August 2017 - dovecot

Hide public mailboxes from some users
by Arie Peterson 08 Sep '17

08 Sep '17

Hi all, I'm trying to set up public mailboxes for a subset of my users. This is on dovecot 2.2.27. I've created a new public namespace, and the new mailboxes indeed show up for everyone. So far so good. Now I want to restrict access: these mailboxes shouldn't be visible at all except to a fixed list of users. This part I can't seem to get working. I've added acl data along these lines: ``` pubbox anyone pubbox/* anyone pubbox user=me(a)example.com lrwstipekxa pubbox/* user=me(a)example.com lrwstipekxa ``` However, other users can still see "pubbox" and its subfolders, although they can't actually view the contents. This is corroborated by some of the output of `doveadm mailbox list`: ``` # doveadm -D mailbox list -u other(a)example.com … doveadm(other(a)example.com): Debug: Namespace : type=public, prefix=pubbox/, sep=/, inbox=no, hidden=no, list=children, subscriptions=no … doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Drafts' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Drafts' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/Drafts/dovecot-acl doveadm(other(a)example.com): Debug: acl: No lookup right to mailbox: pubbox/Drafts doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Sent' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: Mailbox 'pubbox/Sent' matches global ACL pattern 'pubbox/*' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/Sent/dovecot-acl doveadm(other(a)example.com): Debug: acl: No lookup right to mailbox: pubbox/Sent doveadm(other(a)example.com): Debug: Mailbox 'pubbox' matches global ACL pattern 'pubbox' doveadm(other(a)example.com): Debug: Mailbox 'pubbox' matches global ACL pattern 'pubbox' doveadm(other(a)example.com): Debug: acl vfile: reading file /mnt/data/mail/example.com/public/pubbox/mail/dovecot-acl pubbox pubbox/Drafts pubbox/Sent INBOX ``` Why do these "pubbox/*" mailboxes show up in the `mailbox list` output, even though the debug messages say that the user has no lookup right for them? `doveadm acl rights` seems to confirm that `other(a)example.com` does not have the lookup right for these mailboxes. So why do they show up in their email clients anyway? Thanks for any advice!

