- dovecot - dovecot.org

submission server relay to localhost
by Michael Grant 20 Oct '23

20 Oct '23

I'm trying to set up dovecot-submission server which will listen on external ports 465 (SSL) and 587 (StartTLS) and relay mail to sendmail waiting on localhost port 587. I have dovecot submission listening on the external ports and sendmail listening on the localhost port. I want dovecot-submission doing the authentication on the external ports because sendmail doesn't use the /etc/dovecot/users file. I can authenticate to dovecot: auth: Debug: client in: CONT<hidden> auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Performing passdb lookup auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): lookup: user=mgrant(a)top.networkguild.org file=/etc/dovecot/users auth: Debug: passwd-file(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Finished passdb lookup auth: Debug: auth(mgrant(a)top.networkguild.org,217.35.29.56,<blablabla>): Auth request finished auth: Debug: client passdb out: OK 1 user=mgrant(a)top.networkguild.org But in the sendmail logs, dovecot *is* trying to authenticate and it's trying to use a username that sendmail can't look up in the password file: top sm-mta[1012721]: 39KCg8h31012721: --- 220 top.networkguild.org ESMTP Sendmail 8.17.2/8.17.2/Debian-1~bpo12+1; Fri, 20 Oct 2023 12:42:08 GMT; (No UCE/UBE) logging access from: localhost(OK)-localhost [IPv6:0:0:0:0:0:0:0:1] top sm-mta[1012721]: 39KCg8h31012721: <-- EHLO top.networkguild.org top sm-mta[1012721]: 39KCg8h31012721: --- 250-top.networkguild.org Hello localhost [IPv6:0:0:0:0:0:0:0:1], pleased to meet you top sm-mta[1012721]: 39KCg8h31012721: --- 250-ENHANCEDSTATUSCODES top sm-mta[1012721]: 39KCg8h31012721: --- 250-PIPELINING top sm-mta[1012721]: 39KCg8h31012721: --- 250-EXPN top sm-mta[1012721]: 39KCg8h31012721: --- 250-VERB top sm-mta[1012721]: 39KCg8h31012721: --- 250-8BITMIME top sm-mta[1012721]: 39KCg8h31012721: --- 250-SIZE top sm-mta[1012721]: 39KCg8h31012721: --- 250-AUTH DIGEST-MD5 CRAM-MD5 top sm-mta[1012721]: 39KCg8h31012721: --- 250-STARTTLS top sm-mta[1012721]: 39KCg8h31012721: --- 250-DELIVERBY top sm-mta[1012721]: 39KCg8h31012721: --- 250 HELP top sm-mta[1012721]: 39KCg8h31012721: <-- MAIL FROM:<mgrant(a)top.networkguild.org> AUTH=mgrant(a)top.networkguild.org top sm-mta[1012721]: 39KCg8h31012721: --- 530 5.7.0 Authentication required top dovecot: submission(mgrant(a)top.networkguild.org)<1012719><blablabla>: Error: Relay server requires authentication: 530 5.7.0 Authentication required top dovecot: submission(mgrant(a)top.networkguild.org)<1012719><blablabla>: Disconnected: Internal error occurred. Refer to server log for more information. (unfinished MAIL command) (state=MAIL FROM) in=41 out=121 top sm-mta[1012721]: 39KCg8h31012721: <-- QUIT How do I stop dovecot from proposing AUTH to the relay server? Once I am authenticated via dovecot, the relay which is only available on localhost, doesn't need to authenticate. It should be as if bin-mail is submitting to localhost. I tried setting up a user with a password but no shell and configure this into submission_relay_master_user and submission_relay_password but this leads to other problems. Dovecot wants to do PLAIN auth, so I then enable starttls, but then the ssl certificate doesn't match because I'm connecting to localhost, not top.networkguild.org. So it seems clear, the relay should a) not auth, and b) not do ssl. Note that this is not an open relay, it's only open on the loopback interface. Michael Grant

