April 2019 - dovecot - dovecot.org

[Dovecot] auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied
by mailing＠securitylabs.it 03 Apr '25

03 Apr '25

Hello, just upgraded one of my testing machine from dovecot 1.2.15 to 2.0.7. After some trouble with permissions now all seems working, but when I stop dovecot I have these errors in log: Nov 9 17:08:07 in dovecot: master: Warning: Killed with signal 15 (by pid=20362 uid=0 code=kill) Nov 9 17:08:07 in dovecot: pop3-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap-login: Error: read(anvil) failed: EOF Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=410/59361 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=79/26605 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=802/55708 Nov 9 17:08:07 in dovecot: imap(mailing(a)securitylabs.it): Server shutting down. bytes=258/1242 Nov 9 17:08:07 in dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF Nov 9 17:08:07 in dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied dovecot -n: # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-xen-686 i686 Debian squeeze/sid auth_cache_negative_ttl = 2 mins auth_cache_size = 1000 M auth_cache_ttl = 2 mins auth_master_user_separator = * auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@& disable_plaintext_auth = no dotlock_use_excl = yes first_valid_uid = 100 last_valid_uid = 105 lock_method = dotlock log_timestamp = "%Y-%m-%d %H:%M:%S " login_greeting = Server ready. mail_fsync = never mail_gid = Debian-exim mail_location = maildir:~/Maildir:INDEX=/var/indexes/%d/%n mail_privileged_group = Debian-exim mail_uid = Debian-exim managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = / type = private } namespace { location = maildir:~/Maildir/expunged prefix = EXPUNGED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted prefix = DELETED/ separator = / type = private } namespace { location = maildir:~/Maildir/deleted/expunged prefix = DELETED/EXPUNGED/ separator = / type = private } passdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } passdb { args = /usr/local/etc/passwd.masterusers driver = passwd-file master = yes pass = yes } plugin { lazy_expunge = EXPUNGED/ DELETED/ DELETED/EXPUNGED/ mail_log_events = delete expunge mail_log_group_events = quota = maildir quota_warning = storage=80%% /usr/local/bin/dovecot-quota-warning.sh 80 quota_warning2 = storage=90%% /usr/local/bin/dovecot-quota-warning.sh 90 sieve = ~/.dovecot.sieve } pop3_no_flag_updates = yes protocols = imap pop3 service auth { unix_listener auth-userdb { group = Debian-exim mode = 0600 user = Debian-exim } } service imap-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service imap { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } service pop3-login { client_limit = 256 process_limit = 128 process_min_avail = 3 service_count = 1 } service pop3 { drop_priv_before_exec = yes process_limit = 256 vsz_limit = 256 B } ssl_cert = </usr/local/etc/dovecot.crt ssl_key = </usr/local/etc/dovecot.key userdb { args = /usr/local/etc/dovecot-sql.conf driver = sql } protocol imap { mail_max_userip_connections = 10 mail_plugins = " notify quota imap_quota mail_log lazy_expunge" } protocol pop3 { mail_max_userip_connections = 3 mail_plugins = " notify quota mail_log" pop3_uidl_format = %08Xu%08Xv } protocol lda { mail_plugins = quota sieve postmaster_address = postmaster(a)securitylabs.it } My /usr/local/var/run/dovecot directory: 4 drwxr-sr-x 4 root staff 4096 Nov 9 17:08 . 4 drwxrwsrwx 3 root staff 4096 Nov 9 17:05 .. 0 srw------- 1 root staff 0 Nov 9 17:05 anvil 0 srw------- 1 root staff 0 Nov 9 17:05 anvil-auth-penalty 0 srw------- 1 root staff 0 Nov 9 17:05 auth-client 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-login 0 srw------- 1 root staff 0 Nov 9 17:05 auth-master 0 srw------- 1 Debian-exim Debian-exim 0 Nov 9 17:05 auth-userdb 0 srw------- 1 dovecot staff 0 Nov 9 17:05 auth-worker 0 srw------- 1 root staff 0 Nov 9 17:05 config 0 srw------- 1 root staff 0 Nov 9 17:05 dict 0 srw------- 1 root staff 0 Nov 9 17:05 director-admin 0 srw-rw-rw- 1 root staff 0 Nov 9 17:05 dns-client 0 srw------- 1 root staff 0 Nov 9 17:05 doveadm-server 0 lrwxrwxrwx 1 root staff 35 Nov 9 17:05 dovecot.conf -> /usr/local/etc/dovecot/dovecot.conf 4 drwxr-xr-x 2 root root 4096 Nov 9 17:05 empty 4 drwxr-x--- 2 root dovenull 4096 Nov 9 17:05 login My emails are delivered as user Debian-exim and users are virtual in a MySQL DB. This system is behind a proxy (so the master user)

3 2

dovecot-2.3.2.1 and dovecot-pigeonhole-0.5.2 bug?
by Jan Nowak 16 Aug '24

16 Aug '24

Hello, we have a problem after updating the software with the operation of sieve scripts sending a copy of the e-mails, e-mails are not transferred. Configuration: dovecot-2.3.2.1 + dovecot-pigeonhole-0.5.2 + FreeBSD 11.2 log: Sep 06 13:28:17 lda(XXX@XXX)<38615><XXX+XXX>: Info: sieve: msgid=<XXX-XXX-XXX-7788-XXX@XXXXnet>: stored mail into mailbox 'INBOX' Sep 06 13:28:17 lda(XXX@XXX)<38615><XXX+XXX>: Info: sieve: Execution of script /usr/home/XXX/mail/XXX(a)XXX/.dovecot.sieve failed, but implicit keep was successful (user logfile /usr/home/XXX/mail/XXX(a)XXX/.dovecot.sieve.log may reveal additional details) .dovecot.sieve.log: error: msgid=<XXX-XXX-XXX-7788-XXX@XXXXnet>: failed to redirect message to <XXXXX(a)XXXXXX.com>: smtp(127.0.0.1:25): DATA failed: 552 Message header not CRLF terminated (permanent failure). On old configuration: dovecot 2.2 + dovecot-pigeonhole- 0.4 + FreeBSD 11.2 we don't have problem. Has anyone had a similar problem, knows the solution?

5 12

[Dovecot] doveadm delete folders ?
by Robert Schetterer 19 Feb '24

19 Feb '24

Hi , is there a feature like doveadm expunge savedbefore ... for imap folder delete ? -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

5 10

decrypt.rb
by Dave 11 Apr '23

11 Apr '23

Per the Dovecot site here: https://wiki.dovecot.org/Plugins/MailCrypt ... the "decrypt.rb" ruby script can be used to decrypt a Dovecot-encrypted message file from the command line. The script sort of runs successfully for me, in the sense that it doesn't error out, but it doesn't show the decrypted message. I've called it like so: decrypt.rb -k <PATH_TO_DOVECOT_KEYFILE> -f ./encrypted_message But when I do it just displays the info below and exits (I've subbed <DATA> tags for the actual data): ------------------[OUTPUT]----------------------- Key(s) (total: 1) - Key type : EC - Key digest: <DATA1> - Peer key : <DATA2> - Encrypted : <DATA3> - Kd hash : <DATA4> ------------------------------------------------------- I've tried specifying an output file as well, per the script's command line options, but the output file is 0 bytes. Does anyone have any suggestions? I *think* I'm using it the way it's intended to be used, but maybe I'm not?! -Dave