1 2

v2.2.32 released
by Timo Sirainen 04 Sep '17

04 Sep '17

https://dovecot.org/releases/2.2/dovecot-2.2.32.tar.gz https://dovecot.org/releases/2.2/dovecot-2.2.32.tar.gz.sig Two more fixes since rc2. And repeating: There are various changes in this release that can be used to significantly reduce disk IO with: 1) NFS storage especially, but I guess also other remote filesystems and even some with local disks 2) When mail storage and INDEX storage are separated * imapc: Info-level line is logged every time when successfully connected to the remote server. This includes local/remote IP/port, which can be useful for matching against external logs. * config: Log a warning if plugin { key=no } is used explicitly. v2.3 will support "no" properly in plugin settings, but for now any value at all for a boolean plugin setting is treated as "yes", even if it's written as explicit "no". This change will now warn that it most likely won't work as intended. + Various optimizations to avoid accessing files/directories when it's not necessary. Especially avoid accessing mail root directories when INDEX directories point to a different filesystem. + mail_location can now include ITERINDEX parameter. This tells Dovecot to perform mailbox listing from the INDEX path instead of from the mail root path. It's mainly useful when the INDEX storage is on a faster storage. + mail_location can now include VOLATILEDIR=<path> parameter. This is used for creating lock files and in future potentially other files that don't need to exist permanently. The path could point to tmpfs for example. This is especially useful to avoid creating lock files to NFS or other remote filesystems. For example: mail_location=sdbox:~/sdbox:VOLATILEDIR=/tmp/volatile/%2.256Nu/%u + mail_location's LISTINDEX=<path> can now contain a full path. This allows storing mailbox list index to a different storage than the rest of the indexes, for example to tmpfs. + mail_location can now include NO-NOSELECT parameter. This automatically deletes any \NoSelect mailboxes that have no children. These mailboxes are sometimes confusing to users. + mail_location can now include BROKENCHAR=<char> parameter. This can be useful with imapc to access mailbox names that aren't valid mUTF-7 charset from remote servers. + If mailbox_list_index_very_dirty_syncs=yes, the list index is no longer refreshed against filesystem when listing mailboxes. This allows the mailbox listing to be done entirely by only reading the mailbox list index. + Added mailbox_list_index_include_inbox setting to control whether INBOX's STATUS information should be cached in the mailbox list index. The default is "no", but it may be useful to change it to "yes", especially if LISTINDEX points to tmpfs. + userdb can return chdir=<path>, which override mail_home for the chdir location. This can be useful to avoid accessing home directory on login. + userdb can return postlogin=<socket> to specify per-user imap/pop3 postlogin socket path. + cassandra: Add support for result paging by adding page_size=<n> parameter to the connect setting. + dsync/imapc, pop3-migration plugin: Strip also trailing tabs from headers when matching mails. This helps with migrations from Zimbra. + imap_logout_format supports now %{appended} and %{autoexpunged} + virtual plugin: Optimize IDLE to use mailbox list index for finding out when something has changed. + Added apparmor plugin. See https://wiki2.dovecot.org/Plugins/Apparmor - virtual plugin: A lot of fixes. In many cases it was also working very inefficiently or even incorrectly. - imap: NOTIFY parameter parsing was incorrectly "fixed" in v2.2.31. It was actually (mostly) working in previous versions, but broken in v2.2.31. - Modseq tracking didn't always work correctly. This could have caused imap unhibernation to fail or IMAP QRESYNC/CONDSTORE extensions to not work perfectly. - mdbox: "Inconsistency in map index" wasn't fixed automatically - dict-ldap: %variable values used in the LDAP filter weren't escaped. - quota=count: quota_warning = -storage=.. was never executed (try #2). v2.2.31 fixed it for -messages, but not for -storage. - imapc: >= 32 kB mail bodies were supposed to be cached for subsequent FETCHes, but weren't. - quota-status service didn't support recipient_delimiter - acl: Don't access dovecot-acl-list files with acl_globals_only=yes - mail_location: If INDEX dir is set, mailbox deletion deletes its childrens' indexes. For example if "box" is deleted, "box/child" index directory was deleted as well (but mails were preserved). - director: v2.2.31 caused rapid reconnection loops to directors that were down.

2 1

Mixed Autehtnication and password schemes
by Raymond Sellars 03 Sep '17

03 Sep '17

Hi Looking for some confirmation/direction on how to achieve the following. We have a requirement to support both SASL PLAIN and DIGEST-MD5 authentication (certification reasons). In addition to this we have an application (webmail) that utilises a master password pattern for access, as the contain web portal provides the necessary authentication. I have access to users passwords in PLAIN text and looking to utilise the dict lookup mechanism for passwords. Problem #1 https://wiki2.dovecot.org/Authentication/MultipleDatabases - "Currently the fallback works only with the PLAIN authentication mechanism." The above not suggests I can't use DIGEST-MD5 with master password configuration, if using more than one passdb setup. I don't understand why there would be a restriction as the password validation should just fall through irrespective. Problem #2 How do I enforce some kind of account access policy Currently we're backing the authentication with an Identity and Authentication system. I would like to block IMAP access if a user's account is locked out, expired, or inactive. Similarly if there are too many IMAP attempts with the incorrect password I would like the account system wide to be locked out. With Dict lookup I don't seem a mechanism to keep the IDM system aware of login attempt/failures, since it pulls the plaintext password and validates internally. Is this possible? As a worse case does Dovecot implement any type of account access policies? Out IT security reviewers are hot on account policies, i.e. lockouts, expiries, and back off attempts. Thanks Raymond Solution Architect - Orion Health

2 4

Pigeonhole 0.4.20 source archive based on v. 0.4.20-rc1?
by Markus Schönhaber 02 Sep '17

02 Sep '17

Hi, looking at the source archive of pigeonhole 0.4.20 <https://pigeonhole.dovecot.org/releases/2.2/dovecot-2.2-pigeonhole-0.4.20.t…> I noticed that the contained ChangeLog mentions v0.4.20.rc1 as first entry and pigeonhole-version.h defines git revision 7cd71ba as version where I'd expect 4a55e6c. This is probably no big deal. But since Makefile.in and install-sh also differ (see attached diff) from the patch contained in <http://xi.rename-it.nl/debian.new/pool/jessie-rc-auto/dovecot-2.2/dovecot_2…> I thought I'd ask whether this is something without importance or something which should be changed. -- Regards mks

