November 2019 - dovecot

Virtual mailboxes: errors after renaming a folder
by André Rodier 24 Nov '19

24 Nov '19

Hello, I have a dovecot server, running fine, on Debian Stretch. Virtual folders are set up, and works correctly. For instance, I have Unread, All and Conversations, and everything works fine. However, when I rename a folder, I have error messages from Dovecot. For instance, I had a folder INBOX/Bills, which I renamed INBOX/Invoices. After that, I have these error messages: > The reported error was “Failed to select mailbox: Backend mailbox INBOX/Bills' added by another session. Reopen the virtual mailbox. (for backend mailbox Search/All) (0.000 + 0.000 secs).”. How can I avoid these errors, for instance, how can I rebuild the indexes every night or so? Kind regards, André

1 0

Dovecot proxy with ldap, complains about 'host not given'
by Marc Roos 24 Nov '19

24 Nov '19

It looks like the dovecot proxy can authenticate correctly but fails then on with this message Nov 23 23:33:33 test2 dovecot: pop3-login: Error: proxy: host not given: user=<test>, method=PLAIN, rip=127.0.0.1, lip=127.0.0.1, secured, session=<LDTlHguYJth/AAAB> I have configured a host= in ldap for this user

3 4

chown(/var/dovecot/login/ipc-proxy
by Marc Roos 22 Nov '19

22 Nov '19

Can we remove/change this in the source? So we do not have to add the CAP_CHOWN with containers. chown(/var/dovecot/login/ipc-proxy) When run as root this has user dovenull, maybe this can be resolved by using a group dovenull? bash-5.0# ls -arlt total 4 srw-rw-rw- 1 root root 0 Nov 21 22:27 pop3 srw-rw-rw- 1 root root 0 Nov 21 22:27 login srw------- 1 dovenull root 0 Nov 21 22:27 ipc-proxy srw-rw-rw- 1 root root 0 Nov 21 22:27 imap drwxr-xr-x 1 dovecot dovecot 4096 Nov 21 22:27 .. drwxr-x--- 1 root dovenull 60 Nov 21 22:27 . Maybe this would work srw-rw---- 1 root dovenull 0 Nov 21 22:27 ipc-proxy

1 1

Virtual folder auto creation
by sergio 22 Nov '19

22 Nov '19

After switching on Virtual Plugin and configuring it as specified on https://doc.dovecot.org/configuration_manual/virtual_plugin/ the virtual folder is created for each user. Is it possible do not creater virtual folder automatically, only manually, for specific users? lda_mailbox_autocreate set to yes, but hope it's not related. -- sergio.

3 3

Lost quota, maildirsize with value S0
by grupodecorreo10 21 Nov '19

21 Nov '19

Hi,We have installed dovecot 2.2.22. we have servers as director dovecot and servers as dovecot backend. The mailboxes are estored in maildir format, over nfs (Emc Isilon).The problem we have is that sometimes some aleatory users loss her quota and the maildirsze show ilimited cuota, with S0 value in maildirsive file.The mails are stored in the mailboxes with maildrop and postfix, but we have done some test with postfix stoped. Only Dovecot openning the mailbox and the maildirsize is corrupted.I do not known where to look. We have configured dovecot with all the recomendarions for nfs.Thank you

1 0

virtual folder index logs
by sergio 21 Nov '19

21 Nov '19

A virtual folder is just really a saved search, but index log files are created. dovecot.list.index.log for the virtual folder itself and dovecot.index.log for all subfolders. Is it correct? Is it possible to disable index logs for virtual folder or it will only make dovecot worse? -- sergio.

1 0

Dovecot can't log in Virtual user - please help
by Andrej Rehak 20 Nov '19

20 Nov '19

Hello Im having issues login to dovecot using imap through telnet. Im running Linux 4.9.0-11-amd64 #1 SMP Debian 4.9.189-3+deb9u1 (2019-09-20) x86_64 GNU/Linux Im totally new to setting up mailservers. I havesetup a postfix for SMTP and it can receive emails. Postfix version is mail_version = 3.1.12 I have also installed Dovecot version:2.2.27 (c0f36b0) My configuration is such that POSTFIX is configured to use DOVECOT SASL through local socket. My system is configured to store emails in /var/mail/owndomain.org/<username>. For each domain i have my own passwd file where dovecot is supposed to lookup usernames and passwords. /var/mail/owndomain.org/passwd. I have created virtualuser for accessing mails and authenticating users. My dovecot (dovecot -n output) configuration is: ------------------------------------------------------------- # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-11-amd64 x86_64 Debian 9.11 auth_debug = yes auth_mechanisms = plain login auth_verbose = yes debug_log_path = /var/log/dovecot-debug.log disable_plaintext_auth = no info_log_path = /var/log/dovecot-info.log listen = 192.168.2.2 log_path = /var/log/dovecot.log mail_home = /var/mail/home/%d/%n mail_location = mbox:~/mail:INBOX=/var/spool/mail/%d/%n mail_privileged_group = virtualmail namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = username_format=%n /var/mail/%d/passwd driver = passwd-file } pop3_uidl_format = %g protocols = imap pop3 service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } user = dovecot } ssl = no userdb { driver = passwd } userdb { args = username_format=%n /var/mail/%d/passwd default_fields = uid=virtualmail gid=virtualmail home=/var/mail/%d/%n driver = passwd-file } verbose_proctitle = yes ---------------------------------------- Now the problem: I was testing the configuration using telnet. POSTFIX receives email, stores it. No problem. When i tried to log in onto Dovecot IMAP using Telnet i get this message: * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH-LOGIN] Dovecot ready. a login "username(a)owndomain.org" "test" a NO [UNAVAILABLE] Internal error occured. Refer to server log for more information. I have enabled verbose logging and this is the output of logs: /var/log/dovecot.log had this message: Nov 16 14:20:49 auth: Error: plain(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): user not found from any userdbs Nov 16 14:20:49 imap: Error: Authenticated user not found from userdb, auth lookup id=684589057 (client-pid=9601 client-id=1) /var/log/dovecot-debug.log had this message: Nov 16 14:20:18 auth: Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Nov 16 14:20:18 auth: Debug: Read auth token secret from /var/run/dovecot/auth-token-secret.dat Nov 16 14:20:18 auth: Debug: auth client connected (pid=9601) Nov 16 14:20:47 auth: Debug: client in: AUTH 1 PLAIN service=imap session=RF4llXaXisPAqAmD lip=192.168.2.2 rip=192.168.9.131 lport=143 rport=$ Nov 16 14:20:47 auth-worker(9603): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth Nov 16 14:20:47 auth-worker(9603): Debug: pam(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup service=dovecot Nov 16 14:20:47 auth-worker(9603): Debug: pam(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): #1/1 style=1 msg=Password: Nov 16 14:20:49 auth: Debug: passwd-file /var/mail/owndomain.org/passwd: Read 2 users in 0 secs Nov 16 14:20:49 auth: Debug: passwd-file(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup: user=username file=/var/mail/owndomain.org/passwd Nov 16 14:20:49 auth: Debug: client passdb out: OK 1 user=username(a)owndomain.org Nov 16 14:20:49 auth: Debug: master in: REQUEST 684589057 9601 1 a61dd67ee43390596ddf86e6c08db6f9 session_pid=9604 request_auth_token Nov 16 14:20:49 auth-worker(9603): Debug: passwd(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup Nov 16 14:20:49 auth: Debug: passwd-file(username(a)owndomain.org,192.168.9.131,<RF4llXaXisPAqAmD>): lookup: user=username file=/var/mail/owndomain.org/passwd Nov 16 14:20:49 auth: Debug: master userdb out: NOTFOUND 684589057 And i am completelly clueless what is the problem. Because it seems as if the password was found but the user is not? Password and user are looked up in the same passwd file. Have i forgotten something to setup? Any help or guidance is appreciated! I have also posted the issue on: https://serverfault.com/questions/992108/dovecot-cant-login-virtual-user Thanks A.

2 3

ios12 clients not getting correct certificate, sni supported not? or config error?
by Marc Roos 20 Nov '19

20 Nov '19

I am having an ios12.4.1 client whine about access problems. He is getting the 'default' self signed ceritificate instead of the hostname alias. openssl s_client -servername mail.xxxxx.com -connect x.x.x.x:pop3s gives a 'Verify return code: 0 (ok)' I can't imagine this sni support is not available in recent versions. Should I remove this default certificate in the main section of 10-ssl.conf? These lines I have added to 10-ssl.conf ssl_cert = </etc/pki/tls/certs/mail-wildcard.crt ssl_key = </etc/pki/tls/private/mail-wildcard.key local 192.168.10.43 { ssl_key = </etc/pki/tls/private/xxxxxxx.local.key ssl_cert = </etc/pki/tls/certs/xxxxxxx.local.crt } local_name mail.xxxxx.com { ssl_key = </etc/pki/tls/private/mail.xxxxx.com.key ssl_cert = </etc/pki/tls/certs/mail.xxxxx.com.crt } local_name imap.xxxxxxx.net { ssl_key = </etc/pki/tls/private/imap.xxxxxxx.net.key ssl_cert = </etc/pki/tls/certs/imap.xxxxxxx.net.crt } [@ conf.d]# doveconf | egrep 'ssl_cert|ssl_key' ssl_cert = </etc/pki/tls/certs/mail-wildcard.crt ssl_cert_username_field = commonName ssl_key = # hidden, use -P to show it ssl_key_password = ssl_cert = </etc/pki/tls/certs/xxxxxxx.local.crt ssl_key = # hidden, use -P to show it ssl_cert = </etc/pki/tls/certs/mail.xxxxx.com.crt ssl_key = # hidden, use -P to show it ssl_cert = </etc/pki/tls/certs/imap.xxxxxxx.net.crt ssl_key = # hidden, use -P to show it