5 14

Mailbox problem on centos O/S after some "fiddling"
by John Richards 28 May '21

28 May '21

Good day from Somerset, England Version 2.2.10 Problem after a huge centos update Data:- Server has 8 mailboxes under /var/mail/"user name" history:- After update, mail to ONE user was going into mqueue as undeliverable Had to delete and recreate the user. somewhere along the line (ME!) /var/mail/;imap var/mail/new were deleted After new user and reboot server no one could access mailboxes with password error except ONE user randomly....This created the /var/mail/.mbox folder and sub folders but with the owner as the user name. Then any mail for other users was put in the /var/new folder and just sat there. only the "owner" of this folder could get mail, everyone else was prohibited with password error. chown the folder (owner:group) to root did nothing BUT When .mbox was give PUBLIC execute permissions (771) suddenly everything works fine! I do not understand why dovecot creates this folder as we ONLY ever use pop3 (currently with plain text auth but going to secure when this sorted) for mail and also why when it writes the blank folder it "owns" it with the user accessing it (also the /var/mail/new folder takes the same owner) I have trolled everywhere and spent a whole day on this so any clues would be very gratefully accepted as do not like to leave this folder as 771 (note the folder INBOX within it is only 770 and the log file in that is 660) Is this INBOX needed at all for pop3 ? rgds John Richards UK ================= dovecot -n # 2.2.10: /etc/dovecot/dovecot.conf # OS: Linux 3.10.0-514.2.2.el7.x86_64 x86_64 CentOS Linux release 7.3.1611 (Core ) ext4 auth_mechanisms = plain login disable_plaintext_auth = no mail_location = mbox:/var/mail/:INBOX=/var/mail/%u mbox_write_locks = fcntl namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = shadow } protocols = pop3 service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } ssl_cert = </etc/pki/tls/certs/watchetwebdesign.co.uk.crt ssl_key = </etc/pki/tls/private/watchetwebdesign.co.uk.key userdb { driver = passwd }

2 1

[Dovecot] Doveadm sometimes failed "to iterate through some users" after upgrade to 2.2
by Alessio Cecchi 04 May '21

04 May '21

Hi, I'm running every week in cron "doveadm expunge -A mailbox Spam before 30d" and monthly "doveadm quota recalc -A". After the upgrade to dovecot 2.2.12 (from 2.1.17), "doveadm -A" sometimes exit with this error: doveadm(user(a)domain.com): Error: User listing returned failure doveadm: Error: Failed to iterate through some users # echo $? 75 If I re-run the same command the user where doveadm stops changeing (always in alphabetical order): info@ mario@ pippo@ zazza@ and finally, after 3 or 4 run, ends with success. I have enable debug (via doveadm -D and auth/mail debub in 10-logging.con) but there are no errors or difference in the log when doveadm exit with the error (error code is 75). If I run # doveadm expunge -A mailbox Spam savedbefore 30d doveadm works fine Can somebody help me? Here is my configuration: # dovecot -n # 2.2.12: /etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian 6.0.9 auth_debug = yes auth_master_user_separator = * auth_verbose = yes deliver_log_format = msgid=%m, from=%f, subject="%s": %$ dict { expire = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext sqlquota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } disable_plaintext_auth = no dotlock_use_excl = no first_valid_gid = 89 first_valid_uid = 89 imap_client_workarounds = delay-newmail tb-extra-mailbox-sep tb-lsub-flags imap_idle_notify_interval = 29 mins imap_logout_format = in=%i out=%o session=<%{session}> last_valid_gid = 89 last_valid_uid = 89 lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes listen = * mail_debug = yes mail_fsync = always mail_location = maildir:~/Maildir mail_nfs_index = yes mail_nfs_storage = yes mail_plugins = quota expire maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave vnd.dovecot.duplicate mmap_disable = yes namespace { list = children location = maildir:%%h/Maildir:INDEX=~/Maildir/shared/%%u prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / } passdb { args = username_format=%Ld /etc/dovecot/extra/alias-domains-denylogin.txt deny = yes driver = passwd-file } passdb { args = /etc/dovecot/extra/master-users driver = passwd-file master = yes pass = yes } passdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } plugin { expire = Trash expire2 = Spam expire_dict = proxy::expire quota = maildir:UserQuota quota2 = dict:Quota Usage::noenforcing:proxy::sqlquota quota_grace = 10M quota_rule2 = Trash:storage=+100M quota_warning = storage=95%% quota-warning 95 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = ~/.dovecot.sieve sieve_before = /etc/dovecot/sieve/before.sieve sieve_dir = ~/sieve sieve_extensions = +vnd.dovecot.duplicate -vacation } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s, bytes=%i/%o, session=<%{session}> protocols = imap pop3 sieve service auth-worker { process_limit = 1000 } service auth { client_limit = 5500 unix_listener auth-userdb { group = vchkpw mode = 0660 user = vpopmail } } service dict { process_limit = 300 unix_listener dict { group = vchkpw mode = 0660 user = vpopmail } } service imap-login { process_min_avail = 4 service_count = 0 } service imap { process_limit = 4000 service_count = 100 } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { service_count = 0 } service pop3 { process_limit = 1023 service_count = 100 } service quota-warning { executable = script /etc/dovecot/scripts/quota-warning.sh unix_listener quota-warning { user = vpopmail } user = vpopmail } ssl_cert = </etc/dovecot/ssl/wildcard-myemail.net.pem ssl_key = </etc/dovecot/ssl/wildcard-myemail.net.key submission_host = localhost userdb { args = /etc/dovecot/dovecot-sql.conf.ext driver = sql } protocol lda { mail_location = maildir:~/Maildir:INDEX=MEMORY mail_plugins = quota expire sieve } protocol imap { mail_max_userip_connections = 15 mail_plugins = quota expire imap_quota } protocol sieve { mail_max_userip_connections = 2 } protocol pop3 { mail_max_userip_connections = 5 } -- Alessio Cecchi is: @ ILS -> http://www.linux.it/~alessice/ on LinkedIn -> http://www.linkedin.com/in/alessice Assistenza Sistemi GNU/Linux -> http://www.cecchi.biz Cloud Email Hosting -> http://www.qboxmail.com @ PLUG -> ex-Presidente, adesso senatore a vita, http://www.prato.linux.it

3 3

How to backup maildir
by Robert Moskowitz 04 Sep '20

04 Sep '20

I have been thinking, and reading, on how to back up my mailserver. I have not found any approach that seems ready to use. I have run years without any backup, but would really like to have something in place. I figure I can attach a USB drive and backup to that, then from there rsync to something elsewhere. Further if that USB drive is a full mailserver image, I actually have a 'hot backup' where I only have to put the backup drive into a system and boot up at the last backup. But this means properly copying all of /home/vmail and probably /home/sieve plus the /var/lib/mysql Are there good tools that nicely does this? Or do I choose a time late at night (only I am sometimes in non-US timezones) to shut down all services and just use rsync? And stopping services itself is thought provoking. What if Dovecot, amavis, mysql, or whatelse is in the middle of writing out a mail file what happens to that file and restart. Just scary stuff and, in part, why I have never tackled this in the past. thanks for all feedback

4 6

imap doesn't like my passwd
by James 31 Jul '20

31 Jul '20

I spent days on this problem. I have dovecot setup to use SSL and IMAP. I also have a pop account that I had no trouble getting working. Both use PAM authentication on Linux. openssl s_client -connect localhost:993 a login test_user test_secure_password The response I got back was: a BAD Invalid characters in atom I changed the password to "abc" and it worked. The secure password used to work but it was a different architecture (x86_64 I think). The current architecture is armhf. It may be different versions of the software too. Dovecot v2.1.7

5 7

[Dovecot] Postfixadmin/MySQL/Dovecot 2 and quota
by Matt 01 Apr '20

01 Apr '20

Hi all, I'm setting up a new email server based on the softwares list below: * Postfix * Dovecot 2.0.9 * MySQL * Postfixadmin 2.3.6 My current problem is I'm unsure whether quota feature is well configured or not. In order to test and validate, I use Roundcubemail GUI which provides percentage of the space used by the mailbox (quota should be applied per mailbox). Here, my dovecot configuration: dovecot.conf: dict { quotadict = mysql:/etc/dovecot/dovecot-dict-quota.conf } dovecot-dict-quota.conf: connect = host=localhost dbname=postfix user=postfix password=postfix map { pattern = priv/quota/storage table = quota2 username_field = username value_field = bytes } map { pattern = priv/quota/messages table = quota2 username_field = username value_field = messages } dovecot-sql.conf.ext: driver = mysql connect = host=localhost dbname=postfix user=postfix password=postfix default_pass_scheme = PLAIN-MD5 password_query = SELECT username AS user, password, \ CONCAT('*:storage=', CAST(quota AS CHAR), 'b') AS quota_rule \ FROM mailbox WHERE username = '%u' AND active='1' user_query = SELECT maildir, 89 AS uid, 12 AS gid, \ concat('dict:storage=',floor(quota/1000),'::proxy::quotadict') AS quota, \ CONCAT('*:storage=', CAST(quota AS CHAR), 'b') AS quota_rule \ FROM mailbox WHERE username = '%u' AND active='1' conf.d/90-quota.conf: plugin { quota = dict:user::proxy::quotadict quota_rule2 = Trash:storage=+10%% } conf.d/20-imap.conf: protocol imap { mail_plugins = $mail_plugins imap_quota } When I check postfixadmin GUI, I can see that quota in realtime in quota2 table, no problem. But Roundcubemail cannot get this information and shows a unknown quota. If I add this line: quota_rule = *:storage=1G in conf.d/90-quota.conf file, it works, I mean roundcubemail gets and shows information (but not the one stored in db of course). I think I'm close to the right configuration but I need your help to complete this setup. Thank you in advance for your help. Best, Matt