2 2

Re: General IMAP question
by Joseph Tam 31 Aug '17

31 Aug '17

"Scott Techlist" <techlist06(a)msws.org> writes: > Currently my POP users have a max mbox size but that is how much it > will store before they "come get it". I ensure they have at least one > device set to delete from the server periodically (i.e. 1 week). So > users with multiple devices get their mail duplciated on their devices > and at least one devices keeps the server emptied so their mbox does > not hit any limits. Traditionally, POP was a store and forward protocol. The client would download all the message in INBOX, them empty the mailbox. Nowadays, many POP users configure their clients to "Leave on server mode", which essentially accumulate on the server. The client may or may not also keep a cached copy. > As I understand it, when using IMAP, the user's messages are > perpetually stored on the server. IMAP is oriented as a remote mail service (client fetches and manipulate mail data on a remote server), so yes, messages are meant to remain on the server until deleted. There are probably some clients that cache local copies, but the remote server is considered canonical, so that local copies are deleted if the remote copies disappear. > How do other's deal with this? Am I misunderstanding something? As > popular as it seems to be, these seem like big hurdles to overcome. > Appreciate some help for a IMAP noob. What problem are you trying to solve? Is there a particularly compelling reason for you to move to IMAP (if not, stay with POP3)? You want to curtail space usage by users? You want to force users to retain client side copies of the messages? (Mind you, you'll still could have the same problem with POP -- there's nothing you can do to enforce the client to download/delete messages. Whether you use IMAP or POP3, you'll probably need some client side set up.) Joseph Tam <jtam.home(a)gmail.com>

1 0

RE: Iterate All Dovecot Users !
by Nick Lekkas 31 Aug '17

31 Aug '17

Hi Thomas ! So simple.... But you save my ass ..... And yes it works ! Thanks a lot ! Really ! I appreciate it ! Thanks Nick -----Original Message----- From: Thomas Reifferscheid [mailto:thomas@reifferscheid.org] Sent: Thursday, August 31, 2017 10:49 PM To: nlekkas(a)gmail.com Subject: Re: Iterate All Dovecot Users ! Am 31.08.2017 um 18:18 schrieb Nick Lekkas: > Hello to all ! > > I am trying to write a script that iterate all users that are created in > dovecot and postfix .... > Is there any way ..? > Hi Nick for user in $(doveadm user -u '*'); do echo $user; done Thomas __________ Information from ESET Endpoint Antivirus, version of detection engine 16008 (20170831) __________ The message was checked by ESET Endpoint Antivirus. part000.txt - is OK http://www.eset.com __________ Information from ESET Endpoint Antivirus, version of detection engine 16008 (20170831) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

1 0

Iterate All Dovecot Users !
by Nick Lekkas 31 Aug '17

31 Aug '17

Hello to all ! I am trying to write a script that iterate all users that are created in dovecot and postfix .... Is there any way ..? Thanks in advance for your time ! Nick __________ Information from ESET Endpoint Antivirus, version of detection engine 16007 (20170831) __________ The message was checked by ESET Endpoint Antivirus. Email message - is OK http://www.eset.com