1 0

Error: Raw backtrace and index cache
by Maciej Milaszewski IQ PL 20 Nov '19

20 Nov '19

Hi I have "problem" with dovect 2.2.13 from repo debian8 and I don't know how to solve it ... Server is a virtual (kvm) with debian 8.11 (postfix + dovecot from repo) and storage is mounting via nfs (I have use only one dovecot with external storage) All works fine but sometime ( after a few hours ) I have got a problem with dovecot cache (i use indexes) logs -> http://paste.debian.net/1117072/ The store is mounted via nfs in /home/ index is local in /var/dovecot_indexes%h All go back to normal when i remove indexes like: find /var/dovecot_indexes/home/ -name 'dovecot*' -type f -delete but this is not good solution What am I doing wrong ? For tunning nfs in 10-mail.conf: --------- "mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h namespace inbox { inbox = yes } mmap_disable = yes dotlock_use_excl = no mail_fsync = always mail_nfs_storage = no mail_nfs_index = no lock_method = fcntl mail_temp_dir = /tmp mail_plugins = quota expire notify mail_log mailbox_idle_check_interval = 30 secs mail_temp_scan_interval = 1w maildir_very_dirty_syncs = no ------------- doveconf -n # 2.2.13: /etc/dovecot/dovecot.conf # OS: Linux 3.16.0-9-amd64 x86_64 Debian 8.11 auth_mechanisms = plain login disable_plaintext_auth = no dotlock_use_excl = no lda_original_recipient_header = X-Original-To log_path = /var/log/dovecot/dovecot.mail133 mail_fsync = always mail_location = maildir:~/Maildir:INDEX=/var/dovecot_indexes%h mail_plugins = quota expire notify mail_log managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mmap_disable = yes namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } passdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } plugin { mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid size sieve = ~/dovecot.sieve sieve_default = /var/lib/dovecot/sieve/default.sieve sieve_dir = %h/sieve sieve_global_dir = /var/lib/dovecot/sieve/ } protocols = " imap lmtp sieve pop3" service auth { unix_listener auth-master { group = users mode = 0666 user = virtual } unix_listener auth-userdb { group = users user = virtual } } service lmtp { inet_listener lmtp { port = 24 } unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } user = virtual } service managesieve-login { inet_listener sieve { address = 127.0.0.1 94.124.15.58 port = 4190 } } ssl_ca = /etc/postfix/ssl/mail.maximail.pl.pem ssl_cert = </etc/postfix/ssl/mail.maximail.pl.pem ssl_key = </etc/postfix/ssl/mail.maximail.pl.key ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } userdb { args = /etc/dovecot/dovecot-sql.conf driver = sql } protocol lmtp { info_log_path = /var/log/dovecot/dovecot.mali133 lmtp_save_to_detail_mailbox = yes mail_plugins = quota sieve notify push_notification } protocol lda { auth_socket_path = /var/run/dovecot/auth-master lda_mailbox_autocreate = yes log_path = /var/log/dovecot/dovecot-lda.mail133 mail_plugins = sieve postmaster_address = root }

2 4

Junk virtual forder
by sergio 20 Nov '19

20 Nov '19

Is it possible to create a virtual folder that selects all mails with imap Junk flag (set by pigeonhole imap4flags' setflag "Junk")? -- sergio.

3 4

Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Hello, I have 2 Dovecot 2.3.8 servers running SSL with valid wildcard certificates. Email clients connect fine, https://www.immuniweb.com/ssl/ tests show certificates are ok. However I can't make replication work when I add ssl = yes. Without ssl it works ok. I added verbose_ssl in config and error log shows: dovecot: doveadm(149.x.x.x): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol >From the other server 149.x.x.x I tested with openssl: openssl s_client -connect 188.x.x.x:12333 -crlf -CAfile /etc/pki/tls/cert.pem CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Organization Validation Secure Server CA verify return:1 depth=0 C = FR, postalCode = 34980, ST = Occitanie, L = Montpellier, street = 123 Main str, O = My Company, OU = PremiumSSL Wildcard, CN = *.domain.com verify return:1 . . SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA384 Session-ID: 95CF7F07702A50CB7CDC5D478986B5A4682EA945C487E770550EE48BFEA53EBC Session-ID-ctx: Master-Key: ECC14F2EE03C04474992A651B3695D78A27A0B07529DB35F61F6FB5F5A5D51395432BDFF37F2 41BD4B3C4B9E1AB6A929 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574108251 Timeout : 300 (sec) Verify return code: 0 (ok) The configuration of the 2 servers below. 188.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: login.domain.com default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_replica = tcp:149.x.x.x:12333 sieve = file:~/sieve;active=~/.dovecot.sieve } protocols = imap pop3 replication_full_sync_interval = 10 mins service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes local 91.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 91.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } 149.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: prime.domain.com auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_plugins = " notify replication" mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes setcred=yes failure_show_msg=yes dovecot driver = pam } plugin { mail_replica = tcp:188.x.x.x:12333 } protocols = imap pop3 replication_full_sync_interval = 10 mins replication_max_conns = 11 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local 178.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 178.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } Your help will be great appreciated.

2 2

[SOLVED] Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Solved, thank you. TCPS was the issue. From: Aki Tuomi <aki.tuomi(a)open-xchange.com> Sent: Wednesday, November 20, 2019 08:54 To: Miro Igov <miro.igov(a)gmail.com>; dovecot(a)dovecot.org Subject: Re: Doveadm replicator ssl issues On 18.11.2019 22.30, Miro Igov via dovecot wrote: Hello, I have 2 Dovecot 2.3.8 servers running SSL with valid wildcard certificates. Email clients connect fine, https://www.immuniweb.com/ssl/ tests show certificates are ok. However I can't make replication work when I add ssl = yes. Without ssl it works ok. I added verbose_ssl in config and error log shows: dovecot: doveadm(149.x.x.x): Error: SSL handshake failed: SSL_accept() failed: error:140760FC:SSL routines:SSL23_GET_CLIENT_HELLO:unknown protocol >From the other server 149.x.x.x I tested with openssl: openssl s_client -connect 188.x.x.x:12333 -crlf -CAfile /etc/pki/tls/cert.pem CONNECTED(00000003) depth=2 C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority verify return:1 depth=1 C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Organization Validation Secure Server CA verify return:1 depth=0 C = FR, postalCode = 34980, ST = Occitanie, L = Montpellier, street = 123 Main str, O = My Company, OU = PremiumSSL Wildcard, CN = *.domain.com verify return:1 . . SSL-Session: Protocol : TLSv1.2 Cipher : ECDHE-RSA-AES256-SHA384 Session-ID: 95CF7F07702A50CB7CDC5D478986B5A4682EA945C487E770550EE48BFEA53EBC Session-ID-ctx: Master-Key: ECC14F2EE03C04474992A651B3695D78A27A0B07529DB35F61F6FB5F5A5D51395432BDFF37F2 41BD4B3C4B9E1AB6A929 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1574108251 Timeout : 300 (sec) Verify return code: 0 (ok) The configuration of the 2 servers below. 188.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: login.domain.com default_vsz_limit = 512 M doveadm_password = # hidden, use -P to show it mail_plugins = " notify replication" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { mail_replica = tcp:149.x.x.x:12333 sieve = file:~/sieve;active=~/.dovecot.sieve <file://~/sieve;active=~/.dovecot.sieve> } protocols = imap pop3 replication_full_sync_interval = 10 mins service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } verbose_ssl = yes local 91.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 91.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } 149.x.x.x # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-754.6.3.el6.x86_64 x86_64 CentOS release 6.10 (Final) # Hostname: prime.domain.com auth_mechanisms = plain login default_vsz_limit = 1 G disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it mail_location = maildir:~/Maildir mail_plugins = " notify replication" mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Archive { auto = subscribe special_use = \Archive } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = session=yes setcred=yes failure_show_msg=yes dovecot driver = pam } plugin { mail_replica = tcp:188.x.x.x:12333 } protocols = imap pop3 replication_full_sync_interval = 10 mins replication_max_conns = 11 service aggregator { fifo_listener replication-notify-fifo { mode = 0666 } unix_listener replication-notify { mode = 0666 } } service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0666 user = postfix } } service doveadm { inet_listener { port = 12333 ssl = yes } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { mode = 0666 } } ssl_cert = </etc/dovecot/ssl_chain.pem ssl_cipher_list = ECDHE-RSA-AES256-SHA384:AES256-SHA256:AES256-SHA256:HIGH:MEDIUM:+TLSv1:+TLSv 1.1:+TLSv1.2:!RC4:!IDEA:!3DES:!MD5:!ADH:!aNULL:!eNULL:!NULL:!DH:!ADH:!EDH:!A ESGCM:!CAMELLIA:!SEED ssl_client_ca_file = /etc/pki/tls/cert.pem ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { driver = passwd } protocol imap { mail_max_userip_connections = 50 } protocol pop3 { pop3_uidl_format = %08Xu%08Xv } local 178.x.x.x { protocol imap { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } local 178.x.x.x { protocol pop3 { ssl_cert = </etc/dovecot/ssl_chain.pem ssl_key = # hidden, use -P to show it } } Hi! You need to use tcps in mail_replica. Aki

1 0

[SOLVED] Doveadm replicator ssl issues
by Miro Igov 20 Nov '19

20 Nov '19

Solved, thank you! TCPS was the problem. Hi! You need to use tcps in mail_replica. Aki

1 0

http API for IMAP
by Thomas Güttler 20 Nov '19

20 Nov '19

10 22

Panic: file smtp-client-connection.c: line 1142 (smtp_client_connection_established)
by Dirk 20 Nov '19