7 20

intermittant passdb error
by NeuralNET 23 Jan '20

23 Jan '20

I'm having great difficulty debugging this problem.. I'm having intermittant problems connecting to dovecot. This started a couple of days ago following an apt-get update on the server. I'm running Ubuntu 14.04, dovecot 2.2.9. Here's my dovecot -n --- # 2.2.9: /etc/dovecot/dovecot.conf # OS: Linux 3.19.0-59-generic x86_64 Ubuntu 14.04.4 LTS auth_mechanisms = plain login mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam } plugin { sieve_dir = ~/sieve } protocols = imap service auth { unix_listener /var/spool/postfix/private/auth { mode = 0666 } user = $default_internal_user } ssl = required ssl_cert = </etc/dovecot/box.neuralnet.org.uk_crt.pem ssl_key = </etc/dovecot/box.neuralnet.org.uk_key.pem ssl_protocols = !SSLv2 !SSLv3 userdb { driver = passwd } --- Pretty standard stuff. In addition disable_plaintext_auth = yes is set in 10-auth.conf This showed up in the mail.err after the reboot; --- May 17 09:04:51 server dovecot: imap-login: Error: read(anvil) failed: EOF May 17 09:04:51 server dovecot: auth: Error: read(anvil-auth-penalty) failed: EOF May 17 09:04:51 server dovecot: auth: Error: net_connect_unix(anvil-auth-penalty) failed: Permission denied --- At that point The following commands were run on the server a few minutes apart with no changes made in the interim; --- username@box /etc/dovecot $ doveadm user username field valueuserdb lookup: user username doesn't exist username@box /etc/dovecot $ doveadm user username field value uid 1000 gid 1000 home /home/username mail maildir:~/Maildir system_groups_user username --- so, passdb wasn't accessible, but now it is ? Imap logins are showing in mail.log as failing, but thunderbird is currently connected; --- May 18 12:00:58 box dovecot: imap-login: Disconnected (auth failed, 3 attempts in 19 secs): user=<username>, method=PLAIN, rip=10.0.0.3, lip=10.0.0.99, TLS, session=<********> May 18 12:08:27 box dovecot: imap-login: Disconnected (auth failed, 3 attempts in 20 secs): user=<username>, method=PLAIN, rip=10.0.0.3, lip=10.0.0.99, TLS, session=<********> May 18 12:08:50 box dovecot: imap-login: Disconnected (auth failed, 3 attempts in 12 secs): user=<username>, method=PLAIN, rip=10.0.0.3, lip=10.0.0.99, TLS, session=<********> --- do I conclude that method=plain is failing, whereas method=login succeeds ? I tried setting auth_debug_password=yes and get the following; --- May 18 12:26:42 box dovecot: auth: Debug: client in: CONT#0111#011A********== (previous base64 data may contain sensitive data) May 18 12:26:42 box dovecot: auth-worker(12214): Debug: Loading modules from directory: /usr/lib/dovecot/modules/auth May 18 12:26:42 box dovecot: auth-worker(12214): Debug: pam(expert,10.0.0.3): lookup service=dovecot May 18 12:26:42 box dovecot: auth-worker(12214): Debug: pam(expert,10.0.0.3): #1/1 style=1 msg=Password: May 18 12:26:42 box dovecot: auth-worker(12211): pam(username,10.0.0.3): pam_authenticate() failed: Authentication failure (password mismatch?) (given password: ******) May 18 12:26:44 box dovecot: auth: Debug: client passdb out: FAIL#0112#011user=username --- Any assistance debugging this further is greatly recieved! Thanks.

2 2

CentOS x64 compilation fails.
by Mart Pirita 16 Dec '19

16 Dec '19

Hello. I have problems to compile Dovecot2.2.13 with rpmbuild using options: ./configure \ --prefix=/usr \ --with-ssl=openssl \ --with-ssldir=/etc/ssl \ --sysconfdir=/etc \ --without-vpopmail \ --with-pam \ --without-bsdauth \ --without-sql \ --without-nss \ --without-ldap \ --without-pgsql \ --without-mysql \ --without-sqlite \ --with-rundir=/var/run/dovecot \ --without-deliver \ --without-gssapi make Using CentOS 5.11, option - rpmbuild -ba dovecot2.2.spec fails with error: /bin/mkdir -p '/var/tmp/dovecot-2.2.13-mp-root/usr/lib64/dovecot' /bin/sh ../../libtool --mode=install /usr/bin/install -c libdovecot-storage.la '/var/tmp/dovecot-2.2.13-mp-root/usr/lib64/dovecot' libtool: install: error: cannot install `libdovecot-storage.la' to a directory not ending in /usr/lib/dovecot make[4]: *** [install-pkglibLTLIBRARIES] Error 1 make[4]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.2.13/src/lib-storage' make[3]: *** [install-am] Error 2 make[3]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.2.13/src/lib-storage' make[2]: *** [install-recursive] Error 1 make[2]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.2.13/src/lib-storage' make[1]: *** [install-recursive] Error 1 make[1]: Leaving directory `/usr/src/redhat/BUILD/dovecot-2.2.13/src' make: *** [install-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.14076 (%install) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.14076 (%install) But using CentOS 5.11with option- rpmbuild --target=i686 -ba dovecot2.2.spec works fine. However, using CentOS 6.5, with option - rpmbuild -ba dovecot2.2.spec fails with error: /bin/mkdir -p '/root/rpmbuild/BUILDROOT/dovecot-2.2.13-mp.x86_64/usr/lib64/dovecot' /bin/sh ../../libtool --mode=install /usr/bin/install -c libdovecot-storage.la '/root/rpmbuild/BUILDROOT/dovecot-2.2.13-mp.x86_64/usr/lib64/dovecot' libtool: install: error: cannot install `libdovecot-storage.la' to a directory not ending in /usr/lib/dovecot make[4]: *** [install-pkglibLTLIBRARIES] Error 1 make[4]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.13/src/lib-storage' make[3]: *** [install-am] Error 2 make[3]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.13/src/lib-storage' make[2]: *** [install-recursive] Error 1 make[2]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.13/src/lib-storage' make[1]: *** [install-recursive] Error 1 make[1]: Leaving directory `/root/rpmbuild/BUILD/dovecot-2.2.13/src' make: *** [install-recursive] Error 1 error: Bad exit status from /var/tmp/rpm-tmp.HP3meN (%install) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.HP3meN (%install) But when CentOS 5.11with option rpmbuild --target=i686 -ba dovecot2.2.spec suceeds, CentOS 6.5still fails: cpio: dovecot-2.2.13/src/lib-compression/abspath.c: Cannot stat: No such file or directory cpio: dovecot-2.2.13/src/lib-compression/compat.h: Cannot stat: No such file or directory cpio: dovecot-2.2.13/src/lib-compression/lib.h: Cannot stat: No such file or directory 18096 blocks + /usr/lib/rpm/check-buildroot /root/rpmbuild/BUILDROOT/dovecot-2.2.13-mp.i386/usr/lib/dovecot/dovecot-config:LIBDOVECOT='-L/root/rpmbuild/BUILDROOT/dovecot-2.2.13-mp.i386/usr/lib/dovecot -ldovecot' /root/rpmbuild/BUILDROOT/dovecot-2.2.13-mp.i386/usr/lib/dovecot/dovecot-config:LIBDOVECOT_INCLUDE=-I/root/rpmbuild/BUILDROOT/dovecot-2.2.13-mp.i386/usr/include/dovecot Found '/root/rpmbuild/BUILDROOT/dovecot-2.2.13-mp.i386' in installed files; aborting error: Bad exit status from /var/tmp/rpm-tmp.69mGY0 (%install) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.69mGY0 (%install) How to fix these errors? -- Mart

