July 2013 - dovecot - dovecot.org

[Dovecot] script to test CATENATE
by Mike Abbott 05 Aug '13

05 Aug '13

Attached please find a perl script which tests the CATENATE support in dovecot. I used this to test my CATENATE implementation a few years ago and it runs fine against dovecot in OS X Server. When run against dovecot-2.2.4 though it always fails or hangs, which in some cases means we interpreted RFCs differently and in other cases means it's finding bugs; both conditions are worthy of scrutiny. (It's random-number driven so every run is different.) A couple months ago I reported a few simple bugs which this script found and you fixed them; thanks. Then it started finding problems for which it's harder to isolate simple reproducible test cases. Vacations and other work interceded but now Apple is pleased to give you the script itself to allow you to iterate faster. Here are some examples of it running. One time only, pass the --init argument to store some template messages used by the real tests: $ ./catenate.pl --host your.test.server --user testuser --password 1234 --init connecting (imaps)... capability... logging in... deleting old templates mailbox... creating templates mailbox... append1... Append succeeded append2... Append succeeded logout... success $ ./catenate.pl --host your.test.server --user testuser --password 1234 connecting (imaps)... capability... logging in... append1... Append failed as it should have (bad url): <append1 NO [BADURL ;invalid;] Invalid IMAP URL: Unexpected IMAP URL path segment: `;invalid;'.> append2... Append failed as it should have (bad url): <append2 NO [BADURL /inbox/;uid=99999999] Message not found.> append3... Append succeeded [...] All tests passed. $ If it concludes with anything other than "All tests passed" or hangs then it found something that it didn't expect and that should be examined. Use the --verbose option to see the entire client-server conversation. We hope that you find this script helpful to harden your CATENATE code. I will be happy to answer any questions.

3 5

[Dovecot] attachments not with email causing FETCH BODY[] failed
by Anand Kumria 05 Aug '13

05 Aug '13

Hi, Anyone else experiencing this (Dovecot 2.2.4, attachments stored separately): dovecot: imap(user(a)kamdha.com): Error: file_istream.open(/home/ example.com/user/attachments/f5/f0/f5f0f2c08c4311fa404d090a703c3b492f2ea718…) failed: No such file or directory dovecot: imap(user(a)example.com): Error: read(BODY[]) failed: No such file or directory (FETCH for mailbox INBOX UID 42501) dovecot: imap(user(a)example.com): Disconnected: FETCH failed in=186 out=86389 My dovecot.conf attachment related config is: mail_attachment_dir = /home/%d/%n/attachments mail_attachment_min_size = 128k mail_attachment_fs = sis posix mail_attachment_hash = %{sha1} So, questions: - anyone else experiencing this? - how might this occurred? - what is the best way to find the corrupted message? - how should I go about fixing this? Any help or pointers would be appreciated. Thanks, Anand

3 4

[Dovecot] Passing data safely in password_key?
by Attila Nagy 05 Aug '13

05 Aug '13

Hi, I would like to convert my custom POP/IMAP proxy to Dovecot's. In this proxy I do more than giving back user name, password and the host and I need extra information. Luckily all of them are available as variables, but more than one comes as user input (like user name and cleartext password) and I'm not sure how to pass them safely. Obviously I would need a separator, which is guaranteed not to show up either in user name and the cleartext password. Should I use escape (%E) here, or is there a better way?

