The rest have "UID 0: Opened mail because: mail stream". Started looking at these snipped entries. It seems that almost every mail with this logged is missing on the filesystem(!). Huh, what could be happening here? debug log (is there a way to enable even more detailed/low level log?): > Mar 24 14:19:01 lmtp(examplelogin@mbox): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: auth-master: userdb lookup(examplelogin@mbox): Started userdb lookup > Mar 24 14:19:01 lmtp(examplelogin@mbox): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: auth-master: userdb lookup(examplelogin@mbox): auth USER input: examplelogin home=/var/mail/examplelogin/ mail=maildir:/var/mail/examplelogin/:CONTROL=/var/lib/dovecot/control/examplelogin:VOLATILEDIR=/var/lib/dovecot/control/examplelogin:INDEX=/var/lib/dovecot/control/examplelogin uid=1234 gid=7890 sieve_enabled=no > Mar 24 14:19:01 lmtp(examplelogin@mbox): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: auth-master: userdb lookup(examplelogin@mbox): Finished userdb lookup (username=examplelogin home=/var/mail/examplelogin/ mail=maildir:/var/mail/examplelogin/:CONTROL=/var/lib/dovecot/control/examplelogin:VOLATILEDIR=/var/lib/dovecot/control/examplelogin:INDEX=/var/lib/dovecot/control/examplelogin uid=1234 gid=7890 sieve_enabled=no) > Mar 24 14:19:01 lmtp(examplelogin@mbox): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: changed username to examplelogin > Mar 24 14:19:01 lmtp(examplelogin@mbox): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: lmtp-server: conn unix:pid=25252,uid=8 [89]: rcpt examplelogin@mbox: Added userdb setting: mail=maildir:/var/mail/examplelogin/:CONTROL=/var/lib/dovecot/control/examplelogin:VOLATILEDIR=/var/lib/dovecot/control/examplelogin:INDEX=/var/lib/dovecot/control/examplelogin > Mar 24 14:19:01 lmtp(examplelogin@mbox): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: lmtp-server: conn unix:pid=25252,uid=8 [89]: rcpt examplelogin@mbox: Added userdb setting: plugin/sieve_enabled=no > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Effective uid=1234, gid=7890, home=/var/mail/examplelogin/ > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota root: name=Calkowita przestrzen dla serwera backend=fs args=group > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota grace: root=Calkowita przestrzen dla serwera bytes=0 (10%) > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota root: name=Twoja przestrzen e-mail backend=fs args=user > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota grace: root=Twoja przestrzen e-mail bytes=0 (10%) > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/mail/examplelogin/:CONTROL=/var/lib/dovecot/control/examplelogin:VOLATILEDIR=/var/lib/dovecot/control/examplelogin:INDEX=/var/lib/dovecot/control/examplelogin > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: maildir++: root=/var/mail/examplelogin, index=/var/lib/dovecot/control/examplelogin, indexpvt=, control=/var/lib/dovecot/control/examplelogin, inbox=/var/mail/examplelogin, alt= > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota add mailbox dir = /var/mail/examplelogin > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota block device = /dev/mapper/vg_sys-lv_home > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota mount point = /home > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota mount type = xfs > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: fts: Indexes disabled for namespace '' > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota: quota_over_flag check: quota_over_script unset - skipping > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota: quota_over_flag check: quota2_over_script unset - skipping > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: User session is finished > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Effective uid=1234, gid=7890, home=/var/mail/examplelogin/ > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota root: name=Calkowita przestrzen dla serwera backend=fs args=group > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota grace: root=Calkowita przestrzen dla serwera bytes=0 (10%) > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota root: name=Twoja przestrzen e-mail backend=fs args=user > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Quota grace: root=Twoja przestrzen e-mail bytes=0 (10%) > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Namespace inbox: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes location=maildir:/var/mail/examplelogin/:CONTROL=/var/lib/dovecot/control/examplelogin:VOLATILEDIR=/var/lib/dovecot/control/examplelogin:INDEX=/var/lib/dovecot/control/examplelogin > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: maildir++: root=/var/mail/examplelogin, index=/var/lib/dovecot/control/examplelogin, indexpvt=, control=/var/lib/dovecot/control/examplelogin, inbox=/var/mail/examplelogin, alt= > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota add mailbox dir = /var/mail/examplelogin > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota block device = /dev/mapper/vg_sys-lv_home > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota mount point = /home > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota-fs: fs quota mount type = xfs > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Namespace : type=private, prefix=, sep=, inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: none: root=, index=, indexpvt=, control=, inbox=, alt= > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: fts: Indexes disabled for namespace '' > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota: quota_over_flag check: quota_over_script unset - skipping > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: quota: quota_over_flag check: quota2_over_script unset - skipping > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: duplicate db: Initialize > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: sieve: Pigeonhole version 0.5.21.1 (49005e73) initializing > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: sieve: Sieve is disabled for this user > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: duplicate db: Cleanup > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Mailbox INBOX: Mailbox opened > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Mailbox INBOX: saving UID 0: Opened mail because: snippet (Mail not cached, highest cached seq=20 uid=31: reset_id=1742577355) > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Mailbox INBOX: Adding field hdr.Subject to cache for the first time (uid=0) > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: Mailbox INBOX: Mailbox opened > Mar 24 14:19:01 lmtp(examplelogin): pid=<14397> session=<+LpAG8Vb4Wc9OAAA9fPEKQ>, Debug: User session is finished ps. logins, uid, gid changed to example values -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