5 8

BUG: panic when using fs:posix as dict for acl_shared_dict
by Marco Giunta 13 Dec '19

13 Dec '19

Hi, I'm using Dovecot 2.2.33.2 on a RHEL 7, new installation. When I use fs:posix as dict for acl_shared_dict, like in Dovecot wiki (https://wiki.dovecot.org/SharedMailboxes/ClusterSetup) doveadm-server crash with error: # doveadm acl set -u USERNAME FOLDER user=DEST_USERNAME lookup read write-seen doveadm(USERNAME): Panic: file dict-fs.c: line 127 (fs_dict_iterate_init): assertion failed: ((flags & DICT_ITERATE_FLAG_RECURSE) == 0) doveadm(USERNAME): Error: Raw backtrace: /usr/lib64/dovecot/libdovecot.so.0(+0x9f3de) [0x7f0e4a4b23de] -> /usr/lib64/dovecot/libdovecot.so.0(default_fatal_handler+0x2a) [0x7f0e4a4b244a] -> /usr/lib64/dovecot/libdovecot.so.0(i_fatal+0) [0x7f0e4a44377c] -> /usr/lib64/dovecot/libdovecot.so.0(+0x31688) [0x7f0e4a444688] -> /usr/lib64/dovecot/libdovecot.so.0(dict_iterate_init_multiple+0x4d) [0x7f0e4a47cadd] -> /usr/lib64/dovecot/libdovecot.so.0(dict_iterate_init+0x29) [0x7f0e4a47cb89] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_lookup_dict_rebuild+0x3e1) [0x7f0e49a40371] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_acllist_rebuild+0x488) [0x7f0e49a3dd18] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_backend_vfile_object_update+0x3c7) [0x7f0e49a3e867] -> /usr/lib64/dovecot/lib01_acl_plugin.so(acl_mailbox_update_acl+0x68) [0x7f0e49a41e28] -> /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so(+0x2c11) [0x7f0e48da1c11] -> /usr/lib64/dovecot/doveadm/lib10_doveadm_acl_plugin.so(+0x3060) [0x7f0e48da2060] -> doveadm(+0x2b41c) [0x556f1280b41c] -> doveadm(+0x2c01a) [0x556f1280c01a] -> doveadm(doveadm_cmd_ver2_to_mail_cmd_wrapper+0x23b) [0x556f1280ce7b] -> doveadm(doveadm_cmd_run_ver2+0x50c) [0x556f1281c73c] -> doveadm(doveadm_cmd_try_run_ver2+0x37) [0x556f1281c7d7] -> doveadm(main+0x1e4) [0x556f127fb944] -> /lib64/libc.so.6(__libc_start_main+0xf5) [0x7f0e4a071c05] -> doveadm(+0x1bd35) [0x556f127fbd35] Aborted Attached coredump and configuration. I'm not a programmer, but seems that assert is raised by 'fs_dict_iterate_init' function inside 'src/lib-dict-extra/dict-fs.c': static struct dict_iterate_context * fs_dict_iterate_init(struct dict *_dict, const char *const *paths, enum dict_iterate_flags flags) { ... /* these flags are not supported for now */ i_assert((flags & DICT_ITERATE_FLAG_RECURSE) == 0); ... because it is called by 'acl_lookup_dict_iterate_read' function in file 'src/plugins/acl/acl-lookup-dict.c' static void acl_lookup_dict_iterate_read(struct acl_lookup_dict_iter *iter) { ... dict_iter = dict_iterate_init(iter->dict->dict, prefix, DICT_ITERATE_FLAG_RECURSE); ... with DICT_ITERATE_FLAG_RECURSE set. Same problem also with Dovecot 2.3.0. Thanks, Marco -- Marco Giunta - ITCS SysAdmin Via Bonomea, 265 34136 - Trieste, Italy Tel: +39-040-3787-503 Fax: +39-040-3787-244

4 6

Supporting RFC 5466 (IMAP4 Extension for Named Searches (Filters))
by Jesus Cea 06 Dec '19

06 Dec '19

I wonder if Dovecot supports RFC 5466 (IMAP4 Extension for Named Searches (Filters)) or if there is any plan about it. -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

4 6

dovecot sieve duplicates detection
by André Rodier 04 Dec '19

04 Dec '19

Hello, I have tested the sieve duplicate script with success so far, but I have a question. I would like to know if the "duplicate" sieve flag in Dovecot is global to all folders, or specific to one folder only. For instance, if I copy an email from one folder to another, and I have a discard action on duplicate email, is this action will be applied (in this case, discard) or not. If the duplicate is global to all folders, is there a way to restrict the search in one folder only. Thanks for your help. André

3 10

Migration
by Hans Brage 01 Oct '19

01 Oct '19

Hi! I'm currently running an small imap-server on Dovecot 2.2.4 but will retire that server. I've set up an new server with Dovecot 2.3.4 and will migrate the mailboxes (maildir-format) from the old to the new server. I'm planning to restructure the accounts a bit when migrating so I need to move them one by one. Its only a few so thats not a big issue. Both servers are using virtual accounts (users file). I've understood that best method for migration is to run doveadm backup -R from the new server. But I really cant figure out what other parameters or settings that I need to perform that task and if it should be run as user vmail or root. Would be greatful for any tips, hints, links or similiar. Regards, Hans

6 9

Best way to move mail from one server to another
by James Brown 01 Oct '19

01 Oct '19

I’d like to migrate to a new server. I only need to transfer the mail store, have already done the users. I’ve seen different recommendations: IMAP-Sync Rsync Doveadmin backup and dsync What are the pros and cons of each? What would be best for me? I’m thinking that Doveadmin backup is the way to go. Both old and new servers are on same network. New server is running Dovecot 2.3.2.1, old server is 2.2.32. macOS X. Does anyone have any advice or examples? Thanks, James.

13 29

pigeonhole/lda accessing -m folder
by matthias lay 12 Sep '19

12 Sep '19

Hi all, anybody knows, if there is a way to acces the folder from a call like this deovecot-lda -m destfolder from within a sieve script? thx in advance matze

5 9

Re: Message delivered twice caused by an LMTP error "Got unexpected reply" during upgrade to 2.3
by Gabriele Nencioni 02 Sep '19

02 Sep '19

>>> On 08/09/2018 09:12 AM, Stephan Bosch wrote >>>>>> Can you make a pcap log of the LMTP communication between the two >>>>>> Dovecot hosts? That may give me a clue on which side of the >>>>>> communication is causing the issue. >>>>> Yes sure, where I can send it? >>>>> Here on list or at your address? >>>> >>>> Just send it to me. On 08/16/2018 10:21 AM, Stephan Bosch wrote: > Op 16/08/2018 om 09:46 schreef Gabriele Nencioni: >> On 08/15/2018 06:39 PM, Stephan Bosch wrote: >>> Op 15-8-2018 om 17:19 schreef Stephan Bosch: >>>> >>>> Op 13-8-2018 om 15:50 schreef Gabriele Nencioni: >>>>> So the scenario seems to be: >>>>> the error occurs between old directors and new backends >>>>> and between the new backends and the smtp submission_host (for >>>>> redirection) >>>>> and using the pipeline capability and attaching a file >>>>> >>>>> Let me know if you need more info >>>> In this case it is possible to obtain a debug log by enabling >>>> mail_debug=yes. Can you obtain a full debug log for such a failing >>>> submission session? >> Ok! It is attached. > > That is just weird. Dovecot reports that it cannot fully send the last > bits of the message and right thereafter the reply is received, which > Dovecot then interprets as out-of-sequence. The PCAP files tell me the > final CRLF.CRLF is actually sent to the other side, but somehow Dovecot > thinks it couldn't do that yet. > > Is this problem occurring for any and all SMTP client interactions, or > just every once in a while? Unfortunately it occurs just every once in a while and it is weird because at the second attempt the message is successful delivered or redirected. >>> Also, I don't see anything weird in the PCAP files: the command-reply >>> sequence is OK. This means that this is likely a bug in the current >>> Dovecot version. Those debug logs should tell me more. >> Ok! Which version of dovecot do you suggest to install? >> On debian current stable (stretch) repository there is the version >> number 2.2.27, have we to install it? > > If you're facing big trouble it is usually best to revert to the > previous version that worked I guess. Ok I'm agree! So, about you, which version can I try to install the 2.2.27 or the previous release of the 2.3 version such as v2.3.2 2018-06-29 or v2.3.1 2018-02-29? Regards, -- Gabriele Nencioni System Administrator eml gabriele.nencioni(a)register.it

