- dovecot - dovecot.org

Problem with permissions of the logfile
by Andreas Meyer 06 Nov '15

06 Nov '15

Hello! I want to have dovecot log into a separate file and set log_path = /var/log/dovecot instead of log_path = syslog Dovecot does not start if I do this. Tried to change permissions and overschip of the file, no luck, ha. Deleted it in the hope dovecot creates it but no. If I set log_path = syslog dovecot starts and I see it is running as # ps aux |grep dove root 2429 0.2 0.0 3416 2568 ? Ss 16:42 0:00 /usr/sbin/dovecot -F dovecot 2431 0.0 0.0 3100 2080 ? S 16:42 0:00 dovecot/anvil root 2432 0.0 0.0 3228 2316 ? S 16:42 0:00 dovecot/log root 2434 0.0 0.0 4220 3300 ? S 16:42 0:00 dovecot/config What must be done to have doveot log into the specified file? Greetings Andreas

1 0

Patch for Dovecot 2.2.19 compilation failure
by Hammer, Adam 06 Nov '15

06 Nov '15

I’m almost embarrassed to submit the following patch. ==== cut here ==== --- dovecot-2.2.19/src/lib/bits.h.orig Thu Mar 19 08:42:32 2015 +++ dovecot-2.2.19/src/lib/bits.h Thu Nov 5 15:10:35 2015 @@ -10,7 +10,9 @@ #include <limits.h> #include <stddef.h> -#include <stdint.h> +#ifdef HAVE_STDINT_H +# include <stdint.h> +#endif #define UINT64_SUM_OVERFLOWS(a, b) \ (a > (uint64_t)-1 - b)

2 1

replication delays
by djk 05 Nov '15

05 Nov '15

I have two dovecot instances that replicate to each other. Mail arrives into "post" and it is generally accessed via IMAP on "france". Changes (moves/expunge etc) on "france" seem to replicate back to "post" more or less immediately. But this seems to happen only for this user. (Some) other users' (e.g. me) mail generally replicates more or less immediately in both directions. Nov 5 17:40:55 post dovecot: lmtp(willem@xxx): xF9mK6eUO1YsFQAAdYyp2A: sieve: msgid=<20151105173923.14970.95605@ssa-app-xxx>: stored mail into mailbox 'SSA' Nov 5 17:41:00 post dovecot: lmtp(willem@xxx): yV9mK6eUO1YsFQAAdYyp2A: sieve: msgid=<20151105173924.14970.91073@ssa-app-xxx>: stored mail into mailbox 'SSA' Nov 5 20:39:09 france dovecot: dsync-server(willem): save: box=SSA, uid=3130, msgid=<20151105173923.14970.95605@ssa-app-xxx>, size=9724 Nov 5 20:39:09 france dovecot: dsync-server(willem): save: box=SSA, uid=3131, msgid=<20151105173924.14970.91073@ssa-app-xxx>, size=9197 Any suggestions as to where to start looking? As you can see I am using 2.2.18 with mdbox and a simple all vmail based system with not many users. I am not seeing any error messages in my mail logs that suggest there any delays happening. Although I have seen a few things like this happening from time to time a busier account: Nov 5 12:12:07 france dovecot: dsync-server(djk): Error: Couldn't lock /home/imap/djk/.dovecot-sync.lock: Timed out after 30 seconds Nov 5 12:12:13 france dovecot: dsync-server(djk(a)tobit.co.uk): Error: Couldn't lock /home/imap/djk/.dovecot-sync.lock: Timed out after 30 seconds Nov 5 12:16:49 france dovecot: dsync-server(djk): Error: Couldn't lock /home/imap/djk/.dovecot-sync.lock: Timed out after 30 seconds root@france:/var/log# dovecot -n # 2.2.18: /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.8 (0c4ae064f307+) # OS: Linux 3.13.0-66-generic x86_64 Ubuntu 14.04.3 LTS auth_verbose = yes doveadm_password = <some secret string or other> first_valid_uid = 2000 imapc_features = rfc822.size fetch-headers imapc_host = <imap hostname> imapc_port = 993 imapc_ssl = imaps imapc_ssl_verify = no imapc_user = %n lda_mailbox_autocreate = yes login_greeting = IMAP ready. mail_attachment_dir = %h/attachments mail_attachment_min_size = 64 k mail_location = mdbox:%h:INBOX=%h/mail mail_plugins = " fts fts_lucene mail_log notify notify replication" mail_prefetch_count = 20 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mdbox_rotate_size = 10 M namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { fts = lucene fts_lucene = whitespace_chars=@. mail_log_events = delete undelete expunge copy save mailbox_delete mailbox_rename mailbox_create mail_log_fields = uid box msgid size mail_replica = tcps:post:<same port as doveadm port> sieve = file:~/sieve;active=~/.dovecot.sieve } postmaster_address = postmaster(a)tobit.co.uk protocols = " imap lmtp sieve sieve" service aggregator { fifo_listener replication-notify-fifo { mode = 0666 user = vmail } unix_listener replication-notify { mode = 0666 user = vmail } } service auth { unix_listener exim-auth { group = Debian-exim mode = 0660 user = Debian-exim } } service config { unix_listener config { mode = 0666 user = vmail } } service doveadm { inet_listener { port = <some port or other> ssl = yes } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service lmtp { inet_listener lmtp { address = 127.0.0.1 port = <another port> } unix_listener lmtp { mode = 0666 } user = vmail } service managesieve-login { inet_listener sieve { port = <sieve port> } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 100 } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0600 user = vmail } } ssl_cert = </etc/dovecot/tobit.crt ssl_client_ca_dir = /etc/ssl/certs ssl_key = </etc/dovecot/private/tobit.key ssl_protocols = !SSLv3 !SSLv2 userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lmtp { mail_plugins = sieve }