Cannot retrieve private key from LDAP
by luis.neapolis＠gmail.com 22 Mar '25

22 Mar '25

Hello, I have a problem setting the mail-crypt plugin using global keys. First of all I prepare keys: penssl ecparam -genkey -name secp521r1 | openssl pkey -aes-256-cbc -passout pass:foobar | base64 -w0 >ecprivkey.pem cat ecprivkey_b64.pem | openssl ec -pubout > ecpubkey.pem Now I would like to pass these values using the LDAP passdb. My conf is: userdb ldap { driver = ldap ldap_filter = ... ldap filter ... fields { ... other fields ... crypt_global_public_key_file = inline:%{ldap:pubkey_in_pem_base64} crypt_global_private_key/main/crypt_private_key_file=inline:%{ldap:key_in_pem_base64} crypt_global_private_key/main/private_key_password=foobar } } mail_plugins { mail_crypt = yes } crypt_global_private_key main { # create the filter, but leave its settings empty } when I receive an email I have: lmtp(127004): Fatal: Raw user initialization failed: mail_crypt_plugin: main: Couldn't parse private key : Unknown key format I want to let you know that if I give same keys, without base64 encoding, to configuration: crypt_global_private_key main { crypt_private_key_file= /path/to/key } and: userdb ldap { ..... fields { ... other fields ... # crypt_global_private_key/main/crypt_private_key_file=inline:%{ldap:key_in_pem_base64} ... other fields ... } } all works. If I try to retrieve values from LDAP all is ok with: doveadm user user@domain Any suggestion? Thank you.

1 0

dovecot 2.4 : quota config help
by ollie＠ik.me 20 Mar '25

20 Mar '25

Hello ! My dovecot config seems to work ok for managing email, using sieve filters or encrypting emails, but I can't figure out how to use the new quota config. I'm scratching my head over that one since last week and I don't see where I have done a mistake. The quota is properly reported in sql, but when I cross the percentage limit that is supposed to trigger the quota-warning, nothing happens. And I can see that too in the logs compared to my previous 2.3 install where lmtp-server was doing its job to check the quota and trigger the warning. I'm sure that I've forgotten something quite stupid, but at that point I'm not sure if I ever will be able to spot it (and I'm also wondering if that could be a bug... in that case I could scratch my head forever without any hope of finding what's wrong). I'd post my dovecot config if some of you feel like helping, but there are so many posts with configs that do not have answer that I'm wondering if it's useful. So, should I post it or not ?

1 2