2 6

flags not synced correctly with dovecot sync (dsync)
by Dan Christensen 31 Aug '19

31 Aug '19

I'm running dovecot 2.3.4.1 from https://repo.dovecot.org/ on Ubuntu 18.04 on three machines that I'll call server, laptop1 and laptop2. Both laptop1 and laptop2 run dovecot sync against server to keep local copies of my imap folders. Even when I initially had only two machines, laptop1 and server, I occasionally noticed that flags were lost, usually custom flags used by Gnus, but I couldn't reliably reproduce the problem. Now that I have two laptops syncing against the server, the problem has gotten worse and I figured out a way to reproduce it: - on server: create new IMAP folder test, and put two read messages in it - on laptop1: doveadm sync -u user -l 10 -m test -f user@server - on laptop2: doveadm sync -u user -l 10 -m test -f user@server At this point, all three machines show the two messages M1 and M2 as being read. - on laptop1: mark message M1 unread - on laptop2: mark message M2 unread - on laptop1: doveadm sync -u user -l 10 -m test -f user@server Both laptop1 and server have M1 unread, M2 read, as expected. - on laptop2: doveadm sync -u user -l 10 -m test -f user@server Now laptop2 and server have M1 *read*, M2 unread. - on laptop1: doveadm sync -u user -l 10 -m test -f user@server Now laptop1 and the server have both M1 and M2 *read*. - on laptop2: doveadm sync -u user -l 10 -m test -f user@server Now laptop2 has both read as well. The two lines that say "*read*" are wrong in my opinion. dsync propagated a read mark to an unread message, even though that message was marked unread more recently than it was marked read. I usually use stateful sync, and get many related problems. I just did a test in which M1 and M2 started out read, and I started with empty files named dstate.test on laptop1 and laptop2. Then I did the above procedure, using the command doveadm sync -u user -l 10 -m test -s "`cat dstate.test`" user@server > dstate.test At the end, laptop2 and server had both messages unread (which is good), but laptop1 had only M1 unread, and repeated runs of the sync command did not correct this. So the stateful sync failed to detect a change. Are these bugs in dovecot? Is there more information that I can provide? The output of doveconf -n on one machine is below, and the others are almost identical. Thanks for any help! Dan # 2.3.4.1 (3c0b8769e): /etc/dovecot/dovecot.conf # OS: Linux 4.15.0-45-generic x86_64 Ubuntu 18.04.1 LTS # Hostname: laptop2 auth_mechanisms = plain login listen = 127.0.0.1 mail_index_log2_max_age = 10 days mail_index_log_rotate_min_age = 1 days mail_index_log_rotate_min_size = 300 k mail_location = maildir:~/Maildir namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { args = scheme=CRYPT username_format=%u /etc/dovecot/users driver = passwd-file } protocols = imap service imap-login { inet_listener imap { address = * port = 143 } inet_listener imaps { address = * port = 943 ssl = yes } } service imap { process_limit = 25 } ssl_cert = </etc/dovecot/private/dovecot.pem ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = username_format=%u /etc/dovecot/users driver = passwd-file } protocol lda { postmaster_address = [elided] } protocol imap { mail_max_userip_connections = 20 }

3 8

[BUG?] Double quota calulation when special folder is present
by Mark Moseley 07 Aug '19

07 Aug '19

Just hoping to get some dev eyes on this. I'm incredibly reluctant to throw the word 'bug' around (since 99 times out of 100, it's not -- it's almost always the config), but I can't think of any way that this could be a config issue, esp when the pre-2.2.34 version works as expected. I noticed during troubleshooting that dovecot errors out if I try to create a subfolder called 'INBOX' but it'll happily create a subfolder called INBOX.SomethingElse (i.e. a folder called INBOX.INBOX.SomethingElse - resulting in a directory called .INBOX.SomethingElse on the filesystem, and leading to the problem described below). Is that sub-subfolder creation (where the top level subfolder matches the namespace name) supposed to be allowed? It seems odd that 'INBOX' (as a subfolder of INBOX) would be blocked but INBOX.SomethingElse (as a subfolder of INBOX) would be allowed. I'd expect INBOX.SomethingElse (i.e. INBOX.INBOX.SomethingElse) would be blocked as well. On Wed, Mar 13, 2019 at 4:46 AM Bernd Wurst via dovecot <dovecot(a)dovecot.org> wrote: > Hello, > > we're operating dovecot on a small server. Some years ago, we migrated > from courier IMAP to dovecot. Therefore, we defined our default > Namespace "inbox" with prefix "INBOX." to have this compatible. I found > this in some migration docs those days. Generally, everything worked as > expected. > > Our only namespace is configured like this: > > namespace inbox { > separator = . > prefix = INBOX. > inbox = yes > } > > Regularly, there is no folder named INBOX or .INBOX in the file system, > I suppose this is correct. But I found a special corner case today when > it comes to quota calculation. > > When - for whatever reason - a folder .INBOX.foo (for arbitrary values > of foo) exists, the whole mailbox is counted twice in quota > recalculation. Just creating .INBOX does nothing but a subfolder > triggers the problem. > > This is my shell view (replaced username and file path and deleted > unnecessary debug output) > > $ cat maildirsize > 268435456S > 14697 17 > $ maildirmake .INBOX.foo > $ sudo doveadm -D quota recalc -u <user> > [...] > doveadm(<user>): Debug: Namespace inbox: type=private, prefix=INBOX., > sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes > location=maildir:/home/.../test > doveadm(<user>): Debug: maildir++: root=/home/.../test, index=, > indexpvt=, control=, inbox=/home/.../test, alt= > doveadm(<user>): Debug: Namespace : type=private, prefix=, sep=, > inbox=no, hidden=yes, list=no, subscriptions=no location=fail::LAYOUT=none > doveadm(<user>): Debug: none: root=, index=, indexpvt=, control=, > inbox=, alt= > doveadm(<user>): Debug: quota: quota_over_flag check: quota_over_script > unset - skipping > doveadm(<user>): Debug: Quota root User quota: Recalculated relative > rules with bytes=268435456 count=0. Now grace=26843545 > doveadm(<user>): Debug: Namespace INBOX.: Using permissions from > /home/.../test: mode=0700 gid=default > > $ cat maildirsize > 268435456S > 29394 34 > > > So the used quota has exactly been doubled by just creating an empty > subfolder. > > Do you have any pointers for fixing my configuration or is this a bug in > dovecot? > > I coincidentally resurrected a months-old thread with this same issue a few days ago. I'm seeing the exact same after upgrading from 2.2.32 to 2.2.36. The original poster (who also narrowed it down to something in 2.2.34) mentioned a workaround that does indeed work, namely setting mailbox_list_index=no: > doveadm -o 'mailbox_list_index=no' quota recalc -u myuser I've been staring at diffs of 2.2.33 and 2.2.34 without anything jumping out at me (not a C guy, sadly). Maybe src/lib-storage/index/index-storage.c or src/lib-storage/list/mailbox-list-fs-iter.c or src/lib-storage/list/mailbox-list-index-iter.c or src/lib-storage/list/mailbox-list-index.c? The latter few have some added strcmp's against "INBOX". Then again, there's a lot of new code in the diffs under src/lib-storage that references INBOX specifically.