20 Nov '19

I'm using dovecot in a multi server setup. Two directors forward pop3, imap and smtp to backend dovecots with their central storage on NFS. Yesterday I stumbled upon these log lines: 2019-11-18 20:17:51 lmtp(17274): Info: Connect from 172.22.1.6 2019-11-18 20:17:51 lmtp(17274): Panic: file smtp-client-connection.c: line 1142 (smtp_client_connection_established): assertion failed: (!conn->connect_succeeded) 2019-11-18 20:17:51 lmtp(17274): Fatal: master: service(lmtp): child 17274 killed with signal 6 (core not dumped - https://dovecot.org/bugreport.html#coredumps - set /proc/sys/fs/suid_dumpable to 2) Is a core dump required to find the source of that error? Thanks for any help! $ doveconf -n # 2.3.4.1 (f79e8e7e4): /etc/dovecot/dovecot.conf # OS: Linux 4.9.0-8-amd64 x86_64 # Hostname: m03.company.com auth_cache_negative_ttl = 65 secs auth_cache_ttl = 3 mins auth_cache_verify_password_with_worker = yes auth_mechanisms = plain login auth_verbose = yes debug_log_path = /dev/stdout default_client_limit = 10400 default_process_limit = 1024 default_vsz_limit = 1 G deliver_log_format = msgid=%m: %s %{session_time} %$ director_mail_servers = 10.10.10.2 10.10.10.3 director_servers = 10.10.1.2 10.10.1.3 imap_id_log = * imap_max_line_length = 2 M import_environment = TZ CORE_OUTOFMEM CORE_ERROR info_log_path = /dev/stdout instance_name = dovecot_director listen = 10.10.1.3,:: lmtp_proxy = yes log_path = /dev/stderr log_timestamp = "%Y-%m-%d %H:%M:%S " login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k session=<%{session}> mail_max_userip_connections = 250 passdb { args = /etc/dovecot/sql/dovecot-dict-sql-passdb.conf driver = sql result_failure = return-fail result_internalfail = return-fail result_success = continue-ok } passdb { args = proxy=y starttls=any-cert master=director(a)m03.company.com pass=#hidden_use-P_to_show# nopassword=y driver = static skip = unauthenticated } pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, uidl=%u protocols = imap lmtp pop3 service auth-worker { user = $default_internal_user } service director { fifo_listener login/proxy-notify { mode = 0600 user = $default_login_user } inet_listener { port = 9090 } unix_listener director-userdb { mode = 0600 user = vmail } unix_listener login/director { mode = 0666 } } service imap-login { executable = imap-login director process_min_avail = 2 vsz_limit = 1 G } service lmtp { inet_listener lmtp { port = 24 } process_min_avail = 2 unix_listener lmtp { mode = 00 } user = vmail vsz_limit = 1 G } service log { user = dovenull } service pop3-login { executable = pop3-login director process_min_avail = 2 vsz_limit = 1 G } service pop3 { user = vmail } ssl_cert = </etc/ssl/mail/cert.pem ssl_client_ca_dir = /etc/ssl/certs/ ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_prefer_server_ciphers = yes submission_host = postfix:588 protocol lmtp { auth_socket_path = director-userdb }

2 1

Sieve and recipient_delimiter
by ＠lbutlr 17 Nov '19

17 Nov '19

I use recipient_delimiter addresseses quiet a bit, and I want to put several of them into a mailbox if anyof (header :contains ["to"] [ “FOO", “foo", “bar", “florin"]) { fileinto :create “later"; stop; } When I get an email addressed to me+FOO(a)example.com or me_florin(a)example.com, the messages end up in my inbox (Yes, I have both + and _ defined as delimiters in postfix and in dovecot). Is this because sieve is not seeing the delimiter? I am wondering this because I have another rule that seems to be working fine that is largely the same, but operates on domains: if anyof ( header :contains ["From"] [“kreme.com", “localdomain1.tld”, "localdomain2.tld", "localdomain3.tld", “covisp.net” ]){ fileinto :create "priority"; } -- She'd always tried to face towards the light. But the harder you stared into the brightness the harsher it burned into you until, at last, the temptation picked you up and bid you turn around to see how long, rich, strong and dark, streaming away behind you, your shadow had become- --Carpe Jugulum

2 2

Auto expunge log
by Michael Ludwig 16 Nov '19

16 Nov '19

Hi, I'm just setting up a new dovecot system and wonder why I get this error. On another dovecot system this works with no problems. Log entry when exiting MUA Thunderbird: =========================== Nov 16 20:16:35 myhostname dovecot: imap(info(a)mydomain.de): Error: autoexpunge: Couldn't create dovecot.autoexpunge.lock lock: file_create_locked(/var/mail/vmail/mydomain.de/info//dovecot.autoexpunge.lock) failed: safe_mkstemp(/var/mail/vmail/mydomain.de/info//dovecot.autoexpunge.lock) failed: No such file or directory =========================== Is this double slash between /info//dovecot.auto... okay? I believe there should be a "Mailbox" in between? Configuration in /etc/dovecot/conf.d/15-mailboxed.conf =========================== namespace inbox { mailbox Junk { auto = subscribe special_use = \Junk autoexpunge = 90d } =========================== Maybe you can help me a bit. ;-) Michael

2 1

Feature request: ssl-cert config
by Marc Roos 16 Nov '19

16 Nov '19

I am not sure why this </ is used in the configuration. But I hoped it would concatenate the ssl_cert to have multiple certificates. So one could use it multiple times, as needed. It would be nice to be able to specify the intermediate certificate (bundle) separate from the certificate, so when updating the certificate I just have to replace this file. Something like local_name mail.xxxxxx.xxx { ssl_key = </etc/pki/tls/private/mail.xxxxxx.xxx.key ssl_cert = </etc/pki/tls/certs/mail.xxxxxx.xxx.crt ssl_cert = </etc/pki/tls/certs/SectigoIntermediate.crt } Or local_name mail.xxxxxx.xxx { ssl_key = </etc/pki/tls/private/mail.xxxxxx.xxx.key ssl_cert = </etc/pki/tls/certs/mail.xxxxxx.xxx.crt ssl_int = </etc/pki/tls/certs/SectigoIntermediate.crt } dovecot-2.2.36-3.el7_7.1.x86_64

1 0

SCRAM-SHA-1-PLUS / SCRAM-SHA-224(-PLUS) / SCRAM-SHA-256(-PLUS), SCRAM-SHA-384(-PLUS) and SCRAM-SHA-512(-PLUS) supports
by - Neustradamus - 15 Nov '19

15 Nov '19

Dear all, I send you a new email to know what is the progress of SCRAM-SHA-***(-PLUS) supports? Currently there is only SCRAM-SHA-1: https://doc.dovecot.org/configuration_manual/authentication/password_scheme…. - RFC6331: Moving DIGEST-MD5 to Historic: https://tools.ietf.org/html/rfc6331 - RFC5802: Salted Challenge Response Authentication Mechanism (SCRAM) SASL and GSS-API Mechanisms: https://tools.ietf.org/html/rfc5802 - RFC7677: SCRAM-SHA-256 and SCRAM-SHA-256-PLUS Simple Authentication and Security Layer (SASL) Mechanisms: https://tools.ietf.org/html/rfc7677 - since 2015-11-02 I have seen several months ago, commits about SCRAM-SHA-256. For your information, Cyrus SASL supports: - SCRAM-SHA-1(-PLUS) - SCRAM-SHA-224(-PLUS) - SCRAM-SHA-256(-PLUS) - SCRAM-SHA-384(-PLUS) - SCRAM-SHA-512(-PLUS) -> https://cyrusimap.org/sasl/sasl/authentication_mechanisms.html You can see more and more informations here: https://github.com/scram-xmpp/info/issues/1 Thanks in advance. Regards, Neustradamus

1 0

ACL's with SQL/from mysql table
by Jorge Bastos 15 Nov '19

15 Nov '19

Howdy, Would someone point me to a good howto on how to implement ACL from an sql table? Thanks in advanced,

1 0

IMAP4 extensions for Visual Voicemail (VVM)
by Rajesh Bansal 15 Nov '19

15 Nov '19

Hi Team, I need to develop Visual VoiceMail solution. In this solution I need a IMAP4 server, from which I can get a hit for each mail retrieval. Can anyone help me if dovecot can be used for this purpose. BR, Rajesh Bansal

5 5

SASL AUTH with postfix
by Jorge Bastos 15 Nov '19

15 Nov '19

Hi, I just moved from Cyrus SASL to Dovecot SASL, with postfix. Works great, and no issue with non-ascii chars, has i had with Cyrus. With Cyrus i was getting the username/passwd via SQL, with this: sql_select: select password from smtp_auth_users where username='%u@%r' and status='true' worked ok for users with email addresses, and i had some special users that were just a name, like "user-1", and i was able to AUTH it. Postfix had: smtpd_sasl_local_domain = fastmail and in the database i had the username in the format: user-1@fastmail and worked ok. How can i have the same with dovecot SASL? Thanks in advanced,

3 7

Crash when moving mail from Inbox to Trash
by marvin alcantara 14 Nov '19

14 Nov '19

Hi, I am developing a dovecot plugin, and inside my plugin I am implementing my own expunge function. Inside my function, I am calling the following lines of code: if (storage->v.mail_open(mail, &offset, &mail->open_file) < 0) return -1; The mail_open virtual function is an invalid address. The storage should be mdbox however, it seems that it didn't get the correct mdbox_mail_open of mdbox-storage. Do you have any suggestions as to why this is happening? dovecot version:2.3.7 (a3d493f) Sincerely,Marvin

1 0

RFC 5258 violation: incomplete response for "LIST ($OPT RECURSIVEMATCH) ..."
by Guilhem Moulin 12 Nov '19