1 1

Extract body preview in lua notify script
by Filip Hanes 20 Oct '23

20 Oct '23

Hi, I am trying to extract short text preview from mail body in function dovecot_lua_notify_end_txn. I want to send notification about new email with perex included. How can it be done? Is it possible? thanks -- Filip Hanes

2 1

Replicator service in Dovecot 2.4 CE
by k v 18 Oct '23

18 Oct '23

On the documentation page for the upgrade to version 2.4 at https://doc.dovecot.org/3.0/installation_guide/upgrading/from-2.3-to-3.0/, it is mentioned that instead of the 'replicator' service (https://doc.dovecot.org/configuration_manual/replication/#replication-with-…) it is necessary to use an NFS cluster file system. Are you completely removing support for 'replication-with-dsync' starting from version 2.4? Are there any plans for built-in tools to implement an active/active or active/passive cluster in the community edition?

2 1

Debian package for bookworm
by Claudio Corvino 14 Oct '23

14 Oct '23

Hi guys, I updated to Debian 12 but I can't find repo for bookworm on https://repo.dovecot.org/. When it will be released? Thanks! -- Claudio

8 10

Dovecot behind Reverse Proxy and IP families
by Arnaud Cordier 12 Oct '23

12 Oct '23

Dear all, I am running Dovecot 2.3.20 in a Kubernetes cluster. The Dovecot container is exposed behind a Traefik load-balancer, which acts just like HAProxy would, using the Proxy Protocol in order to allow Dovecot to be aware of the real source IP of the client, as follows: Internet <-> Traefik load-balancer <---- Proxy protocol ----> Dovecot My setup works well over IPv4. Oct 12 19:11:33 imap-login: Info: Login: user=<arnaud@xxx>, method=PLAIN, rip=<my_ipv4_public_address> lip=10.42.4.21, mpid=1369531, session=<xxxx> Howevever, if the client originates from an IPv6 address, Dovecot does not seem to take the real IPv6 origin into account and fails. Oct 12 19:09:04 imap-login: Error: haproxy(v1): Client disconnected: Proxied local address is invalid (address=`10.42.4.21', rip=10.42.4.21) A network capture shows that the proxy protocol indeed sends the real IPv6 IP, that should be taken into account by dovecot: ......&.PROXY TCP6 2001:<rest_of_my_public_ip> 10.42.4.21 20200 993 The error seems to be raised in "core/src/lib-master/master-service-haproxy.c" line 553: 551 if (net_addr2ip(*fields, &local_ip) < 0 || 552 local_ip.family != family) { 553 e_error(hpconn->event, "Client disconnected: " 554 "Proxied local address is invalid " 555 "(address=`%s', rip=%s)", str_sanitize(*fields, 64), 556 net_ip2addr(real_remote_ip)); 557 return -1; 558 } 559 fields++; I suppose that the issue is related to the fact that the client originates from an IPv6 then the reverse proxy forwards the connection to Dovecot over IPv4, which results in the "local_ip.family != family" condition to be true. Why is such a restriction implemented ? It is to be noted that I implemented the exact same load-balancer architecture for postfix, which successfully handles an IPv6 real IP over an IPv4 connection. I temporarily fixed the issue by setting an IPv4 only DNS record for my imaps domain name, however, do you think that a fix could be implemented in Dovecot? Kind regards, -- --- Arnaud Cordier --------------- CryptID Freelance cybersecurity engineer - Pentester - Red teamer Tel: +33 (0)6 61 44 82 04

1 0

Create autoreply with http api
by cyril.leclerc＠mantiq.com 12 Oct '23

12 Oct '23

Hi, Is it possible to activate autoreply from http api : https://doc.dovecot.org/admin_manual/doveadm_http_api/ on mailbox ? because on evolution client we could not activate out of office, autoreply, with http api and sieve commands, is it possible to achieve it fron our web application ? thank you