2 1

General IMAP question
by Scott Techlist 31 Aug '17

31 Aug '17

My server is a limited space mailserver set up to filter spam. Most of it's mail is passed on ot an exchange server so it is not stored locally. I have a handful of pop accounts that are stored locally. For years I've used mbox type mailboxes that I'm familiar with and can access on the server when needed using the old mailx program. They use a variety of clinets, typically Outlook and smartphones. I'm considering changing to IMAP because I need a single IMAP mailbox for an unrelated reason. But I am concerned about user storage issues at least.. Currently my POP users have a max mbox size but that is how much it will store before they "come get it". I ensure they have at least one device set to delete from the server periodically (i.e. 1 week). So users with multiple devices get their mail duplciated on their devices and at least one devices keeps the server emptied so their mbox does not hit any limits. As I understand it, when using IMAP, the user's messages are perpetually stored on the server. So if the user is not moving their messages from their inbox to some other place (e.g. a different Outlook pst file), that all the messages will remain on the server. All messages are "synced" in the user's inbox or other user created folders. Is that right? This would pretty quickly cripple those normal non-computer types that have years of emails in their inboxes. And I don't have the storage space to allow storing years of their mail. I also understand if they exceed their storage limit, mail starts bouncing which is what's I'd expect. At first I started googling how to expire the old mail, but then realized that won't work because if I delete on the server, I understand that will delete on their devices, too. How do other's deal with this? Am I misunderstanding something? As popular as it seems to be, these seem like big hurdles to overcome. Appreciate some help for a IMAP noob. Thanks, Scott

2 1

Strange folders
by Marti Markov 31 Aug '17

31 Aug '17

Hi all, I’ve been experiencing the “magical” creation of random folders on my mail server. I managed to catch the creation of one last night. Here is the log: Aug 30 01:38:13 mail dovecot: imap(f.lastName(a)domain.com): Debug: Namespace : /home/vmail/domain.com/f.lastName/Maildir/.wkkwgfrubwioniohkcyqttugdtdabuyn doesn't exist yet, using default permissions Aug 30 01:38:13 mail dovecot: imap(f.lastName(a)domain.com): Debug: Namespace : Using permissions from /home/vmail/domain.com/f.lastName/Maildir: mode=0700 gid=default Aug 30 01:38:13 mail dovecot: imap(f.lastName(a)domain.com): Debug: acl vfile: file /home/vmail/domain.com/f.lastName/Maildir/.wkkwgfrubwioniohkcyqttugdtdabuyn/dovecot-acl not found I have substituted only the username and the domain name. The folder name is as it was created: wkkwgfrubwioniohkcyqttugdtdabuyn There has been no activity logged on the exim4 side at that time. What would be the best course of action to determine what is happening?

2 1

Segmentation fault with doveadm search
by Stefán Tamás 30 Aug '17

30 Aug '17

Hi, We have a Ubuntu 14.04 server with dovecot 2.2.9 If I try to run /usr/bin/doveadm search -u email(a)exmaple.com mailbox Junk savedbefore 30d It will dump a core file. We have a similar config on an other server and there is no problem there. Any ideas how to prevent the core dump? root@triws2:~# gdb --args doveadm search -u email(a)example.com mailbox Junk savedbefore 30d Reading symbols from doveadm...Reading symbols from /usr/lib/debug//usr/bin/doveadm...done. done. (gdb) run Starting program: /usr/bin/doveadm search -u email(a)example.com mailbox Junk savedbefore 30d Program received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) where #0 0x0000000000000000 in ?? () #1 0x00007ffff76ef1b5 in mailbox_get_metadata (box=box@entry=0x5555557e1c70, items=items@entry=MAILBOX_METADATA_GUID, metadata_r=metadata_r@entry=0x7fffffffe2f0) at mail-storage.c:1544 #2 0x0000555555570918 in cmd_search_box (info=<optimized out>, ctx=0x5555557c8230) at doveadm-mail-search.c:28 #3 cmd_search_run (ctx=0x5555557c8230, user=<optimized out>) at doveadm-mail-search.c:58 #4 0x0000555555569b5b in doveadm_mail_next_user (ctx=0x5555557c8230, input=<optimized out>, error_r=0x7fffffffe3f8) at doveadm-mail.c:314 #5 0x000055555556a8ac in doveadm_mail_cmd (argv=0x5555557c33b0, argc=7, cmd=0x5555557c7408) at doveadm-mail.c:525 #6 doveadm_mail_try_run (cmd_name=<optimized out>, argc=7, argv=0x5555557c3398) at doveadm-mail.c:617 #7 0x00005555555696d4 in main (argc=7, argv=0x5555557c3398) at doveadm.c:398 Üdvözlettel Stefán Tamás --------------------------------- domain > email > web >>> siker Numex Informatika Kft. Mobil: +36 20 956 0233, Tel: +36 1 205 3915 http://numex.hu

2 6