12 Nov '19

Hi there, RFC 5258 (IMAP4 LIST command extensions) defines a ‘RECURSIVEMATCH’ selection option which “forces the server to return information about parent mailboxes that don't match other selection options, but have some submailboxes that do.” (Section 3.5 makes the requirement even clearer.) However that's not what Dovecot 2.3.7 does. AFAICT no LIST response is returned for mailboxes that don't meet the selection criteria, regardless of whether they have a child that does. The violation is visible when reproducing example #9 from Section 5 [0]: $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin \ doveadm -c /tmp/dovecot.conf mailbox create foo2 baz2 $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin \ doveadm -c /tmp/dovecot.conf mailbox create -s \ foo2/{bar1,bar2} baz2/{bar2,bar22,bar222} eps2 eps2/mamba qux2/bar2 $ env -i USER=user HOME=/dev/shm/dovecot-test/user PATH=/usr/bin:/bin \ doveadm -c /tmp/dovecot.conf exec imap S: * PREAUTH [CAPABILITY IMAP4rev1 … LIST-EXTENDED …] Logged in as user C: D01 LIST "" "*" S: * LIST (\Noselect \HasChildren) "/" qux2 S: * LIST (\HasNoChildren) "/" qux2/bar2 S: * LIST (\HasChildren) "/" eps2 S: * LIST (\HasNoChildren) "/" eps2/mamba S: * LIST (\HasChildren) "/" baz2 S: * LIST (\HasNoChildren) "/" baz2/bar222 S: * LIST (\HasNoChildren) "/" baz2/bar22 S: * LIST (\HasNoChildren) "/" baz2/bar2 S: * LIST (\HasChildren) "/" foo2 S: * LIST (\HasNoChildren) "/" foo2/bar2 S: * LIST (\HasNoChildren) "/" foo2/bar1 S: * LIST (\HasNoChildren) "/" INBOX S: D01 OK List completed (0.006 + 0.000 + 0.005 secs). C: D02 LIST (SUBSCRIBED) "" "*" S: * LIST (\Subscribed) "/" foo2/bar1 S: * LIST (\Subscribed) "/" foo2/bar2 S: * LIST (\Subscribed) "/" baz2/bar2 S: * LIST (\Subscribed) "/" baz2/bar22 S: * LIST (\Subscribed) "/" baz2/bar222 S: * LIST (\Subscribed) "/" eps2 S: * LIST (\Subscribed) "/" eps2/mamba S: * LIST (\Subscribed) "/" qux2/bar2 S: D02 OK List completed (0.001 + 0.000 secs). A LIST command with ‘RECURSIVEMATCH SUBSCRIBED’ selection options produces an incomplete response: C: D03 LIST (RECURSIVEMATCH SUBSCRIBED) "" "*" S: * LIST (\Subscribed) "/" foo2/bar1 S: * LIST (\Subscribed) "/" foo2/bar2 S: * LIST (\Subscribed) "/" baz2/bar2 S: * LIST (\Subscribed) "/" baz2/bar22 S: * LIST (\Subscribed) "/" baz2/bar222 S: * LIST (\Subscribed) "/" eps2 (CHILDINFO ("SUBSCRIBED")) S: * LIST (\Subscribed) "/" eps2/mamba S: * LIST (\Subscribed) "/" qux2/bar2 S: D03 OK List completed (0.001 + 0.000 secs). The following untagged LIST responses for ‘foo2’ and ‘baz2’ are missing. RFC 5258 mandates their inclusion because even though they're not subscribed to themselves, they each have (at least) a subscribed child. S: * LIST () "/" "foo2" ("CHILDINFO" ("SUBSCRIBED")) S: * LIST () "/" "baz2" ("CHILDINFO" ("SUBSCRIBED")) Cheers, -- Guilhem. [0] https://tools.ietf.org/html/rfc5258#section-5

1 0

How to send a test message directly to lmtp, to test proxying
by Marc Roos 12 Nov '19

12 Nov '19

How to send a test message directly to lmtp, to test proxying?

2 2

Howto pin user in proxy/director <-> backend server setup
by Marc Roos 12 Nov '19

12 Nov '19

I have 1x proxy/director server 2x backend mail server The backend servers are using a ldap database and do not have the option to put a proxy=y value. So I put this as a default in the passdb option in the proxy/director config. When I do telnet localhost 110 on the proxy/director, I can authenticate with a test account on svr1.local 1. Will automatically all users be directed to the first server configured in director_mail_servers = svr1.local svr2.local, when the do not have a proxy=y or host=? If this is the case maybe, we should write this somewhere on https://wiki2.dovecot.org/Director https://doc.dovecot.org/configuration_manual/authentication/proxies/ 2. If I change the host= in the ldap server, I think the proxy/director has archived the previous host and still redirects to the old value. Is there a way around this? (stopping/starting dovecot -F resolves this) 3. Do I need the director even in this setup?

1 0

[SOLVED] dovecot -2.2.24 on Fedora 31
by Frank Elsner 12 Nov '19

12 Nov '19

Hello Aki, thanks for your patience and help. I solved my problems by compiling dovecot-2.3.8 and following the migration hints I got it working. Happy, Frank

1 0

postfix + spamassassin + dovecot-lda (with sieve support)
by Дмитрий До лженко 12 Nov '19

12 Nov '19

Hello, I have FreeBSD 12 server with postfix + spamassassin. Old config work fine. ------ old postfix master.cf spamfilter unix - n n - - pipe flags=R user=nobody argv=/usr/local/bin/spamc -e /usr/sbin/sendmail -oi -f ${sender} ${recipient} ------ I try to add dovecot-lda (with sieve support) as local delivery agent to postfix config ----------- postfix master.cf # Spamd filter spamfilter unix - n n - - pipe flags=DRhu user=nobody argv=/usr/local/bin/spamc -e /usr/local/libexec/dovecot/dovecot-lda -f ${sender} -d ${recipient} ----------- Test mail is bounced with report - --------- If you do so, please include this problem report. You can delete your own text from the attached returned message. The mail system <dol(a)mig.hys.msu.ru>: user unknown --------- /var/log/maillog Nov 11 22:40:49 mig postfix/smtpd[55978]: disconnect from acs366.hys.msu.ru[93.10.51.14] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5 Nov 11 22:40:49 mig dovecot[64447]: auth-worker(55751): passwd(dol(a)mig.hys.msu.ru): unknown user System user dol exist, but LDA try to deliver to dol(a)mig.hys.msu.ru Please, help me to solve this problem. I need to serve IMAP and POP3 clients with delivery to /var/mail/username mailboxes if no user sieve rules exists. Best regards, Dmitry.

2 1

dovecot -2.2.24 on Fedora 31
by Frank Elsner 12 Nov '19

12 Nov '19

Hi, I try to compile dovecot -2.2.24 on Fedora 31 and get the following error: iostream-openssl.c: In function ‘openssl_iostream_verify_client_cert’: iostream-openssl.c:118:37: error: dereferencing pointer to incomplete type ‘X509_STORE_CTX’ {aka ‘struct x509_store_ctx_st’} 118 | subject = X509_get_subject_name(ctx->current_cert); | ^~ make[3]: *** [Makefile:561: iostream-openssl.lo] Error 1 All openssl packages installed. What's the reason and how solve the problem? Kind regards, Frank Elsner

2 8

Login/director not created
by Marc Roos 11 Nov '19

11 Nov '19

I have this[0] config, yet the /var/run/dovecot/login/director is not created, what to check in the config? dovecot: imap-login: Error: auth: connect(director) failed: No such file or directory [0] service director { unix_listener login/director { #mode = 0666 } fifo_listener login/proxy-notify { #mode = 0666 } unix_listener director-userdb { #mode = 0600 } inet_listener { #port = } }

2 4

gssapi without passdb
by David Wells 11 Nov '19

11 Nov '19

Good afternoon. I'm configuring dovecot to authenticate users against a samba server running as an active directory domain controller. I followed the instructions as stated in the page https://wiki.dovecot.org/Authentication/Kerberos and considering the sentence that states [...]The Kerberos authentication mechanism doesn't require having a passdb, but you do need a userdb[...] I produced a configuration file that looked like this > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = gssapi > auth_username_format = %u > mail_location = > maildir:~/Maildir:INDEX=/var/lib/dovecot/%d/%n:CONTROL=/var/lib/dovecot/%d/%n:UTF-8 > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope > encoded-character vacation subaddress comparator-i;ascii-numeric > relational regex imap4flags copy include variables body enotify > environment mailbox date index ihave duplicate mime foreverypart > extracttext > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > } > protocols = imap > ssl_ca = /etc/ssl/certs/cacertificate.crt > ssl_cert = </etc/ssl/certs/certificate.crt > ssl_key = # hidden, use -P to show it > userdb { > args = uid=vmail gid=vmail home=/var/vmail/%d/%n allow_all_users=yes > driver = static > } When I ran these settings I would get an error that read > Nov 8 17:00:00 mail dovecot: auth: Error: > gssapi(user(a)KERBEROSPRINCIPAL,192.168.182.137,<IQMcOtuWI+3AqLaJ>): All > password databases were skipped > Nov 8 17:00:02 mail dovecot: imap-login: Disconnected (auth service > reported temporary failure): user=<user@KERBEROSPRINCIPAL>, > method=GSSAPI, rip=192.168.182.137, lip=192.168.182.4, TLS, > session=<IQMcOtuWI+3AqLaJ> After Trying many things I finally modified my config > auth_gssapi_hostname = $ALL > auth_krb5_keytab = /etc/dovecot/dovecot.keytab > auth_mechanisms = gssapi > auth_username_format = %u > mail_location = > maildir:~/Maildir:INDEX=/var/lib/dovecot/%d/%n:CONTROL=/var/lib/dovecot/%d/%n:UTF-8 > managesieve_notify_capability = mailto > managesieve_sieve_capability = fileinto reject envelope > encoded-character vacation subaddress comparator-i;ascii-numeric > relational regex imap4flags copy include variables body enotify > environment mailbox date index ihave duplicate mime foreverypart > extracttext > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > args = /etc/dovecot/dovecot-ldap.conf.ext > driver = ldap > } > plugin { > sieve = file:~/sieve;active=~/.dovecot.sieve > } > protocols = imap > ssl_ca = /etc/ssl/certs/cacertificate.crt > ssl_cert = </etc/ssl/certs/certificate.crt > ssl_key = # hidden, use -P to show it > userdb { > args = uid=vmail gid=vmail home=/var/vmail/%d/%n allow_all_users=yes > driver = static > } The dovecot-ldap.conf.ext file looks like this > hosts = dc1:3268 > tls = yes > auth_bind = yes > auth_bind_userdn = %u > base = With this configuration I can authenticate to the imap server sending user@KERBEROSPRINCIPAL as my username and without setting a password so I'm wondering if the wiki page needs to be updated or if there is something wrong with my first setup. Thanks in advance. Best regards, David Wells.