2 4

[Dovecot] dovecot fts solr plugin
by Thomas Baumann 05 Aug '13

05 Aug '13

Hello list, * apache-solr-3.6.2 * dovecot-2.1.7 I configured fts_solr for dovecot, but I have two issues When doing a search request within telnet 127.0.0.1 143 it connects to solr. Jul 21, 2013 4:38:15 PM org.apache.solr.core.SolrCore execute INFO: [] webapp=/solr path=/select params={rows=1&q=box:10361d30f8c4ea51ad7c00002ecaff3b+user:" tom(a)tirism.support.tiri.li"&sort=uid+desc&fl=uid} hits=0 status=0 QTime=10 Jul 21, 2013 4:38:15 PM org.apache.solr.core.SolrCore execute INFO: [] webapp=/solr path=/select params={rows=3&q=(hdr:"test"+OR+body:"test")&fq=%2Bbox:10361d30f8c4ea51ad7c00002ecaff3b+%2Buser:" tom(a)tirism.support.tiri.li"&sort=uid+asc&fl=uid,score} hits=0 status=0 QTime=7 But (1) doveadm fts fails: $ doveadm fts rescan -u tom(a)domain.com Error message: doveadm(tom(a)tirism.support.tiri.li): Error: fts not enabled for user's namespace (null) (2) solr schema has errors Jul 21, 2013 4:35:46 PM org.apache.solr.common.SolrException log SEVERE: org.apache.solr.common.SolrException: undefined field text at org.apache.solr.schema.IndexSchema.getDynamicFieldType(IndexSchema.java:1330) at org.apache.solr.schema.IndexSchema$SolrQueryAnalyzer.getAnalyzer(IndexSchema.java:408) at org.apache.solr.schema.IndexSchema$SolrIndexAnalyzer.reusableTokenStream(IndexSchema.java:383) at org.apache.lucene.queryParser.QueryParser.getFieldQuery(QueryParser.java:574) at org.apache.solr.search.SolrQueryParser.getFieldQuery(SolrQueryParser.java:206) at org.apache.lucene.queryParser.QueryParser.Term(QueryParser.java:1436) at org.apache.lucene.queryParser.QueryParser.Clause(QueryParser.java:1319) at org.apache.lucene.queryParser.QueryParser.Query(QueryParser.java:1245) at org.apache.lucene.queryParser.QueryParser.TopLevelQuery(QueryParser.java:1234) at org.apache.lucene.queryParser.QueryParser.parse(QueryParser.java:206) at org.apache.solr.search.LuceneQParser.parse(LuceneQParserPlugin.java:79) at org.apache.solr.search.QParser.getQuery(QParser.java:143) at org.apache.solr.handler.component.QueryComponent.prepare(QueryComponent.java:105) at org.apache.solr.handler.component.SearchHandler.handleRequestBody(SearchHandler.java:165) at org.apache.solr.handler.RequestHandlerBase.handleRequest(RequestHandlerBase.java:129) at org.apache.solr.core.SolrCore.execute(SolrCore.java:1376) at org.apache.solr.core.QuerySenderListener.newSearcher(QuerySenderListener.java:59) at org.apache.solr.core.SolrCore$3.call(SolrCore.java:1182) at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:314) at java.util.concurrent.FutureTask.run(FutureTask.java:149) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:897) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:919) at java.lang.Thread.run(Thread.java:736) Hope somebody can help! Best regards, Thomas # dovecot --version 2.1.7 # dovecot -n # 2.1.7: /etc/dovecot/dovecot.conf # OS: Linux 3.0.74-0.6.10-default x86_64 SUSE Linux Enterprise Server 11 (x86_64) xfs base_dir = /var/run/dovecot/ dict { expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 5000 listen = * login_greeting = tiri Mail ready. login_trusted_networks = 127.0.0.1 mail_location = maildir:/var/vmail/%u/ mail_plugins = fts fts_solr managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } ssl = no userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol imap { plugin { fts = solr fts_solr = break-imap-search url=http://localhost:8983/solr/ } } protocol pop3 { plugin { fts = solr fts_solr = break-imap-search url=http://localhost:8983/solr/ } }