3 5

GSSAPI vs group check
by Németh Ákos Ferenc 05 Aug '19

05 Aug '19

Dear All, Is it possible to make any authorization (eg. checking of group membership) in case of GSSAPI authentication? Our dovecot authenticates the users against PAM and GSSAPI. In the PAM file I'm able to check if a user is a member of a selected (e.g mailreader) group. If the user is member, he can login otherwise not (see below). If the user has a valid Kerberos ticket and he tries to login via GSSAPI, I can't restrict him if he is not a member of the selected group. How can I overcome this issue? My config: passdb { driver = pam # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>] # [cache_key=<key>] [<service name>] #args = dovecot } userdb { # <doc/wiki/AuthDatabase.Passwd.txt> driver = passwd # [blocking=no] #args = # Override fields from passwd #override_fields = home=/home/virtual/%u } ...in PAM file: auth [success=1 default=ignore] pam_succeed_if.so user ingroup mailreader auth [success=ignore default=2] pam_succeed_if.so user ingroup admins auth [success=ignore default=1] pam_succeed_if.so uid >= 1000 auth [success=3 default=ignore] pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login auth [success=ignore default=1] pam_succeed_if.so uid < 1000 auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass auth requisite pam_deny.so auth required pam_permit.so Thank you. Br, Ákos

2 3

Bug with latest GCC 9
by Martin Liška 29 Jul '19

29 Jul '19

Hi. As mentioned here: https://bugzilla.opensuse.org/show_bug.cgi?id=1123136 there's a new issue with GCC 9, it's related to: https://gcc.gnu.org/gcc-9/porting_to.html#complit in: /* Not const! Never return this as a result directly! */ #define SMTP_ADDRESS_LITERAL(localpart, domain) \ &((struct smtp_address){ (localpart), (domain) }) Thanks, Martin

2 4

sieve scripts not synching for 2.3.5.1 pre-built
by Jan-Pieter Cornet 29 Jul '19

29 Jul '19

Hi, We're synching mailboxes, changing format from maildir to mdbox, using doveadm backup/doveadm sync. When still running 2.2.36, 'doveadm backup' also synched the sieve scripts, without issues. After the upgrade to 2.3.5.1, the sieve sync stopped working. We're using the pre-built 2.3 packages from https://repo.dovecot.org/ce-2.3-latest/debian/stretch In fact, when I now remove the dovecot-2.3 packages, and use my own old 2.2.36 packages, using the exact same config, the sieve scripts are being copied again. In 2.2.36, when I migrate a mailbox, I do see Pigeonhole being initialized. Eg: userimap-dev1:~ # doveadm -D backup -u xtra30 "doveadm -D dsync-server -u xtra30+mdbox=.8d1&4&03&xtra30" (note: that strange destination user signals to the auth proxy that we want the new mdbox storage instead of the default for this user) Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib02_lazy_expunge_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so [...skipping a bunch of lines...] dsync-local(xtra30): Debug: brain M: Mailbox Spam: local=88b39d12998d9e5cbb700000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30): Debug: brain M: Mailbox Test: local=801bb932e98d9e5c3d6d0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30): Debug: brain M: Mailbox Trash: local=fc9b162b86479f5cc85a0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-remote(xtra30): Debug: brain S: Skipping unchanged mailbox e7c1961d84479f5c885a0000436edcce dsync-local(xtra30): Debug: doveadm-sieve: Iterating Sieve mailbox attributes dsync-local(xtra30): Debug: sieve: Pigeonhole version 0.4.24 () initializing dsync-local(xtra30): Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. dsync-local(xtra30): Debug: sieve: file storage: Using active Sieve script path: /var/mail/.8d1/index/7/oldsieve/x/xt/xtra30/dovecot.sieve [... skipping a lot of sieve debug lines that seem fine ...] dsync-remote(xtra30): Debug: sieve: file script: Opened script `xtra30-testfilter' from `/var/mail/.8d1/index/4/03/xtra30/sieve/scripts/xtra30-testfilter.sieve' dsync-remote(xtra30): Debug: doveadm-sieve: Assigned value for key `vendor/vendor.dovecot/pvt/server/sieve/default' (last change: 2019-03-29 22:27:41) dsync-remote(xtra30): Debug: brain S: Import INBOX: Import attribute vendor/vendor.dovecot/pvt/server/sieve/default: Nonexistent locally dsync-remote(xtra30): Debug: brain S: Import INBOX: Last common UID=0. Delayed expunges= dsync-remote(xtra30): Debug: brain S: Import INBOX: Import change type=save GUID=1553894809.M254847P28859.userimap11.xs4all.net,S=1311,W=1342 UID=1 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found [...] Afterwards, the sieve scripts have been transferred, even including last-modified time of any scripts. However, with 2.3.5.1, it seems doveadm-sieve is never called from dsync. Output includes: userimap-dev1:~ # doveadm -D backup -u xtra30 "doveadm -D dsync-server -u xtra30+mdbox=.8d1&4&03&xtra30" Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib02_lazy_expunge_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_lookup_dict_iterate_visible_next (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so [... skipping some lines again ..] dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Spam: local=88b39d12998d9e5cbb700000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Test: local=801bb932e98d9e5c3d6d0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Trash: local=fc9b162b86479f5cc85a0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Skipping unchanged mailbox e7c1961d84479f5c885a0000436edcce dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Import INBOX: Last common UID=0. Delayed expunges= dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Import INBOX: Import change type=save GUID=1553894809.M254847P28859.userimap11.xs4all.net,S=1311,W=1342 UID=1 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found [...] In the above output from 2.3.5.1, all lines starting with "Debug: doveadm-sieve: Iterating Sieve mailbox attributes" are absent. I have no idea why. We can "work around" it by explicitly doing an rsync of the sieve storage after the migration, but that's a bit of a hack. Attached is a doveconf -n output for 2.3.5.1. -- Jan-Pieter Cornet <johnpc(a)xs4all.net> Systeembeheer XS4ALL Internet bv www.xs4all.nl

6 7

IMAP copy stopped copying flags
by Andrzej A. Filip 29 Jul '19

29 Jul '19

Is it intended behavior? It seems to be caused by upgrade to 1:2.3.2-2 on Debian/Testing. -- A. Filip