2 1

Sieve vacation :addresses match only case-sensitive?
by Philipp Faeustlin 11 Nov '19

11 Nov '19

The recipients in the vacation :addresses String list are matched case-sensitive. If the recipient gets a mail with wrong case, the message is discarded with: "discarding vacation response for implicitly delivered message; no known (envelope) recipient address found in message headers" I think the matching should be case-insensitive. Is this a bug or do I miss some option? I'm using Dovecot 2.3.7.2, Pigeonhole version 0.5.7.2. -- Philipp Fäustlin

5 9

Proxy testing in container( chown failed /var/dovecot/login)
by Marc Roos 11 Nov '19

11 Nov '19

I am testing a bit with the proxy, and trying to run dovecot as a normal user. (with cap bind_service). I was wondering what the minimum configuration is for running like a proxy. I am now getting issues like unable to chown on /var/dovecot/login, but I do not need this in such a setup do I? passdb { driver = static args = proxy=y host=192.168.11.10 nopassword=y }

2 3

Error: Corrupted index cache file and Error: Maildir filename has wrong S value
by Brent Clark 11 Nov '19

11 Nov '19

Good day Guys I have been met with a very interesting set of error messages. Here is the snippet(s) https://pastebin.com/raw/nFf79Ebc (Sorry for all the redacted REMOVED_*.) Google is proving to be a bit challenging in helping and explaining. Could anyone please share how something like this happens, but more importantly how to recover from this. doveadm index -u <username> INBOX do the trick? I also would like to ask the community, is there any tips or tricks any of you guys do to mitigate index / cache corruptions. Many thanks Regards Brent Clark

2 5

User found but password failure
by Mauricio Tavares 11 Nov '19

11 Nov '19

Trying to figure out which step is causing me not to be able to login. I am using a password file, passdb { driver = passwd-file args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/passwd } We will assume that the pw I created using 'doveadm pw -s SHA512-CRYPT' matches the password I will be using to login below. I crank the debugging mode, auth_debug_passwords = yes auth_debug = yes And then try to login [root@mail ~]# nc -t localhost 143 * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN AUTH=GSSAPI] Howdy a login raub(a)example.com password [blank] which from what I gathered from /var/log/dovecot means it found matching username but did not match password: secured session=lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB lip=::1 rip=::1 lport=143 rport=36340 resp=base64-reply (previous base64 data may contain sensitive data) Aug 26 03:25:52 auth: Debug: passwd-file(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): lookup: user=raub(a)example.com file=/etc/dovecot/passwd Aug 26 03:25:52 auth: Debug: client passdb out: OK 1 user=raub(a)example.com Aug 26 03:25:52 auth: Debug: master in: REQUEST 1520959489 26560 1 63ee7f45236f85fd39573a5c8a2eb46a session_pid=26563 request_auth_token Aug 26 03:25:52 auth-worker(26562): Debug: passwd(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): lookup Aug 26 03:25:52 auth-worker(26562): Info: passwd(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): unknown user Aug 26 03:25:52 auth: Debug: passwd-file(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): lookup: user=raub(a)example.com file=/etc/dovecot/passwd Aug 26 03:25:52 auth: Error: plain(raub@example.com,::1,<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB>): user not found from any userdbs Aug 26 03:25:52 auth: Debug: master userdb out: NOTFOUND 1520959489 Aug 26 03:25:52 imap: Error: Authenticated user not found from userdb, auth lookup id=1520959489 (auth connected 1 msecs ago, handshake 0 msecs ago, request took 1 msecs, client-pid=26560 client-id=1) Aug 26 03:25:52 imap-login: Info: Internal login failure (pid=26560 id=1) (internal failure, 1 successful auths): user=<raub(a)example.com>, method=PLAIN, rip=::1, lip=::1, mpid=26563, secured, session=<lyJttvyQ9I0AAAAAAAAAAAAAAAAAAAAB> Per [1] I decided to see what the response (base64-reply) I am submitting to dovecot looks like: echo 'base64-reply' | base64 -d raub(a)example.compassword Which has the right username and password but follows the userpassword format, not useruserpassword as I was led to believe by [1]. Is that to be expected? If it is then the issue is further down the line. [1] https://wiki.dovecot.org/Debugging/Authentication

3 5

Dovecot on CentOS8 / RHEL8
by Aki Tuomi 11 Nov '19

11 Nov '19

If you are planning to run dovecot on CentOS8 or RedHat 8 using native packages, please be aware that pigeonhole is not currently available (but they are working on it), see https://bugzilla.redhat.com/show_bug.cgi?id=1766985 . We are working on getting our CentOS8 packages available on repo.dovecot.org. Aki

1 0

MariaDB database for users and passwords?
by Ken Wright 10 Nov '19

10 Nov '19

Greetings, All! I've got an email server set up with Postfix and Dovecot, but Dovecot can't find any users. I'd ilke to use the database I set up in MariaDB for users (referenced by Postfix), but I'm just not sure how to do it. There's a line in dovecot.conf specifying /etc/dovecot/passwd.db, but obviously that's not the one I set up in MariaDB. Is what I want even possible? Ken -- Registered Linux user #483005 If you ever think international relations make sense, remember this: because a Serb shot an Austrian in Bosnia, Germany invaded Belgium.

8 14

G Suite migration using dsync
by Paul Pace 09 Nov '19

09 Nov '19

Hello, I am trying to migrate a domain from G Suite using dsync and am not clear on how to configure so I am getting failures. This is the configuration in dovecot.conf: imapc_host = imap.gmail.com imapc_port = 993 imapc_password = 1234 imapc_ssl = imaps imapc_ssl_verify = yes imapc_features = gmail-migration I also tried with imapc_ssl_verify commented. For simplicity, both the username and password are the same for G Suite and Dovecot and are verified to access the G Suite account with other tools. Here is the command (from the wiki) and output: # doveadm backup -a 'virtual/All' -O '-$GmailHaveLabels' -R -u user(a)example.com imapc: dsync(user(a)example.com): Info: imapc(imap.gmail.com:993): Connected to 2607:f8b0:4003:c0f::6c:993 (local IPv6:port) dsync(user(a)example.com): Warning: imapc(imap.gmail.com:993): Server disconnected unexpectedly: SSL_connect() failed: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure: SSL alert number 40 - reconnecting (delay 0 ms) dsync(user(a)example.com): Info: imapc(imap.gmail.com:993): Connected to 74.125.30.109:993 (local IPv4:port) dsync(user(a)example.com): Error: imapc(imap.gmail.com:993): Server disconnected unexpectedly: SSL_connect() failed: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure: SSL alert number 40 - disconnecting dsync(user(a)example.com): Error: User initialization failed: imapc: Login to imap.gmail.com failed: Disconnected from server In reading through the wiki, it seems I am missing something, but I can't figure out what is missing and internet searches don't provide further useful information on the dovecot tools. Thank you, Paul

1 0

Reading config-value from file does not work.
by Jakobus Schürz 08 Nov '19

08 Nov '19

Hi guys! In https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/ i ca see this: Reading value from file It’s possible to read the value for a setting from a file: key = </path/to/file The value is read exactly as the entire contents of the file. This includes all the whitespace and newlines. The paths are relative to the currently parsed config file’s directory, similar to how !include works. The file is read immediately whenever parsing the configuration file, so if it changes afterwards it requires a configuration reload to see the changes. This functionality is especially useful for reading SSL certificates and keys. So i thought it's a good idea, to write the password for dnpass for my ldap in this notation in my config dnpass = <private/dnpass /etc/dovecot/private/dnpass contains only this myVerYSecretLdApPAssworD no space, no newline. But dovecot cannot authenticate on the ldap-host. I also tried dnpass = </private/dnpass dnpass = </etc/dovecot/private/dnpass Then i tried a file /etc/dovecot/conf.d/00-dnpass.conf with dnpass = myVerYSecretLdApPAssworD It should be included with dovecot.conf !include conf.d/*.conf The only notation that works is the line dnpass = myVerYSecretLdApPAssworD in /etc/dovecot/dovecot-ldap-userdb.conf.ext I thought it's a good idea to write it in an extra file, so i have to manipulate only one small file with ansible, when i renew the password. Is it a bug or does it work as designed, and the doc is wrong? thank you Jakob