3 4

[Dovecot] Lowering Log Levels Back to Defaults
by Asai 02 Aug '13

02 Aug '13

Greetings, I'm sorry for asking what may be a really obvious question, but I'm having a hard time turning off logging, or at least getting less verbose logging. My dsync logs are about 7 MB daily, and I'm trying to get that switched off. At one point I had it on a lower level of verbosity, and I turned it up for debugging purposes, but now I cannot seem to turn it back down, which is something I did many times before. For example the logs are getting tons of Info level messages. dsync(asai(a)globalchangemusic.org): Info: expunge: box=Trash, uid=61625, msgid=<JIRA.14456.1367259371732.1046.1367259384800@hexagon>, size=9586 In dovecot.conf I have commented out the following include, which used to lower the log levels back to the defaults, but I've upgraded Dovecot recently to 2.2.4 from 2.1 something: #!include conf.d/10-logging.conf I had the default levels raised in that config file. I'm not sure this helps but: [vmail@triata ~]# doveconf -n # 2.2.4: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-194.32.1.el5xen x86_64 CentOS release 5.5 (Final) ext3 auth_mechanisms = plain login mail_home = /vmail/%d/%n/home mail_location = maildir:/vmail/%d/%n mail_plugins = " mail_log notify" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave namespace { inbox = yes location = prefix = separator = / type = private } passdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } plugin { sieve = /vmail/%d/%n/sievescript } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = vmail mode = 0660 user = vmail } unix_listener auth-userdb { mode = 0660 user = vmail } user = root } service imap-login { process_min_avail = 3 service_count = 0 vsz_limit = 0 } ssl_cert = </etc/postfix/ssl/triata.globalchangemultimedia.net.pem ssl_key = </etc/postfix/ssl/triata.key userdb { args = /etc/dovecot/dovecot-mysql.conf driver = sql } protocol lda { hostname = triata.globalchangemultimedia.net mail_plugin_dir = /usr/lib64/dovecot/ mail_plugins = sieve postmaster_address = postmaster(a)globalchangemultimedia.net } protocol imap { imap_idle_notify_interval = 24 mins mail_max_userip_connections = 60 } -- --Asai

2 2

[Dovecot] dsync backup mails compressed
by Robert Schetterer 02 Aug '13

02 Aug '13

Hi Timo , looks like if zlib plugin is enabled all backupmails ( Maildir ) getting compressed i tested this dsync -o plugin/acl= -o plugin/quota= -u user(a)beispiel.de backup maildir://nfs-backup-data/user@beispiel.de adding -o plugin/zlib= didnt help i am not sure , what is the expected behave , and why -o plugin/quota= does not work ? Best Regards MfG Robert Schetterer -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64 Franziskanerstraße 15, 81669 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Axel von der Ohe, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

2 3

[Dovecot] 2.2.4 - Some questions about and needing help with quota-status
by Axel Luttgens 02 Aug '13