1 0

doveadm(user): Error purging namespace
by Taavi Ansper 10 Oct '23

10 Oct '23

Hi I have an issue with doveadm: doveadm(user): Warning: mdbox /home/user/mdbox/storage: Inconsistency in map index (227,40 != 227,56) doveadm(user): Warning: fscking index file /home/user/mdbox/storage/dovecot.map.index doveadm(user): Warning: mdbox /home/user/mdbox/storage: rebuilding indexes doveadm(user): Error: Purging namespace '' failed: BUG: Unknown internal error Why does this happen and how can it be resolved? User is using thunderbird as the mail client. -- Taavi Ansper taavi.ansper(a)cyber.ee

2 1

spool move/rename question
by Dave McGuire 09 Oct '23

09 Oct '23

Hi folks. Our mail server's spools are structured like this: /var/mail/<domain>/<user> We have an existing user with a lot of mail that we need to move from one domain to another. Our mail system is database-backed so changing the account is trivial, but can I just move the <user> directory from the structure above from one <domain> directory to another and expect everything to be ok? Or is there a better approach? (of course I'll do a backup first) Thanks, -Dave -- Dave McGuire, AK4HZ New Kensington, PA

2 3

qp and Invalid quoted-printable input trailer: '=' not followed by two hex digits
by Arkadiusz Miśkiewicz 09 Oct '23

09 Oct '23

I have a mail (attached) for which dovecot reports: imap(test): pid=<32688> session=<UOVJ/0UHlM3B7y+g>, Error: Mailbox INBOX.test: UID=1: read(<binary stream of mailbox INBOX.test UID 1>) failed: read(/var/mail/test/.test/cur/1695887652.M710714P17846.mbox13:2,RS) failed: Invalid quoted-printable input trailer: '=' not followed by two hex digits and I fail to see why. There is = used at the end of lines as soft-line break. Also if you delete "przez system Spa=" it works. If you lave it and delete "<br>=" line it also works. Doesn't seem to be consistent. Is dovecot too restrictive here? dovecot 2.3.20 and 2.3.21 -- Arkadiusz Miśkiewicz, arekm / ( maven.pl | pld-linux.org )

1 0

bug report: lmtp fails on root-squashed NFS filesystem
by Anne Bennett 09 Oct '23

09 Oct '23

Hi, all. I'm trying to set up Postfix with dovecot LTMP delivery on a host where the user files (/var/spool/mail as well as home directories) are on NFS filesystems, which are exported root-squashed to the mail server. I definitely don't want to give the mail server root permissions on the user files. LMTP delivery fails with this logged message (e.g.): Nov 16 17:51:36 lust dovecot: lmtp(anne)<16830><mkkzEPg1lGG+QQAAs/mAJw>: msgid=<202111162229.1AGMTfAO024765(a)vindemiatrix.encs.concordia.ca>: save failed to INBOX: Read-only mbox I found this posting where someone else had a similar problem and traced it in some detail back in 2019: https://dovecot.org/list/dovecot/2019-February/114611.html but apparently no one answered the fellow. In order to check that this is indeed the same problem, I temporarily changed the INBOX definition to make it write into /var/tmp/ (on a local filesystem), and delivery worked. I then temporarily changed the INBOX definition to make it write into an NFS filesystem with root NOT squashed, and again it worked (after I chmodded the directory to 1777 to allow any user to create a file). I believe that the person who wrote the above posting is correct: at some point, file access is (incorrectly) checked as root instead of as the target user. This is a bit of a showstopper for me. Any plans to address this? I attach the output of "dovecot -n", fwiw, but I don't think that this is a configuration problem... Anne. -- Ms. Anne Bennett, Senior Sysadmin, ENCS, Concordia University, Montreal H3G 1M8 anne(a)encs.concordia.ca +1 514 848-2424 x2285

2 4