1 0

Re: ssl-params: slow startup (patch for consideration)
by Joseph Tam 05 Nov '15

05 Nov '15

A. Schulze writes: > precomputing ssl-params is also possible without patching but it's a > little bit tricky > ... > Long version in german: https://andreasschulze.de/dovecot/ssl-params Nice. (You should probably point out to ensure ssl_parameters_regenerate is zero, otherwise all this work will get wiped out!) Joseph Tam <jtam.home(a)gmail.com>

2 1

Fw: new message
by Doug Wierenga 05 Nov '15

05 Nov '15

Hello! New message, please read <http://battersandco.com/meeting.php?e> Doug Wierenga

1 0

Fw: new message
by terry＠dop.com 05 Nov '15

05 Nov '15

Hello! New message, please read <http://profi2w.com.br/forget.php?80> terry(a)dop.com

1 0

ldap and proxy/proxy_maybe
by jjhoffart 04 Nov '15

04 Nov '15

Hello, I am trying to setup dovecot director and am receiving a lot of "Aborted login (proxy dest auth failed)" and "error proxying loops to itself" messages in the dovecot log. I don't fully understand the dovecot-ldap.conf file config? could someone please let me know if the following is correct. If so what could be causing the errors mentioned above, if not what needs to be corrected? hosts = 127.0.0.1:389 ldap_version = 3 auth_bind = yes dn = cn=vmail,dc=something,dc=somewhere dnpass = hi89Dfnptc55jRWG9oLQJUfWOH0CgV base = o=domains,dc=campus,dc=local scope = subtree deref = never # Below two are required by command 'doveadm mailbox ...' iterate_attrs = mail=user iterate_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)) user_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u)))) user_attrs = mail=user,homeDirectory=home,=mail=maildir:~/Maildir/,mailQuota=quota_rule=*:bytes=%$ # Used for dn lookup pass_filter = (&(objectClass=mailUser)(accountStatus=active)(enabledService=mail)(enabledService=%Ls%Lc)(|(mail=%u)(&(enabledService=shadowaddress)(shadowAddress=%u)))) pass_attrs = mail=user,userPassword=password,someAttribute=proxy,hostName=host default_pass_scheme = CRYPT