02 Aug '13

Help! I'm stuck. :-( The config of my experimental setup appears at the end of this message; I'm providing hereafter some more info that may not be immediately obvious. This is dovecot 2.2.4 with changesets 9091d0f2d971 and 2be295a0b64f. All involved databases are sqlite ones. passdb and userdb are devised so as to change usernames. For example, I could have a user with addresses "doe(a)oldexample.com", "johnd(a)oldexample.com" and "john.doe(a)example.com" needing to be able to log in as "jdoe" or "u123456"; all db lookups for that user then end with name "john.doe". This is a single mail user setup (user/group "dovemailer", uid/gid 999). Service lmtp has been configured to run as that user; that required a slight adjustment at the auth-userdb socket level. As a general rule, the quota dict appears to be correctly updated upon message arrivals and removals (thru lmtp, pop, imap), and to be correctly queried/interpreted by the various parts of the server. For example, thru the userdb query, user john.doe has been given an even lower quota limit than the already low default defined for testings: $ sudo doveadm quota get -u john.doe Quota name Type Value Limit % Quota utilisateur STORAGE 20 5 400 Quota utilisateur MESSAGE 14 - 0 and is clearly recognized as being over-quota by lmtp: $ telnet /_ROOT/var/run/dovecot/lmtp Trying /_ROOT/var/run/dovecot/lmtp... Connected to (null). Escape character is '^]'. 220 almba.local Dovecot ready. mail from:<mary.jane(a)example.com> 250 2.1.0 OK rcpt to:<john.doe(a)example.com> 250 2.1.5 OK data 354 OK Subject: test . 552 5.2.2 <john.doe(a)example.com> Quota exceeded (mailbox for user is full) Note that both services config and dict are launched if they aren't running. Since it has been previously seen that running quota-status as root comes with its own problems, and since it is a single user setup anyway, I'm trying to run it as dovemailer as well. So, let's try to see what quota-status thinks about john.doe: $ sudo -u _postfix telnet /_ROOT/var/spool/postfix/private/quota-policyd Trying /_ROOT/var/spool/postfix/private/quota-policyd... Connected to (null). Escape character is '^]'. Connection closed by foreign host. Clearly, not much... Looking in the log: dovecot[10554]: quota-status: Fatal: Error reading configuration: net_connect_unix(/_ROOT/var/run/dovecot/config) failed: Permission denied This thus raises a first question: Q1. What makes lmtp and quota-status different? How does lmtp manage to fetch all needed info, while quota-status seems to require an access to the config socket? Let's then slightly adjust dovecot.conf, in the hope to make quota-status happy: service config { unix_listener config { group = dovemailer mode = 0660 } } Q2. Should the above really be needed, wouldn't there be a better way? I ask, because it seems to me that I'm starting to seriously lose the benefits of privilege separation... Anyway, let's ask quota-status again: $ sudo -u _postfix telnet /_ROOT/var/spool/postfix/private/quota-policyd Password: Trying /_ROOT/var/spool/postfix/private/quota-policyd... Connected to (null). Escape character is '^]'. recipient=john.doe(a)example.com size=10000 action=OK ^] telnet> quit Connection closed. In the log: dovecot[11050]: auth: Debug: userdb out: USER 1 john.doe(a)example.com quota_rule=*:storage=5k dovecot[11050]: quota-status: Debug: auth input: john.doe(a)example.com quota_rule=*:storage=5k dovecot[11050]: quota-status: Debug: Added userdb setting: plugin/quota_rule=*:storage=5k dovecot[11050]: quota-status(john.doe(a)example.com): Debug: Effective uid=999, gid=999, home=/_Mailstores/john.doe dovecot[11050]: quota-status(john.doe(a)example.com): Debug: Quota root: name=Quota utilisateur backend=dict args=john.doe:proxy::sql_quota dovecot[11050]: quota-status(john.doe(a)example.com): Debug: Quota rule: root=Quota utilisateur mailbox=* bytes=5120 messages=0 dovecot[11050]: quota-status(john.doe(a)example.com): Debug: Quota grace: root=Quota utilisateur bytes=512 (10%) dovecot[11050]: quota-status(john.doe(a)example.com): Debug: dict quota: user=john.doe, uri=proxy::sql_quota, noenforcing=0 dovecot[11050]: quota-status(john.doe(a)example.com): Debug: fs: root=/_Mailstores/john.doe/mboxes, index=, indexpvt=, control=, inbox=/_Mailstores/john.doe/mboxes/inbox, alt= It is to be noted that the config server is now launched as expected, but that the dict server still isn't. Trying a dirsize backend instead of the dict backend doesn't help. The problem seems to be circumscribed to the interaction with the quota backend since, for example, querying quota-status for an unknown recipient yields an expected "action=REJECT Unknown user". Hence my last question, after having tried a lot of things for several days now, with no more success: Q3. What am I doing wrong? Many thanks in advance, Axel # 2.2.4: /_ROOT/etc/dovecot/dovecot.conf # OS: Darwin 12.4.0 x86_64 auth_debug = yes dict { sql_quota = sqlite:/_ROOT/etc/dovecot/dict-quota.conf } disable_plaintext_auth = no listen = * mail_debug = yes mail_gid = dovemailer mail_home = /_Mailstores/%n mail_location = mbox:~/mboxes:INBOX=~/mboxes/inbox mail_plugins = quota mail_uid = dovemailer managesieve_sieve_capability = vacation mbox_write_locks = fcntl passdb { args = /_ROOT/etc/dovecot/db.conf driver = sql } plugin { quota = dict:Quota utilisateur:%n:proxy::sql_quota quota_rule = *:storage=50M sieve = ~/sieve/active_script.sieve sieve_dir = ~/sieve/scripts sieve_extensions = vacation sieve_max_actions = 3 sieve_max_redirects = 2 sieve_max_script_size = 10K sieve_user_log = ~/sieve/log } service auth { unix_listener auth-userdb { group = dovemailer mode = 0660 user = $default_internal_user } } service dict { unix_listener dict { group = dovemailer mode = 0660 } } service lmtp { group = dovemailer user = dovemailer } service quota-status { client_limit = 1 executable = quota-status -p postfix group = dovemailer unix_listener /_ROOT/var/spool/postfix/private/quota-policyd { user = _postfix } user = dovemailer } ssl = no userdb { driver = prefetch } userdb { args = /_ROOT/etc/dovecot/db.conf driver = sql } protocol lmtp { mail_plugins = quota sieve postmaster_address = postmaster(a)example.com sendmail_path = /_ROOT/postfix/sbin/sendmail } protocol pop3 { pop3_uidl_format = %08Xv%08Xu }