1 1

dovecot ignores users sieve-script
by Jakobus Schürz 08 Nov '19

08 Nov '19

Hi there! I recognized that dovecot ignores users sieve-script. The global and the post-sieve-scripts are working, but users sievescript is ignored. You can see the sieve trace-files last lines 65: finishing match with result: not matched 65: jump if result is true 65: not jumping 65: jumping to line 67 67: jumping to line 77 ## Finished executing script 'global' ## Started executing script 'junk' 2: header test 2: starting `:contains' match with `i;ascii-casemap' comparator: 2: extracting `X-Spam' headers from message 2: finishing match with result: not matched 2: jump if result is false 2: jumping to line 6 ## Finished executing script 'junk' Between global and junk-Script should sieve run users sieve script. Before the Upgrade to 2.3.8 sieve was working correct. Now ALL messages go to INBOX, no one is filtered anymore. compiling the sievescript with sudo -u vmail sievec sievefilter.sieve gives no errormessage... My users sievefilter is: /var/mail/jakobus.schuerz/sieve/sievefilter.sieve This directory contains: lrwxrwxrwx 1 vmail vmail 17 Nov 7 12:44 jakobus.schuerz.sieve -> sievefilter.sieve -rw------- 1 vmail vmail 36834 Nov 7 13:25 jakobus.schuerz.svbin -rw------- 1 vmail vmail 45588 Nov 7 11:43 sievefilter.sieve The dovecot conf dump: # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 4.19.0-6-amd64 x86_64 Debian 10.1 # Hostname: mail.mydomain.example auth_mechanisms = plain login cram-md5 digest-md5 auth_socket_path = /var/run/dovecot/auth-userdb disable_plaintext_auth = no first_valid_uid = 1000 imap_capability = +XDOVECOT +SPECIAL-USE imap_client_workarounds = tb-extra-mailbox-sep tb-lsub-flags delay-newmail lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = *, ::1 login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c tls=%k login_trusted_networks = 127.0.0.1/8 192.168.0.0/24 192.168.1.0/24 172.17.0.0/24 172.18.0.0/24 mail_gid = vmail mail_home = /var/mail/%u mail_location = maildir:~/Maildir:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/Maildir/%u:CONTROL=/var/lib/dovecot/db/control/Maildir/%u mail_plugins = zlib quota acl listescape mail_log notify virtual fts fts_lucene mail_privileged_group = vmail mail_server_admin = mailto:user@mydomain.example mail_shared_explicit_inbox = yes mail_uid = vmail managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve namespace Geteilt { hidden = no inbox = no list = children location = maildir:/var/mail/%%u/Maildir:LAYOUT=fs:INDEXPVT=/var/lib/dovecot/db/indexes/shared/%u/%%u prefix = Geteilt/%%n/ separator = / subscriptions = no type = shared } namespace History { hidden = no inbox = no list = children location = maildir:/var/mail/archiv/%u/:LAYOUT=fs:INDEX=/var/lib/dovecot/db/indexes/archiv/%u:CONTROL=/var/lib/dovecot/db/control/archiv/%u mailbox Archiv { auto = subscribe special_use = \Archive } prefix = Archiv/ separator = / subscriptions = no type = private } namespace Synoptic { hidden = no ignore_on_failure = no list = children location = virtual:/var/mail/virtual/synoptic:INDEX=/var/lib/dovecot/db/indexes/virtual/synoptic/%u mailbox AKTUELL { auto = subscribe special_use = \All } mailbox Markierte { auto = subscribe special_use = \Flagged } mailbox Neue { auto = subscribe } mailbox Rechnungen { auto = subscribe } mailbox WICHTIG { auto = subscribe } prefix = Synoptic/ separator = / subscriptions = no } namespace Tulln { list = children location = maildir:/var/mail/public/tulln:SUBSCRIPTIONS=subscriptions/%u:LAYOUT=fs:INDEXPVT=/var/lib/dovecot/db/indexes/public/tulln/%u mailbox Familie { auto = subscribe } mailbox Versicherungen { auto = subscribe } mailbox familyextracard { auto = subscribe } prefix = Tulln/ separator = / subscriptions = no type = public } namespace inbox { hidden = no inbox = yes location = mailbox "Deleted Messages" { auto = no autoexpunge = 30 days special_use = \Trash } mailbox Drafts { auto = no special_use = \Drafts } mailbox Entwürfe { auto = no special_use = \Drafts } mailbox "Gelöschte Elemente" { auto = no autoexpunge = 30 days special_use = \Trash } mailbox "Gelöschte Objekte" { auto = no autoexpunge = 30 days special_use = \Trash } mailbox Gesendet { auto = no special_use = \Sent } mailbox "Gesendete Elemente" { auto = no special_use = \Sent } mailbox "Gesendete Objekte" { auto = no special_use = \Sent } mailbox Junk { auto = subscribe autoexpunge = 30 days special_use = \Junk } mailbox Mistkübel { auto = no autoexpunge = 30 days special_use = \Trash } mailbox Papierkorb { auto = no autoexpunge = 30 days special_use = \Trash } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = no autoexpunge = 30 days special_use = \Junk } mailbox Synoptic/AKTUELL { auto = no comment = All my messages special_use = \All } mailbox Trash { auto = no autoexpunge = 30 days special_use = \Trash } prefix = INBOX/ separator = / subscriptions = no type = private } namespace subscriptions { hidden = yes list = no location = prefix = subscriptions = yes } passdb { args = /etc/dovecot/dovecot-ldap-passdb-user.conf.ext driver = ldap name = user } passdb { args = /etc/dovecot/dovecot-ldap-passdb-admin.conf.ext driver = ldap name = admin } passdb { args = /etc/dovecot/dovecot-ldap-passdb-others.conf.ext driver = ldap name = others } plugin { acl = vfile:/etc/dovecot/dovecot-acl:cache_secs=300 acl_shared_dict = file:/var/lib/dovecot/db/shared-mailboxes.db fts = lucene fts_autoindex = yes fts_autoindex_max_recent_msgs = 80 fts_index_timeout = 90 fts_lucene = whitespace_chars=@. normalize no_snowball imapsieve_mailbox1_before = file:/etc/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = INBOX/Junk imapsieve_mailbox2_before = file:/etc/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = INBOX/Junk imapsieve_mailbox2_name = * mail_home = /var/mail/%u mail_log_events = delete undelete expunge copy mailbox_delete mailbox_rename mail_log_fields = uid box msgid subject from flags setting_name = sieve, managedsieve sieve = file:/var/mail/%u/sieve/;active=/var/mail/%u/sieve/%u.sieve sieve_after = /etc/dovecot/sieve/after.d/ sieve_before = /etc/dovecot/sieve/global.sieve sieve_global_dir = /etc/dovecot/sieve/ sieve_global_extensions = +vnd.dovecot.pipe sieve_pipe_bin_dir = /etc/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms sieve_trace_dir = /var/log/dovecot/sieve/trace sieve_trace_level = matching sieve_user_log = /var/mail/%u/sieve/sieve.log } postmaster_address = postmaster@localhost protocols = " imap lmtp lmtp sieve pop3 sieve" service anvil { client_limit = 199999 unix_listener anvil-auth-penalty { mode = 0700 } } service auth { unix_listener auth-client { group = vmail mode = 0666 user = Debian-exim } unix_listener auth-userdb { group = vmail mode = 0666 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } process_min_avail = 1 service_count = 1 } service imap-postlogin { executable = script-login -d rawlog /etc/dovecot/acl_groups.py unix_listener imap-postlogin { group = vmail user = vmail } } service imap { executable = imap imap-postlogin process_limit = 1024 vsz_limit = 400 M } service lmtp { user = Debian-exim vsz_limit = 400 M } service stats { unix_listener stats-writer { group = vmail mode = 0600 user = vmail } } ssl = required ssl_cert = </etc/letsencrypt/live/imap.mydomain.example/fullchain.pem ssl_cipher_list = ALL:!ADH:!LOW:!SSLv2:!SSLv3:!EXP:!aNULL:+HIGH:+MEDIUM ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap-userdb.conf.ext default_fields = home=/var/mail/%u uid=vmail gid=vmail driver = ldap } verbose_proctitle = yes protocol lmtp { auth_username_format = %Ln mail_plugins = zlib quota acl listescape mail_log notify virtual fts fts_lucene quota sieve acl } protocol lda { info_log_path = log_path = mail_plugins = zlib quota acl listescape mail_log notify virtual fts fts_lucene quota sieve acl } protocol imap { mail_max_userip_connections = 60 mail_plugins = zlib quota acl listescape mail_log notify virtual fts fts_lucene imap_quota imap_acl imap_sieve rawlog_dir = %h/rawlog } Thanks for your help

2 2

[2.3.8] possible replication issue
by KOCIK Fabien (Acoss) 08 Nov '19

08 Nov '19

Hi, I'm dealing for few days with replication issues between two dovecot containerized instances in Kubernetes environment. After some search, I found this thread that reports exactly the same symptoms I encountered : https://dovecot.org/pipermail/dovecot/2019-October/117353.html I can confirm that downgrade of dovecot to 2.3.7.2 fixes the issue. Testing usage of -T parameter with a very low value (10s) on 2.3.8 version is reducing perceptible impact of the issue (mails are replicated within the following five minutes). I'm not expert in dovecot architecture but I tried to put an eye in the code and I'm wondering if this commit is not creating a potential phantom stalled I/O timeout ? https://github.com/dovecot/core/commit/ec817bb2185bb21b34ba6bdd83b32af16dd0… In fact, I was unable to see when the counter incremented by io_set_pending is decremented ? Hoping that this information can help... Regards. Fabien. +--------+ For technical details : Container images are based on Arch Linux distro image. Here is the configuration of Dovecot server : dovecot -n # 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf # OS: Linux 4.19.66-coreos x86_64 ext4 # Hostname: mailstore-0.mailstore.piafe.svc.cluster.local disable_plaintext_auth = no doveadm_password = # hidden, use -P to show it doveadm_port = 12345 login_greeting = PIAFE Mail Server Ready mail_location = mdbox:/var/mail/%Ld/%Ln mail_plugins = " notify replication quota" namespace inbox { hidden = no inbox = yes list = yes location = mailbox Brouillons { auto = subscribe special_use = \Drafts } mailbox Corbeille { auto = subscribe special_use = \Trash } mailbox "Courrier indésirable" { auto = subscribe special_use = \Junk } mailbox Envoyés { auto = subscribe special_use = \Sent } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/ldap.conf.ext driver = ldap } plugin { mail_replica = tcp:mailstore-1.mailstore.piafe.svc.cluster.local quota = dirsize:User quota quota_grace = 10%% quota_max_mail_size = 20M quota_rule = *:storage=1G quota_rule2 = Trash:storage=+200M quota_status_access = DUNNO quota_status_nouser = DUNNO quota_status_overquota = 552 5.5.2 Mailbox is full } postmaster_address = postmaster(a)piafe.recouv.fr replication_dsync_parameters = -d -N -l 30 -U -T 10 service aggregator { fifo_listener replication-notify-fifo { user = mailer } unix_listener replication-notify { user = mailer } } service doveadm { inet_listener { port = 12345 } inet_listener http { port = 8080 } } service lmtp { inet_listener lmtp { address = * port = 24 } } service replicator { process_min_avail = 1 unix_listener replicator-doveadm { group = mailer mode = 0660 } } ssl = no userdb { args = /etc/dovecot/ldap.conf.ext default_fields = uid=500 gid=500 home=/var/mail/%Ld/%Ln driver = ldap } protocol imap { mail_plugins = " notify replication quota quota" }

1 0

Sendmail lmtp delivery and director
by Marc Roos 07 Nov '19

07 Nov '19

If I have sendmail configured to deliver to dovecot lmpt and use the director are incoming messages directed to the correct/configured server? Sendmail.mc with: FEATURE(`local_lmtp',`[IPC]',`FILE /var/run/dovecot/lmtp')dnl

1 0

Using attachment_dir with plugin zlib corrupt mails
by MAREN ZUBIZARRETA 06 Nov '19