1 0

ssl-params: slow startup (patch for consideration)
by Joseph Tam 04 Nov '15

04 Nov '15

Based on the recent found weaknesses in DH key exchange, http://weakdh.org/ I increased ssl_dh_parameters_length to 2048 bits, and found waited for 5+ minutes for dovecot to come back online after a restart. Unless you got a fast machine, the initialization of DH parameters can exceed your patience. Regeneration may not be a problem (if ssl_parameters_regenerate=0 or if Dovecot uses old parameters until regeneration finishes), but for cold starts, the server can be tied up for a few minutes creating DH parameters while clients queue up. I ran "openssl dhparam 2048" and got wildly varying run times of 1m45s, 11m56s, 0.4s, 2m19s, 3h23s. Most of the time was spent testing primality of candidate p *and* (p-1)/2 -- so called "safe prime". If you're unlucky, this can take a long time. However, it appears "safe" primes are not what they're cracked up to be -- they offer some guarantees, but are not safer than non-safe primes. Creating DH parameters without requiring primality of (p-1)/2 (i.e. what "openssl dhparam -dsaparam" does) results in much lower run-time bounds. I cribbed some OpenSSL code to create this (untested) patch. -------------------------------------------------------------------------------- --- iostream-openssl-params.c~ Tue Nov 3 16:08:38 2015 +++ iostream-openssl-params.c Tue Nov 3 15:43:39 2015 @@ -6,5 +6,2 @@ -/* 2 or 5. Haven't seen their difference explained anywhere, but 2 is the - default.. */ -#define DH_GENERATOR 2 @@ -14,2 +11,3 @@ DH *dh; + DSA *dsa; unsigned char *p; @@ -17,3 +15,13 @@ - dh = DH_generate_parameters(bitsize, DH_GENERATOR, NULL, NULL); + dsa = DSA_generate_parameters(bitsize, NULL, 0, NULL, NULL, NULL, NULL); + if (dsa == NULL) { + *error_r = t_strdup_printf( + "DSA_generate_parameters(bits=%d) failed: %s", + bitsize, openssl_iostream_error()); + return -1; + } + + dh = DSA_dup_DH(dsa); + DSA_free(dsa); + if (dh == NULL) { @@ -20,4 +28,4 @@ *error_r = t_strdup_printf( - "DH_generate_parameters(bits=%d, gen=%d) failed: %s", - bitsize, DH_GENERATOR, openssl_iostream_error()); + "DSA_dup_DH() failed: %s", + openssl_iostream_error()); return -1; -------------------------------------------------------------------------------- The other way to prevent long startup times is to pre-compute the DH parameter using "openssl dhparam -out dh2048.pem 2048". I can contribute a patch to do this (read file, convert it into ssl-parameters.dat, then set/behave like ssl_parameters_regenerate=0), but I couldn't figure out the best place to do this. ssl_params_if_unchanged()? Joseph Tam <jtam.home(a)gmail.com>

2 1

dovecot-lda can't create /var/mail dotlocks on debian
by John Clements 03 Nov '15

03 Nov '15

I've been using dovecot+postfix happily for many years, and I'm now configuring it for a new machine. However, I'm running into an old problem again, and thinking that there must be a better solution. The problem is that dovecot-lda is unable to create dotlock files in the /var/mail directory. Dovecot version: 1:2.2.13-12~deb8u1 (I'm guessing this is upstream version 2.2.13) OS: Debian Jessie Currently, my mail directory has these permissions: clements@desmond:~$ ls -ld /var/mail drwxrwsr-x 2 root mail 4096 Nov 2 22:07 /var/mail clements@desmond:~$ ls -l /var/mail total 8 -rw------- 1 clements mail 1382 Nov 2 21:59 clements -rw------- 1 granitemon mail 530 Nov 2 22:07 granitemon I've added mail_privileged_group = mail to allow creation of the dotlock files. When I configure postfix to deliver using dovecot-lda, I get logs that look like this: Nov 3 11:12:20 desmond dovecot: lda(granitemon): Error: setegid(privileged) failed: Operation not permitted Nov 3 11:12:20 desmond dovecot: lda(granitemon): msgid=< 20151103181306.A4B5B5FF32(a)desmond.XXXDOMAIN.org>: save failed to INBOX: BUG: Unknown internal error In order to isolate the error, I took postfix out of the equation, and called dovecot-lda directly: clements@desmond:/tmp$ cat bogusmail From: clements(a)XXXDOMAIN.org To: granitemon@localhost Date: November 3 2015 Subject: graaaah this is the body clements@desmond:/tmp$ /usr/lib/dovecot/dovecot-lda -e -d clements < bogusmail BUG: Unknown internal error clements@desmond:/tmp$ In response to this, mail.log now contains this similar error: Nov 3 11:34:57 desmond dovecot: lda(clements): msgid=unspecified: save failed to INBOX: BUG: Unknown internal error Nov 3 11:34:57 desmond dovecot: lda(clements): Error: setegid(privileged) failed: Operation not permitted I've tried a number of "random internet search" solutions, including - changing perms on mail files from 660 to 600 - enabling 'mail_access_groups=mail' in 10-mail.conf - adding individual users to the mail group. I guess I'm pretty confident that if dovecot is writing "BUG: Unknown internal error" in the logs, that this is is actually a bug in dovecot. OBresearch: I read through the release notes of 2.2.14 -- 2.2.19 to see if a relevant-looking bug had been fixed, but nothing jumped out at me. OBresearch: searching the dovecot mailing list, I found one *extremely* relevant thread called "Re: [Dovecot] started with dovecot sieve <http://dovecot.markmail.org/message/kgd34wberxuvmrsa?q=setegid>", but there didn't seem to be a solution contained in the thread. Final note: this doesn't appear to be confined to debian jessie: I took a look at my existing installation, and I see that in fact I just went ahead and made /var/mail world-writeable, which seems... sub-optimal. I'm sure I could do that here, too, but I'd certainly rather not. Thanks in advance, and let me know if I've left out relevant crucial information. Best, John Clements