2 9

[Dovecot] mails delivered to the wrong user when using lmtp_proxy and reject_unverified_recipient
by Peer Heinlein 02 Aug '13

02 Aug '13

Hi, looks like we detected a serious bug in dovecot's lmtp proxying where e-mails are delivered to the wrong user. The setup is: *) Dovecot is configured with "lmtp_proxy=yes" # Support proxying to other LMTP/SMTP servers by performing passdb lookups. lmtp_proxy = yes *) Postfix uses "dynamic recipient verification", so Postfix starts sending a (verify) mail by LMTP to dovecot, but quits the lmtp-session right after the RCPT TO:. No DATA-stage is reached in the protocol and no real e-mail is sent. But Postfix had a LMTP-connection for "user1". *) Just some seconds later a "real" e-mail to "user2" has to be delivered to dovecot by LMTP. But Dovecot will deliver this mail to the wrong "user1" instead of "user2". Looks like dovecot re-uses the (still opened?) lmtp-proxy-connection from "user1" to deliver an e-mail to "user2". Have a log at the protocol: 1) There's a verify call to user1 from Postfix: Jul 19 13:49:49 mailms postfix/lmtp[9842]: DE653280C51: to=<user1(a)example.com>, relay=localhost[127.0.0.1]:24, conn_use=2, delay=120, delays=117/0.45/0/2.5, dsn=2.1.5, status=deliverable (250 2.1.5 OK) 2) Just five seconds later the e-mail to user2 (see Postfix' point of view in the last line) is delivered to user2 (see result from Dovecot in the last line): Jul 19 13:50:04 mailms dovecot: lmtp(10965, kraemer): save: box=INBOX, uid=49880, msgid=<59798276-E5D1-4053-A570-9901B731DF5D(a)example.come>, size=11020 Jul 19 13:50:04 mailms dovecot: lmtp(10965, kraemer): 1zTeKrMn6VHVKgAAhyqEuA: msgid=<59798276-E5D1-4053-A570-9901B731DF5D(a)example.com>: saved mail to INBOX Jul 19 13:50:04 mailms postfix/lmtp[10953]: C25FC280BE5: to=<user2(a)example.com>, relay=localhost[127.0.0.1]:24, conn_use=19, delay=116, delays=115/0.53/0/0.33, dsn=2.0.0, status=sent (250 2.0.0 <user2> 1zTeKrMn6VHVKgAAhyqEuA Saved) Same with user3 and user4: Jul 19 14:47:53 mailms postfix/lmtp[10845]: C389A2809D7: to=<user3(a)example.com>, relay=localhost[127.0.0.1]:24, delay=4.7, delays=3.7/0.87/0/0.19, dsn=2.1.5, status=deliverable (250 2.1.5 OK) Jul 19 14:47:55 mailms dovecot: lmtp(26546, fs211113): save: box=INBOX, uid=8504, msgid=<928729810.113.1374238063381(a)example.com>, size=233151 Jul 19 14:47:55 mailms dovecot: lmtp(26546, fs211113): MbMvI2816VGyZwAAhyqEuA: msgid=<928729810.113.1374238063381(a)example.com>: saved mail to INBOX Jul 19 14:47:55 mailms postfix/lmtp[22524]: 6F0D2280A6E: to=<user4(a)example.com>, relay=localhost[127.0.0.1]:24, conn_use=2, delay=10, delays=8.4/1/0/0.8, dsn=2.0.0, status=sent (250 2.0.0 <user3> MbMvI2816VGyZwAAhyqEuA Saved) The user itself is quite normal in the user database (but has a mailhost=127.0.0.1 set): root@mailms:/etc/dovecot/conf.d# doveadm user user2(a)example.com userdb: user2(a)example.com uid : 5000 gid : 5000 home : /srv/mail/user2 root@mailms:/etc/dovecot/conf.d# doveadm auth user2(a)example.com Password: passdb: user2(a)example.com auth failed extra fields: user=user2 Peer -- Heinlein Support GmbH Schwedter Str. 8/9b, 10119 Berlin http://www.heinlein-support.de Tel: 030 / 405051-42 Fax: 030 / 405051-19 Zwangsangaben lt. §35a GmbHG: HRB 93818 B / Amtsgericht Berlin-Charlottenburg, Geschäftsführer: Peer Heinlein -- Sitz: Berlin