06 Nov '19

Hello: I have found the same problem reported above by Patrick Cernko affecting our system and corrupting our messages. Even worse, Outlook 2016 will no synchronize and the clients cannot see any message, even if there is only one corrupted mail per mailbox. I cannot figure out a feasible workaround for our system, and I can see that in new version 2.38 the bug is not fixed. Will this issue be treated soon? Thanks a lot Maren Zubizarreta WARNING: using attachment_dir with plugin zlib can corrupt mails Patrick Cernko pcernko at mpi-klsb.mpg.de<mailto:dovecot%40dovecot.org?Subject=Re:%20Re%3A%20WARNING%3A%20using%20attachment_dir%20with%20plugin%20zlib%20can%20corrupt%20mails&In-Reply-To=%3C1ab8edcc-bef4-3b41-d09a-c523674a5031%40mpi-klsb.mpg.de%3E> Fri Jul 19 17:52:37 EEST 2019 * Previous message: index worker 2.3.7 undefined symbol errors<https://dovecot.org/list/dovecot/2019-July/116617.html> * Next message: Address family not supported by protocol<https://dovecot.org/list/dovecot/2019-July/116571.html> * Messages sorted by: [ date ]<https://dovecot.org/list/dovecot/2019-July/date.html#116570> [ thread ]<https://dovecot.org/list/dovecot/2019-July/thread.html#116570> [ subject ]<https://dovecot.org/list/dovecot/2019-July/subject.html#116570> [ author ]<https://dovecot.org/list/dovecot/2019-July/author.html#116570> ________________________________ Hello list, hello Dovecot developers, this week, I discovered a serious bug in Dovecot, that lead to several broken mails on our servers. The bug corrupts the first few characters of the mail header during saving. On our setup, it was almost always only the very first line of text, that was corrupted. Depending on the IMAP client (they seem to request different header fields, ... during mail access), the bug causes the imap process to hang up the TCP connection and log errors like this: > imap(USERNAME)<4767><TeQP4ASOTK5/AAAB>: Error: Corrupted record in index cache file /IMAP/mail/mailboxes/USERNAME/mdbox/mailboxes/Trash/dbox-Mails/dovecot.index.cache: UID 489113: Broken fields in mailbox Trash: read(attachments-connector(zlib(/IMAP/mail/mailboxes/USERNAME/mdbox/storage/m.813))): FETCH BODY[HEADER.FIELDS (RETURN-PATH SUBJECT)] got too little data: 2 vs 122 In our case that finally grabbed my attention, the client was the users iphone that did not display any new messages but his Thunderbird did. The bug seems to be triggered by a bad "interaction" of attachment_dir option and zlib plugin. If you use both, you most likely are affected, too, except you only use zlib plugin for reading previously compressed stored mails. That's also the workaround we use now: zlib plugin only enabled in mail_plugins but no plugin/zlib_save set. The bug occurs on very specific mails. Due to privacy reasons I could not provide sample mails here. Storing such mails seems to trigger the bug reproducible. I attached a very minimal doveconf -n config, that can be used to trigger the bug. If one of the developers is interested, I can try to generate an "anonymized" version of such a specific mail that still causes the issue. I discovered the bug on our productive systems, running latest Dovecot 2.2 release, but the latest 2.3 I used during debugging is affected, too. During debugging, I also found one hint, that might help find the bug: If you store a problematic mail with zlib_save=gz (or zlib_save=bz2) and then disable the zlib plugin in mail_plugins, you can call doveadm fetch -u test hdr all | grep -v ^hdr: | gzip --decompress on test's mailbox with only that one broken mail. This will display the beginning of the rfc822 mail text until gzip terminates with "gzip: stdin: unexpected end of file", approximately after twice the length of the mail HEADER. This might indicate, that dovecot stores the uncompressed size of the header in it's data structures although the mail is stored compressed. I also found a very efficient way to find all affected mails in our setup: doveadm -f flow fetch -A 'user guid mailbox uid seq flags hdr' all | \ grep -a "^[^ ]+ user=" | \ grep -avF ' hdr=Return-path: ' | \ grep -av '.* hdr=[[:print:][:space:]]*$' (runtime for ~6M mails on our servers was 20-30min) This can be even more optimized if you have a powerful storage system with GNU parallel: > doveadm user '*' | parallel "doveadm -f flow fetch -u '{}' 'user guid mailbox uid seq flags hdr' all | grep -a '^user=' | grep -avF ' hdr=Return-path: ' | grep -av '.* hdr=[[:print:][:space:]]*$' || true" (runtime for ~6M mails on our servers was ~4min) The command will give you a list of mails that possibly are affected, check the full output of doveadm fetch -u USERNAME hdr guid GUID | less to verify that the header is really broken. On our systems I found 39 mails within ~12M mails. I was able to recover these mails "manually" by reconstructing the Return-Path header line, importing the fixed mails and expunging the corrupt ones. Before importing, I had to disable zlib_save option obviously. Best regards, -- Patrick Cernko <pcernko at mpi-klsb.mpg.de<https://dovecot.org/mailman/listinfo/dovecot>> +49 681 9325 5815 Joint Administration: Information Services and Technology Max-Planck-Institute fuer Informatik & Softwaresysteme

6 11

Trying to replace anti spam plugin with IMAPSieve; no joy
by Brad Koehn 06 Nov '19

06 Nov '19

I’m trying to follow the instructions on the wiki to move from antispam to IMAPSieve, but it’s not working at all. A bit of a background: dovecot-core 2:2.3.8-4~buster dovecot-imapd 2:2.3.8-4~buster dovecot-lmtpd 2:2.3.8-4~buster dovecot-managesieved 2:2.3.8-4~buster dovecot-pgsql 2:2.3.8-4~buster dovecot-pop3d 2:2.3.8-4~buster dovecot-sieve 2:2.3.8-4~buster dovecot-solr 2:2.3.8-4~buster My regular sieve scripts work fine for messages arriving through LMTP. I’ve updated my 20-imap.conf thusly: ## ## IMAP specific settings ## protocol imap { mail_max_userip_connections = 30 # Space separated list of plugins to load (default is global mail_plugins). mail_plugins = $mail_plugins imap_acl imap_sieve } plugin { sieve_plugins = sieve_imapsieve sieve_extprograms sieve_trace_dir = /tmp sieve_trace_level = matching # From elsewhere to Spam folder imapsieve_mailbox1_name = Spam imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_before = file:/usr/lib/dovecot/sieve/report-spam.sieve # From Spam folder to elsewhere imapsieve_mailbox2_name = * imapsieve_mailbox2_from = Spam imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_before = file:/usr/lib/dovecot/sieve/report-ham.sieve sieve_pipe_bin_dir = /usr/lib/dovecot/sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment } ======== I created the report-spam.sieve and report-ham.sieve scripts in /usr/lib/dovecot/sieve and compiled them with sievec: require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.mailbox" "*" { set "mailbox" "${1}"; } if string "${mailbox}" "Trash" { stop; } pipe :copy "sa-learn-pipe.sh" [ "ham" ]; ======== require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; pipe :copy "sa-learn-pipe.sh" [ "spam" ]; ======== Lastly, I have the sa-learn-pipe.sh script in /usr/lib/dovecot/sieve: #!/bin/bash echo "`date` learning $*" >> /tmp/sa-learn # We run amavisd-new on another Kubernetes pod and communicate with it via socat on both ends; this worked with the old antispam plugin. if [ "$*" = "ham" ] ; then socat - TCP:amavis:4443 else socat - TCP:amavis:4444 fi exit 0 ======== The /usr/lib/dovecot/sieve directory looks like this: drwxr-xr-x 1 root root 4096 Nov 4 20:49 . drwxr-xr-x 1 root root 4096 Nov 3 20:06 .. -rwxr-xr-x 1 root root 237 Nov 3 15:56 report-ham.sieve -rw-r--r-- 1 root root 384 Nov 4 20:49 report-ham.svbin -rwxr-xr-x 1 root root 122 Nov 3 15:56 report-spam.sieve -rw-r--r-- 1 root root 290 Nov 4 20:49 report-spam.svbin -rwxr-xr-x 1 root root 208 Nov 3 17:58 sa-learn-pipe.sh When the sieve scripts run when mail arrives during LMTP delivery they dutifully log their work in /tmp, so I know sieve works and sieve logging works too. The sieve scripts above never log anything, nor does /tmp/sa-learn ever get created as it would if sa-learn-pipe.sh were ever run. As far as I can tell I’ve duplicated the configuration from the wiki almost exactly, but dovecot is just not running the sieve scripts when messages are moved into/out of Junk. What am I missing?

2 1

newbie question on a dovecot buffer
by Richard Bown 06 Nov '19

06 Nov '19

Hi apologies for what will seem a daft question I'm getting problems with my mail provider who is using dovecot. I've loaded Dovecot on a 8 core ARMHF SBC version 2.2.33.2 on Ubuntu 18.04. The SBC is headless. and the load looks very light and only needs to store/cache 4GB of mail Can I use Dovecot as a buffer between my mail providers Dovecot servers and the several IMAP mail clients on my own network ? ie, so Dovecot would mirror the mail on my account with my mail provider, So my local dovecot server downloads mail and caches/stores on the local SBC and all the local users use IMAP from that, instead of from my mail provider. Can I import the same directory structure as help on my mail providers server ? I'm trying to avoid the timeout problem I get when using IMAP from my mail provider. Can it be done ? and can you withstand the questions on configuration, I haven't used Dovecot before so its a vertical learning curve Thanks -- Best wishes /73 Richard Bown Email : richard(a)g8jvm.com HTTP : http://www.g8jvm.com ###################################################################### Ham Call: G8JVM . QRV: 50-432 MHz + Microwave Maidenhead QRA: IO82SP38, LAT. 52 39.720' N LONG. 2 28.171 W QRV 6mtrs 200W, 4mtrs 150W, 2mtrs 300W, 70cms 200W, Microwave 1296MHz 110W, 2320MHz 100W, 5760MHz 10W & 10368MHz 5W OS: Linux Mint 19.2 x86_64 Tina, on a Dell Inspiron 3580 laptop ###################################################################### Come back Guy Fawkes, all is forgiven

3 3

sievec *.sieve problem.
by Reio Remma 05 Nov '19

05 Nov '19

Hello! For the second time I've tripped onto this banana peel. :) I had 2 sieve files in a directory that I wanted to compile: sievec *.sieve The result of this is that first.sieve is compiled into second.sieve instead of first.svbin, thus destroying the source of second.sieve. Please consider this a bug report. :) Good luck, Reio