4 6

Re: Best mail encryption solution for per-user
by Aki Tuomi 12 Jul '19

12 Jul '19

On 27.05.2018 21:16, mail(a)sjemm.net wrote: > May 27, 2018 8:52 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 26 May 2018 at 10:36 mail(a)sjemm.net wrote: >>> >>> May 23, 2018 10:10 AM, mail(a)sjemm.net wrote: >>> May 23, 2018 9:46 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> >>> On 23.05.2018 10:15, mail(a)sjemm.net wrote: >>> >>> May 23, 2018 8:31 AM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> >>> On 23.05.2018 09:13, mail(a)sjemm.net wrote: >>> May 20, 2018 8:01 PM, mail(a)sjemm.net wrote: >>> May 20, 2018 2:47 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 19 May 2018 at 16:40 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 10:01 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 21:44 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:43 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 17:38 mail(a)sjemm.net wrote: >>> >>> May 18, 2018 4:05 PM, "Aki Tuomi" <aki.tuomi(a)dovecot.fi> wrote: >>> On 18 May 2018 at 16:43 mail(a)sjemm.net wrote: >>> >>> Hi Tai74 and Aki, >>> I followed your conversation with interest on how to setup per user encryption in dovecot. >>> I have setup my dovecot with the following in a conf file: >>> >>> ============== >>> >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> mail_plugins = $mail_plugins mail_crypt >>> plugin { >>> >>> mail_crypt_curve = secp521r1 >>> >>> mail_crypt_save_version = 2 >>> >>> } >>> >>> ============== >>> >>> This works nice, all emails are being encrypted and every user/folder has keys. >>> But as I understood from your conversation these keys are not protected. And I want them to be >>> protected by the users password used by imap. >>> >>> Those passwords are stored in a mysql DB file. ( I used a guide from workaround [dot] org to set up >>> the DB and postfix/dovecot) >>> >>> but how would i set it so, that the users password from the DB is used to encrypt the keys? >>> >>> should i use mail_crypt_private_password = ? >>> how do i point it to the mysql db then? >>> im unsure about this >>> >>> Do you have any hints on this? >>> >>> Kind regards, >>> Zjemm >>> >>> The passwords in your MySQL database are, hopefully, not in plaintext. If you want to secure your >>> user's keys using user's login password, you must have a TOOL that manages this. >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> You can change the key password using 'doveadm mailbox cryptokey', this needs to be done every time >>> user changes his password. >>> >>> Also note that if you go down this road, and the user forgets his password, you will not be able to >>> recover the emails without backup copy of the private key. >>> >>> Aki >>> >>> Hi Aki >>> >>> I used the following command: >>> dovecot pw -s SHA256-CRYPT >>> >>> the output on the chosen password looks like: {SHA256-CRYPT}$5$Rokc06a7In4SF3bO$OQpGQWqg........ >>> >>> This output is used to store in the password fields in the database. So no plain text passwords no >>> :) >>> >>> You can use mail_crypt_private_password = %w in (mysql) passdb fields to provide the user's login >>> password as private password. >>> >>> can you explain this a bit more for me? >>> >>> for now i have in the 10-auth.conf file the following: >>> ============== >>> passdb { >>> driver = sql >>> >>> # Path for SQL configuration file, see example-config/dovecot-sql.conf.ext >>> args = /etc/dovecot/dovecot-sql.conf.ext >>> } >>> >>> and: >>> >>> userdb { >>> driver = static >>> args = uid=vmail gid=vmail home=/var/vmail/%d/%n >>> } >>> ============== >>> >>> then i have in dovecot-sql.conf.ext >>> ============== >>> driver = mysql >>> connect = host=x.x.x.x dbname=mailserver user=mailuser password=mailpasswordexample >>> default_pass_scheme = SHA256-CRYPT >>> password_query = SELECT email as user, password FROM virtual_users WHERE email='%u'; >>> ============== >>> Where do i need to set : mail_crypt_private_password = %w ? >>> >>> password as private password. You might want to run it thru some hash, so %{sha1:password} might be >>> a good option. >>> >>> the passwords are allready hashed in the DB using: dovecot pw -s SHA256-CRYPT to genereate the has. >>> so this step isnt nesesary anymore am i right? >>> >>> Thank you for your quick response, very helpfull >>> >>> Zjemm >>> >>> You misunderstood a bit. The idea is to use the *plaintext* password as the password for the >>> private key. Otherwise anyone could just decrypt it by looking at your database where the hashed >>> password is.. >>> >>> So: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> Aki >>> >>> Hi Aki, >>> >>> Thank you very much for your help, i realy appreciate that. >>> >>> Ok so if i understand it correctly i'll have to use: >>> >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u' >>> >>> in my dovecot-sql.conf.ext file >>> >>> This query selects the user, the password, and %w >>> >>> if i run a little query myself: >>> MariaDB [mailserver]> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password >>> FROM virtual_users; >>> +------------------+----------------------------------+------------------------------------+ >>> | user | password | userdb_mail_crypt_private_password | >>> +------------------+----------------------------------+------------------------------------+ >>> | john(a)example.org | {SHA256-CRYPT}$5$M/GWzmtjsLroRWI | %w | >>> +------------------+----------------------------------+------------------------------------+ >>> >>> %w is a dovecot variable, and stands for the plaintext password, but the password is not stored as >>> plaintext in the DB, %w get filled with the actual plaintext password by dovecot upon the user that >>> is typing in the password when authenticating. >>> >>> is this correct? >>> >>> yes. >>> >>> so then i have the username the hashed password en the plaintext password as a result of the query. >>> >>> yes >>> >>> now userdb_mail_crypt_private_password = the plaintext password >>> do i need to reference it somewhere? or is userdb_mail_crypt_private_password autmatically used by >>> the dovecot mail_crypt plugin to encrypt the keys? or should it be mail_crypt_private_password? >>> >>> It gets injected into the mail process as 'mail_crypt_private_password', as if it was set in plugin >>> {} section. >>> >>> if i have this setup working i'm going to write a blog post on this topic to share this knowledge >>> >>> Thanks again and have a great weekend. >>> >>> Zjemm >>> >>> Aki >>> >>> Hi Aki, >>> >>> Cool i'm testing it right now. >>> I have set up a new mailserver (life is great with lxc containers :) ) >>> >>> postfix and dovecot are working like normal >>> >>> next i enable mail_crypt >>> >>> i did create a file: /etc/dovecot/conf.d/10-mailcrypt.conf >>> ========================== >>> mail_attribute_dict = file:%h/Maildir/dovecot-attributes >>> >>> mail_plugins = $mail_plugins mail_crypt >>> >>> plugin { >>> mail_crypt_curve = secp521r1 >>> mail_crypt_save_version = 2 >>> } >>> ========================== >>> >>> and then i changed the file: /etc/dovecot/dovecot-sql.conf.ext >>> >>> so the query is now the new query: >>> password_query = SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM >>> virtual_users WHERE email='%u'; >>> >>> then i restarted dovecot and postfix and send a test email to the one and only testuser that is in >>> there. >>> >>> when i open the mailbox with the tool mutt, i can see the new email, and when openening the email >>> the mutt client drops the connection. >>> >>> in the log i can see: >>> >>> May 19 13:34:48 mailserver1.example.local dovecot[600]: imap-login: Login: user=<john(a)example.org>, >>> method=PLAIN, rip=::1, lip=::1, mpid=713, TLS, session=<E3PnIY9sNM4AAAAAAAAAAAAAAAAAAAAB> >>> May 19 13:34:49 mailserver1.example.local dovecot[600]: imap(john(a)example.org): Error: read() >>> failed: >>> read(/var/vmail/example.org/john/Maildir/cur/1526736378.M161472P641.mailser…, >>> =571:2,) failed: Private key not available: Cannot decrypt key >>> bfc5bb25b1bf64290eea6dc14b516c6a0a25b64551b6e4f0f8677ba7274887cb: error:03070068:bignum >>> routines:BN_mpi2bn:encoding error (FETCH BODY[] for mailbox INBOX UID 8) >>> >>> i think i missed a step, but witch one? >>> >>> the userpassword hasnt been changed (that would be the next step in the testing process) >>> >>> should i've use doveadm first to encrypt the key with that userpassword? i thought it would do that >>> on the fly, because the initial keys where only just created when enabling the mail_crypt plugin >>> >>> please let me know your thougts >>> Zjemm >>> I noticed you replied directly to me, and not to the list, too... fixed that for you. >>> >>> mail_crypt_private_password is used when key is created, but if you have created it before using >>> password, you'll need to encrypt it before turning the setting on. >>> >>> Aki >>> Hi, Ok i'm sorry about that, thank you for fixing that. i'm a bit new to mailing lists :) >>> >>> are you a dovecot devoloper? or a enthusiastic user? >>> >>> anyway, i managed to get it working now with all your help :) >>> >>> to start fresh i did a: >>> rm -rf /var/vmail/example.org >>> >>> so all email is gone, and i assume all dovecot keys are gone that way. >>> >>> Then i tried to set a password first: >>> >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>> result: Changed password for 0 key(s) >>> >>> (summersun = the password for this user) >>> >>> but then it says there are 0 keys, so then i send the test user an email and try to open the >>> mailbox, i'll get: >>> >>> imap(john(a)example.org): Error: read() failed: >>> read(/var/vmail/example.org/john/Maildir/cur/1526827992.M149712P883.mailser…, >>> =561:2,) failed: Private key not available: Cannot decrypt key >>> 71849013a70b0c631c06112077e7c2fe39b0b2737b4933b219793841209d4e7f: error:03070068:bignum >>> routines:BN_mpi2bn:encoding error >>> >>> but hey, now the key's are created, so i tried to set the password again: >>> >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>> result: dcrypt_key_load_private(787701bd677dd69a26842547a3926cbaa625b0b5a91751f06678c3e9708343d9) >>> failed: password missing >>> ========= >>> >>> Lets start over again, i did a new: >>> rm -rf /var/vmail/example.org >>> >>> i disabled the mail_crypt_private_password in the sql query and send an email to the test user. >>> now again new keys are generated. >>> >>> then i did set the password via doveadm: >>> >>> root@mailserver1:/var/vmail# doveadm mailbox cryptokey password -u john(a)example.org -n summersun >>> result: Changed