4 3

[Dovecot] Auth-woker log lines
by Grzegorz Staniak 02 Aug '13

02 Aug '13

Hi, Are log lines like the following: Jul 28 15:30:50 mx1.somewhere dovecot: auth-worker(18980): sql(user(a)domain,217.67.x.x): unknown user Jul 28 15:32:56 mx1.somewhere dovecot: auth-worker(18980): sql(user(a)domain,212.182.x.x): Password mismatch written every time any authetntication phase fails, in SASL as well as in POP3/IMAP mailbox access? I have a legacy app that would gain a lot if I could distinguish between failed SASL authentication and failed POP3/IMAP authentication. I know I can use the "auth failed" lines for the latter case, and postfix log lines in the former, but they don't contain user info. Is there a way for log monitoring software to get failed login lines with both user info, and the reason (SASL, POP3, IMAP)? Regards, -- Grzegorz Staniak <gstaniak [at] gmail _dot_ com>

2 1

[Dovecot] 2.2.4 - quota-status changing the user it is running as
by Axel Luttgens 02 Aug '13

02 Aug '13

Hello, I'm currently experimenting with this quota-status service configuration: service quota-status { client_limit = 1 executable = quota-status -p postfix # Let's make the default explicit. user = root unix_listener /var/spool/postfix/private/quota-policyd { user = postfix } } The idea is to run the service as root during the preliminary tests (at worst, since the service is going to be used as a policy daemon by Postfix only, it shouldn't be very problematic to have it running as root anyway). A user, with address john.doe(a)example.com and identified as john.doe, is known to be over-quota. A "doveadm quota get" returns: $ sudo doveadm quota get -u john.doe Password: Quota name Type Value Limit % Quota utilisateur STORAGE 5 5 100 Quota utilisateur MESSAGE 9 - 0 and messages for that user are correctly rejected by lmtp: dovecot[4989]: lmtp(5069, john.doe(a)example.com) QWSWLgrP4lF7FAAA5Q0ykw: msgid=<20130714161643.9085DF176F2(a)ALMba.local>: save failed to INBOX: Quota exceeded (mailbox for user is full) Let's now simulate a connection from Postfix: $ sudo -u postfix telnet /_ROOT/var/spool/postfix/private/quota-policyd Trying /_ROOT/var/spool/postfix/private/quota-policyd... Connected to (null). Escape character is '^]'. A look at the output of top (excerpt) confirms that quota-status is running as root: PID COMMAND UID 5100 quota-status 0 Going on with our telnet session: recipient=john.doe(a)example.com size=10000 action=OK Hmmm... OK, this may be a config problem of mine which may require further investigation. Anyway, looking at top's output: PID COMMAND UID 5100 quota-status 999 it appears that quota-status is now running as the mail_uid/mail_gid user; the switch happens immediately after having entered the empty line in the telnet session. Let's then try to go further within the telnet session: recipient=john.doe(a)example.com size=10000 action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for more information. ^] telnet> quit Connection closed. and a look at the log indeed reveals that quota-status doesn't have sufficient privileges anymore: dovecot[4989]: quota-status(john.doe(a)example.com): Error: user john.doe(a)example.com: Error reading configuration: net_connect_unix(/_ROOT/var/run/dovecot/config) failed: Permission denied Is this the expected behavior, to have quota-status switch to another user? TIA, Axel

3 8