2 2

Help with master user
by Marcio Merlone 04 Nov '19

04 Nov '19

Hi, Trying to implement a master user (1) for auditing purposes without luck. Ubuntu 18.04.3, canonical official repos only, no ppa nor self-compiled anything. From the log below I understand the master password succeeds but AD auth fails. I am pretty sure I missed something here. Also, notice the messages "Ignoring unknown passdb extra field: original_user". Log: Nov 1 14:02:32 netuno dovecot: auth: Debug: client in: AUTH#0112#011PLAIN#011service=imap#011secured#011session=H2WM7kuWFKYKCQgI#011lip=10.9.8.8#011rip=10.9.8.8#011lport=143#011rport=42516#011resp=<hidden> Nov 1 14:02:32 netuno dovecot: auth: Debug: passwd-file(master,10.9.8.8,master,<H2WM7kuWFKYKCQgI>): Master user lookup for login: test.account Nov 1 14:02:32 netuno dovecot: auth: Debug: passwd-file(master,10.9.8.8,master,<H2WM7kuWFKYKCQgI>): lookup: user=master file=/etc/dovecot/master-users Nov 1 14:02:32 netuno dovecot: auth: passwd-file(master,10.9.8.8,master,<H2WM7kuWFKYKCQgI>): Master user logging in as test.account Nov 1 14:02:32 netuno dovecot: auth: ldap(test.account,10.9.8.8,<H2WM7kuWFKYKCQgI>): invalid credentials Nov 1 14:02:34 netuno dovecot: auth: Debug: client passdb out: FAIL#0112#011user=test.account#011authz#011original_user=master#011auth_user=master Nov 1 14:02:34 netuno dovecot: imap-login: Debug: Ignoring unknown passdb extra field: original_user Nov 1 14:02:34 netuno dovecot: imap-login: Debug: Ignoring unknown passdb extra field: auth_user Nov 1 14:02:42 netuno dovecot: imap-login: Aborted login (auth failed, 1 attempts in 10 secs): user=<test.account>, method=PLAIN, rip=10.9.8.8, lip=10.9.8.8, secured, session=<H2WM7kuWFKYKCQgI> doveconf -n: https://pastebin.com/3cAvfNqB root@netuno:/etc/dovecot# grep -v "^\s*#\|^\s*$" /etc/dovecot/dovecot-ldap.conf.ext hosts = ad.example.net auth_bind = yes auth_bind_userdn = cn=%Lu,CN=Users,DC=ad,DC=example,DC=net base = DC=ad,DC=example,DC=net scope = base user_attrs = \ =home=/mnt/maildirs/%Lu, \ =uid=vmail,\ =gid=vmail user_filter = (&(objectClass=person)(uid=%Lu)(mail=*(a)example.net)) root@netuno:/etc/dovecot# root@netuno:/etc/dovecot# cat /etc/dovecot/global-acls * user=master lr root@netuno:/etc/dovecot# (1) https://doc.dovecot.org/configuration_manual/authentication/master_users/ Best regards -- *Marcio Merlone*

1 1

Bug report
by Peter Nabbefeld 02 Nov '19

02 Nov '19

Hello, I've got a problem fetching my emails using getmail. First question is, of course, what's causing the problems. I'm going to think that getmail get's an error code from dovecot when trying to connect and just signals the most common error, so it seems to be a problem with dovecot. Sorry but I cannot upload any files with the silly web interface of my provider, so I cannot attach a core dump here. :-( Kind regards Peter ~/.getmail/log ========= 2019-11-01 21:44:20 Delivery error (command deliver 42245 error (127, exec of command deliver failed (change UID/GID to vmail/vmail failed ([Errno 1] Operation not permitted)))) dovecot-info.log ========== Oct 31 20:27:00 lda(mein.name(a)gmx.de)<42409><2+iBJIQ1u12ppQAA7IIYzw>: Panic: file istream-crlf.c: line 24 (i_stream_crlf_read_common): assertion failed: (ret != -2) Oct 31 20:27:00 lda(mein.name(a)gmx.de)<42409><2+iBJIQ1u12ppQAA7IIYzw>: Error: Raw backtrace: /usr/lib/dovecot/libdovecot.so.0(+0xff784) [0x7f4ec8e62784] -> /usr/lib/dovecot/libdovecot.so.0(+0xff7c1) [0x7f4ec8e627c1] -> /usr/lib/dovecot/libdovecot.so.0(+0x493aa) [0x7f4ec8dac3aa] -> /usr/lib/dovecot/libdovecot.so.0(+0x4bf62) [0x7f4ec8daef62] -> /usr/lib/dovecot/libdovecot.so.0(+0x111076) [0x7f4ec8e74076] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7f4ec8e70291] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x37) [0x7f4ec8e70477] -> /usr/lib/dovecot/libdovecot.so.0(+0x1164a8) [0x7f4ec8e794a8] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_memarea+0x81) [0x7f4ec8e70291] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read+0x37) [0x7f4ec8e70477] -> /usr/lib/dovecot/libdovecot.so.0(i_stream_read_data+0x4c) [0x7f4ec8e70f3c] -> /usr/lib/dovecot/libdovecot.so.0(io_stream_copy+0x8a) [0x7f4ec8e8bbea] -> /usr/lib/dovecot/libdovecot.so.0(+0x12aa86) [0x7f4ec8e8da86] -> /usr/lib/dovecot/libdovecot.so.0(o_stream_send_istream+0x4f) [0x7f4ec8e8b86f] -> /usr/lib/dovecot/libdovecot-storage.so.0(index_storage_save_continue+0x2e) [0x7f4ec901114e] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_save_continue+0x27) [0x7f4ec8fafbe7] -> /usr/lib/dovecot/libdovecot-storage.so.0(mailbox_save_continue+0x47) [0x7f4ec8f815b7] -> /usr/lib/dovecot/libdovecot-storage.so.0(mail_storage_copy+0xe8) [0x7f4ec8f72388] -> /usr/lib/dovecot/libdovecot-storage.so.0(maildir_copy+0x6d) [0x7f4ec8fab99d] -> /usr/lib/dovecot/libdovecot-lda.so.0(+0x3c46) [0x7f4ec90a2c46] -> /usr/lib/dovecot/modules/lib20_fts_plugin.so(+0x11004) [0x7f4ec8af0004] -> /usr/lib/dovecot/libdovecot-storage.so.0(+0x59b0c) [0x7f4ec8f81b0c] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x4edb8) [0x7f4ec67e0db8] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_result_execute+0x54d) [0x7f4ec67d65cd] -> /usr/lib/dovecot/libdovecot-sieve.so.0(+0x57a79) [0x7f4ec67e9a79] -> /usr/lib/dovecot/libdovecot-sieve.so.0(sieve_multiscript_run+0xa9) [0x7f4ec67eac49] -> /usr/lib/dovecot/modules/lib90_sieve_plugin.so(+0x376b) [0x7f4ec685c76b] -> /usr/lib/dovecot/libdovecot-lda.so.0(mail_deliver+0x199) [0x7f4ec90a46d9] dovecot -n ======= # 2.3.8 (9df20d2db): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.8 (b7b03ba2) # OS: Linux 5.3.7-arch1-2-ARCH x86_64 Arch Linux # Hostname: mein.host.name auth_verbose = yes disable_plaintext_auth = no info_log_path = /var/log/dovecot-info.log log_path = /var/log/dovecot.log mail_location = maildir:~/Maildir:LAYOUT=fs mail_plugins = " fts fts_solr" managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext editheader namespace inbox { inbox = yes location = mailbox Entwürfe { special_use = \Drafts } mailbox Gesendet { special_use = \Sent } mailbox Spamverdacht { special_use = \Junk } mailbox Trash { special_use = \Trash } prefix = } passdb { args = username_format=%u /etc/dovecot/passwd driver = passwd-file } plugin { fts = solr fts_solr = url=http://localhost:8983/solr/ sieve = file:/home/vmail/sieve;active=/home/vmail/.dovecot.sieve sieve_extensions = +editheader } service stats { unix_listener stats-reader { group = vmail mode = 0666 user = vmail } unix_listener stats-writer { group = vmail mode = 0666 user = vmail } } ssl = no ssl_dh = # hidden, use -P to show it userdb { args = uid=vmail gid=vmail home=/home/vmail/%d/%n driver = static } protocol lda { mail_plugins = " fts fts_solr sieve" postmaster_address = mein.name(a)gmx.de }

3 2

warning: NFS hangs with dovecot 2.3.8 on Debian buster
by Jan-Pieter Cornet 01 Nov '19

01 Nov '19

A warning to those considering to upgrade to Debian 10 (buster): we have seen occasional NFS hangs with dovecot when using the stock debian buster kernel (4.19.67-2+deb10u1). When we downgrade to the debian stretch kernel (4.9.189-3+deb9u1), the issue does not occur. Note that we *only* downgraded the kernel, the rest of the OS is still debian buster. Dovecot 2.3.8. A little more info: we have a dovecot cluster, using mdbox for storage, on an NFS server (netapp Cmode version 9.6P2). We use a dovecot director layer, so a user is always connected to the same back-end dovecot server. The NFS hang occurs on the back-end server. Once the process hangs, other processes trying to write to the same mailbox, will get an error like this: Timeout (180s) while waiting for lock for transaction log file /var/mail/.../index/storage/dovecot.map.index.log (WRITE lock held by pid XXXX) The stuck process itself doesn't seem to do anything, is stuck in "D" disk state, "strace" doesn't show anything (and after attaching, strace itself needs a kill -KILL to stop). The only way to unwedge the process seems to be to do a kill -KILL of the stuck process. Reading from the mailbox is still possible. We are in the process of contacting the linux-nfs folks about this, but I'm trying to reproduce this on a test-cluster first, to be able to present a well-documented case. Since this hang doesn't happen immediately, but takes a few hours to a day to occur in the wild, or a few thousand writes to the same mailbox, it's a bit hard to debug. -- Jan-Pieter Cornet <johnpc(a)xs4all.net> Systeembeheer XS4ALL Internet bv www.xs4all.nl

1 1

Dovecot and MySQL aborted connections.
by Benjamin Connelly 01 Nov '19

01 Nov '19

We also spotted these sql connections getting aborted, upon upgrading MySQL from 5.6 to 5.7. (Going back to 5.6 we don't see them!) Turning on mysql general query logging we can see it is Dovecot's mysql connections that inquire about or update quota usage in particular: *** /logs//mysql.log *** 2019-10-30T10:52:22.624690-07:00 2 Connect dovecot@localhost on npomail using Socket 2019-10-30T10:52:40.019780-07:00 2 Query SELECT bytes FROM quota2 WHERE username = 'a@bla' 2019-10-30T10:52:40.020948-07:00 2 Query SELECT messages FROM quota2 WHERE username = 'a@bla' 2019-10-30T10:53:40.113374-07:00 2 [Note] Aborted connection 2 to db: 'npomail' user: 'dovecot' host: 'localhost' (Got an error reading communication packets) Increasing mysqld's net_read_timeout and net_write_timeout values to 3600 does not stop the aborted connections. It seems asymptomatic. If the connection to mysql is still there to do quota operations, Dovecot seems to use it. If it's been aborted by the server, Dovecot seems to just (re)connect. . . But I'd love to help find the root or file a bug report or learn what it is we've configured wrong. . . Benjamin

4 5