2 7

[dovceot-2.2.19] doveadm fts expand constantly gives Segfault
by Marcin Mirosław 03 Nov '15

03 Nov '15

Hi! When I issue: doveadm fts expand -A body xxx I'm always getting Segfault. I can't find descrption of this command in manual, is it possible to add some information to manual? # gdb -q doveadm Reading symbols from doveadm...Reading symbols from /usr/lib64/debug//usr/bin/doveadm.debug...done. done. (gdb) set args fts expand -A body XXX (gdb) run Starting program: /usr/bin/doveadm fts expand -A body XXX Warning: couldn't activate thread debugging using libthread_db: Cannot find new threads: generic error warning: File "/lib64/libthread_db-1.0.so" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load". To enable execution of this file add add-auto-load-safe-path /lib64/libthread_db-1.0.so line to your configuration file "/root/.gdbinit". To completely disable this security protection add set auto-load safe-path / line to your configuration file "/root/.gdbinit". For more information about this security protection see the "Auto-loading safe path" section in the GDB manual. E.g., run from the shell: info "(gdb)Auto-loading safe path" warning: Unable to find libthread_db matching inferior's thread library, thread debugging will not be available. Program received signal SIGSEGV, Segmentation fault. 0x00007ffff65a61af in fts_user_get_search_tokenizer (user=<optimized out>) at fts-user.c:248 248 fts-user.c: No such file or directory. (gdb) bt #0 0x00007ffff65a61af in fts_user_get_search_tokenizer (user=<optimized out>) at fts-user.c:248 #1 0x00007ffff65a2f8a in fts_search_arg_expand (backend=0x555555802f10, argp=0x7fffffffdf10, pool=0x5555557e56e0) at fts-search-args.c:108 #2 fts_search_args_expand_tree (backend=backend@entry=0x555555802f10, pool=0x5555557e56e0, argp=argp@entry=0x7fffffffdf10) at fts-search-args.c:171 #3 0x00007ffff65a31a5 in fts_search_args_expand (backend=backend@entry=0x555555802f10, args=0x5555557e5700) at fts-search-args.c:199 #4 0x00007ffff2118b2e in cmd_fts_expand_run (ctx=0x5555557e2f10, user=<optimized out>) at doveadm-fts.c:127 #5 0x000055555557a945 in doveadm_mail_next_user (ctx=0x5555557e2f10, input=<optimized out>, error_r=0x7fffffffe028) at doveadm-mail.c:384 #6 0x000055555557bf53 in doveadm_mail_all_users (wildcard_user=0x0, argv=<optimized out>, ctx=0x5555557e2f10) at doveadm-mail.c:452 #7 doveadm_mail_cmd (argv=<optimized out>, argc=<optimized out>, cmd=<optimized out>) at doveadm-mail.c:621 #8 doveadm_mail_try_run (cmd_name=<optimized out>, argc=4, argv=0x5555557ce3a0) at doveadm-mail.c:710 #9 0x000055555556ba6a in main (argc=5, argv=0x5555557ce398) at doveadm.c:345 (gdb) mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib protocol lmtp { mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib sieve } protocol lda { mail_plugins = quota sieve } protocol imap { mail_max_userip_connections = 25 mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib antispam imap_acl imap_quota imap_stats imap_zlib last_login } protocol pop3 { mail_plugins = acl fts fts_lucene listescape quota notify mail_log stats zlib last_login } Thanks, Marcin

1 0