password for 1 key(s) >>> >>> i enabled the mail_crypt_private_password again in the sql query part and now it works :) >>> >>> YESSS!!! >>> >>> if i now change the password for the user, i cannot read the email anymore. that is what should >>> happen. >>> so now i changed the password for this user also with doveadm: >>> - doveadm mailbox cryptokey password -u john(a)example.org -n qwerty -o summersun >>> >>> and now i'm able to read the emails again. so it all works now as expected. >>> >>> i have now only one thing remaining. >>> >>> when i want to add a new user, i have to somehow: >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> >>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>> "add-new-user" script to make it usable i guess. >>> >>> do you know of a more easy way of acomplishing this? >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>> >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>> column with %w for users that allready exist, and empty for new users. >>> when being empty, it might not set the mail_crypt_private_password for new users >>> >>> or is this the wrong way of thinking? >>> >>> let me know your thoughts on this. >>> >>> And last but not least, i really want to thank you for all your help. It is a really nice >>> experience. >>> Bless you! >>> >>> Zjemm >>> Hi Aki, >>> >>> You did fix the posting on the mail archive, i can see our conversation on there, all but the last >>> email i send to you. >>> Maybe you did not received the last email? >>> >>> would you be willing to take a look at my last question in the email See below: >>> Thank you very much. >>> >>> ================================ >>> i have now only one thing remaining. >>> >>> when i want to add a new user, i have to somehow: >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> >>> but this would be disruptive to existing users, and i would have to script the whole thing as a >>> "add-new-user" script to make it usable i guess. >>> >>> do you know of a more easy way of acomplishing this? >>> could i use doveadm for all steps, and get around the mail_crypt_private_password disable part? >>> >>> or could i add a column in the mysql db called userdb_mail_crypt_private_password and fill that >>> column with %w for users that allready exist, and empty for new users. >>> when being empty, it might not set the mail_crypt_private_password for new users >>> >>> or is this the wrong way of thinking? >>> >>> let me know your thoughts on this. >>> >>> And last but not least, i really want to thank you for all your help. It is a really nice >>> experience. >>> Bless you! >>> >>> Zjemm >>> >>> If you have mail_crypt_private_password set *when* keys are generated, >>> dovecot should use that password to encrypt the user key. >>> >>> Aki >>> Hi Aki, >>> >>> well, if there is a new email user setup in the mysql DB, and no email has been send to that new >>> user. at that point there are no keys. >>> >>> So trying to set a password on those key's wont work. see: >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n >>> qwerty >>> result: Changed password for 0 key(s) >>> >>> the keys need to be generated first. And that only happens when sending a mail to that new user. >>> Also, at the point of creating the keys, the mail_crypt_private_password should be disabled >>> otherwise the keys are generated and also encrypted with no user password, and then im unable to >>> set a new pasword for that key >>> >>> How can i set the password before the keys are generated? >>> or can i manually generate key's and then set the password? >>> >>> so at this point i have to do the following: >>> >>> You can use doveadm mailbox cryptokey generate -u user -U >>> >>> to generate a user key. >>> >>> Aki >>> >>> - create the new user in the mysql DB >>> - start with dovecot not using mail_crypt_private_password (so disabled) >>> - send an initial email to let the users mailbox be created and generate the keys >>> - set the users password with doveadm >>> - restart dovecot again with mail_crypt_private_password (so enabled) >>> can i somehow enable the mail_crypt_private_password per user? >>> because this mysql query always returns: %w >>> and thus allways sets: userdb_mail_crypt_private_password >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; >>> >>> Hi Aki, >>> >>> You are correct >>> >>> doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: >>> '%w' AS userdb_mail_crypt_private_password >>> from dovecot configuration and restart dovecot. >>> >>> if i don't do that, the keys are generated, but also somehow encrypted using: no >>> password/empty/something else (i don't know) >>> >>> here you can see that happening: >>> >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U >>> Folder Public ID >>> ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n >>> qwerty >>> result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) >>> failed: password missing >>> >>> it expects an old password wich is never set in my opinion. >>> >>> so the last part of this setup would be to figure out a way to disable '%w' AS >>> userdb_mail_crypt_private_password for new users without manually removing that part from the query >>> and restarting dovecot. As that would mean connection interruption while adding new users >>> >>> if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password >>> for that new user in the query, we can add the password afterward, and then enable '%w' AS >>> userdb_mail_crypt_private_password in the query for this user >>> >>> could we add a column in the user db lets say called: encrypted (yes/no) >>> >>> and then change the existing query: SELECT email as user, password, '%w' AS >>> userdb_mail_crypt_private_password FROM virtual_users; >>> >>> to firrt check if encryption is set to 'yes', if so retrun: >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; >>> >>> if not return: >>> SELECT email as user, password FROM virtual_users; >>> >>> but then in one mysql query so dovecot can work with it >>> >>> ? >>> >>> Hi Aki, >>> >>> would you be willing to respond to my last question i had send to you last week? >>> its this one: >>> ================================== >>> doveadm mailbox cryptokey generate -u user -U generates the keys, but i have to first remove: >>> '%w' AS userdb_mail_crypt_private_password >>> from dovecot configuration and restart dovecot. >>> >>> if i don't do that, the keys are generated, but also somehow encrypted using: no >>> password/empty/something else (i don't know) >>> >>> here you can see that happening: >>> >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey generate -u john2(a)example.org -U >>> Folder Public ID >>> ✓ <userkey> 53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4 >>> root@mailserver1:/var/vmail/example.org# doveadm mailbox cryptokey password -u john2(a)example.org -n >>> qwerty >>> result: dcrypt_key_load_private(53004acf9886f887ca081c83d7392a5aa3fac4b5a20ce013db91a341fb4644c4) >>> failed: password missing >>> >>> it expects an old password wich is never set in my opinion. >>> >>> could this be a bug? or am i doing it wrong? if needed i could send in a bug report? >>> >>> or might we need to enable the userdb_mail_crypt_private_password "per user" ? >>> >>> so the last part of this setup would be to figure out a way to disable '%w' AS >>> userdb_mail_crypt_private_password for new users without manually removing that part from the query >>> and restarting dovecot. As that would mean connection interruption while adding new users >>> >>> if we could add new users to the DB and somehow not give '%w' AS userdb_mail_crypt_private_password >>> for that new user in the query, we can add the password afterward, and then enable '%w' AS >>> userdb_mail_crypt_private_password in the query for this user >>> >>> could we add a column in the user db lets say called: encrypted (yes/no) >>> >>> and then change the existing query: SELECT email as user, password, '%w' AS >>> userdb_mail_crypt_private_password FROM virtual_users; >>> >>> to firrt check if encryption is set to 'yes', if so retrun: >>> SELECT email as user, password, '%w' AS userdb_mail_crypt_private_password FROM virtual_users; >>> >>> if not return: >>> SELECT email as user, password FROM virtual_users; >>> >>> but then in one mysql query so dovecot can work with it >>> >>> Please let me know your thougts, after this last thing im done :) >>> also let me know if i can support this project in some way, im willing to contribute >>> >>> Zjemm >> You can select it as userdb_mail_crypt_save_version=0 to disable encryption (it won't disable >> decryption). You can use value '2' for enabling encryption. DO NOT USE 1. >> >> Also I tried the SQL based thing, and if you had EMPTY mail_crypt_private_password, try these to >> change the password. If the one that works is the second one, let me know =) >> >> doveadm mailbox cryptokey password -u testuser -nnewpass -o "" >> >> doveadm mailbox cryptokey password -u testuser -nnewpass -o "yes" >> >> Aki > Hi Aki, > > Thanks for replying > > So if i understand you correctly i could enable encryption per user by using: userdb_mail_crypt_save_version= in the database as an extra column. the column would be called "userdb_mail_crypt_save_version" and the value is "0" or "2" > > if a user has: userdb_mail_crypt_save_version=0, encryption is disabled for that user > if a user has: userdb_mail_crypt_save_version=2, encryption is enabled for that user > > would this also override the setting: mail_crypt_save_version = 2 > in the mailcryp.conf file where that is a global setting? or should i delete it there and only use userdb_mail_crypt_save_version= from the database? > > for the password set command i hve testest some things: > > new user with no keys yet: > doveadm -o plugin/mail_crypt_private_password=password mailbox cryptokey generate -u john2(a)example.org -U > > i can set a password with: > new password: > doveadm mailbox cryptokey password -u john2(a)example.org -n newpass -o password > > > if i do not use new user doveadm: (doveadm -o plugin/mail_crypt_private_password=password mailbox cryptokey generate -u john2(a)example.org -U) > then use this: > doveadm mailbox cryptokey password -u john2(a)example.org -n newpass -o "yes" > > > so yes it is the second one > > Kind regards, > > Zjemm It's unfortunate problem with 2.2 that it defaults empty userdb variables into yes. This has been remedied in 2.3. Unfortunately there is no clean fix to this, they all resort to various levels of trickery. Variables set in passdb/userdb overwrite the ones in plugin {} section. Aki

2 2