April 2019 - dovecot - dovecot.org

permissions for quota-status
by Andreas Meyer 14 Apr '19

14 Apr '19

Hello! doveconf --version 2.2.36 I want to move to a new server with dovecot but get an error Error: service(quota-status): listen(*, 12340) failed: Permission denied when I define service quota-status { executable = quota-status -p postfix inet_listener { port = 12340 } client_limit = 1 } private]# ll insgesamt 0 srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 anvil srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 bounce srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 defer srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 discard srw-------. 1 postfix postfix 0 14. Apr 15:08 dovecot-lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 error srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 lmtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 local srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxymap srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 proxywrite srw-rw----. 1 postfix postfix 0 14. Apr 14:58 quota-status srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 relay srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 retry srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 rewrite srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 scache srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 smtp srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 tlsmgr srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 trace srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 verify srw-rw-rw-. 1 postfix postfix 0 14. Apr 15:05 virtual Don't know what's wrong. Can someone help? Kind regards Andreas -- PGP-Fingerprint: D392 5D21 0299 63D7 5BAE 4562 1E56 B2EA 81A2 59F1

2 1

nginx configuration to pass x-originating-ip
by André Rodier 14 Apr '19

14 Apr '19

Hello, There is a bug in SOGo, as it sends the original IP after successful login, and not before the login process. I traced the bug to the source code. https://sogo.nu/bugs/view.php?id=2979. Then, in my research, I found this old thread: https://forum.nginx.org/read.php?29,237299,237367#msg-237367 Can I use Nginx as an IMAP proxy to add the missing ID. I suspect this is something that can be achieved? I already have an Nginx for the SOGo front-end, so I would add another one for the IMAP proxy. With a little bit of luck, I should be able to pass the original IP between the two servers Does anyone has a working example? Thanks, André -- André Rodier HomeBox: https://github.com/progmaticltd/homebox

1 0

Post login scripts environment
by André Rodier 14 Apr '19

14 Apr '19

Dear Dovecot users, I am running Dovecot 2.2.27 on Debian Stretch, no issue so far. I wonder if there is a way to pass the remote IP address, in an environment variable, in the post login script. My Post login scripts are working well, except that when the server is accessed through a webmail (Roundcube or SOGo), the remote IP address is systematically 127.0.0.1. The other question I have is, is it possible to pass the user agent of the email client used to access the server? I know this can be easily forged, but I would like to log it. Thanks for your insight. -- André Rodier

2 6

Using userdb/passdb data in director_username_hash
by Mark Moseley 12 Apr '19

12 Apr '19

TL;DR: Can director_username_hash use %{userdb:...} or %{passdb:...} ? ==================================== This is on Ubuntu Precise, running dovecot 2.2.36. It's a fully production, director-ized env, so assume everything is working correctly. Happy to post doveconf if it's relevant but wanted to ask a general question first. I was curious if there's a way to get userdb/passdb data into director_username_hash. Currently, we've got default hashing (on %u). I'm returning a SQL field called 'real_username' (the owner of the mailbox, so almost never the same as %u). I'd like (for mdbox reasons) to hash on that rather than %u. My test SQL is returning (this is just a chunk -- it's duplicated for testing): UserName AS userdb_real_username, UserName AS real_username I can see in my director boxes that it's at least picking up the latter: passdb out: PASS 1 user=tesbox(a)mailbox.com proxy=y real_username=testuser Is it possible to inject 'real_username' into director_username_hash? That is, I'd rather hash on 'testuser' instead of 'testbed'. I've been trying different permutations on my director boxes with no luck. director_username_hash = %{userdb:real_username} director_username_hash = %{passdb:real_username} director_username_hash = %{userdb:userdb_real_username} director_username_hash = %{passdb:userdb_real_username} With any of those settings, every mailbox gets hashed to the same backend, so I'm guessing it's not getting anything useful (i.e. probably resolving to the same empty string and hashing on that -- or perhaps is just hashing on the literal string, e.g. "%{userdb:real_username}" ). And I'm not even sure if director_username_hash has access to any passdb/userdb data. Is there a debug setting that would show what string director is using to do the hashing? Current debug settings are: auth_debug = yes auth_debug_passwords = yes mail_debug = yes but not a peep as to the string that director is hashing on.

2 2

Migrating from external server to Dovecot (doveadm sync issues)
by Sven Strickroth 12 Apr '19

12 Apr '19

Hi, I'm experiencing serious issues when using doveadm sync not working at all or do not properly sync. I wanted to use this for migrating external mailboxes to my server (in order to overcome the time when some servers/clients still use the old server and some already the my server). I tried to find a few steps in order to replicate this: For testing purposes I simulate both the remote and local server on my Dovecot instance. I created remote(a)DOMAIN.TLD and local(a)DOMAIN.TLD both use mdbox and are empty (i.e., the mail_location is still non-existent). Then I send two mails to remote(a)DOMAIL.TLD (Subjects: Test1 and Test2). Start backup remote IMAP account (remote(a)DOMAIN.TLD) to local account (local(a)DOMAIN.TLD) * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" backup -R -u local(a)DOMAIN.TLD imapc: (without this I often got errors such as "Error: Backend didn't update mailbox Trash GUID" on sync runs, which seems to be an unrecoverable error). Now the two mailboxes seem to be the same (can confirm this when logging into the two mailboxes). Now, run first sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Seems to work and does nothing at the moment. Deliver one message to local(a)DOMAIN.TLD (Subject Test3). * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: Now Test1,2,3 are in both mailboxes (further runs do change nothing). Everything OK up the here. Now deliver one messages to remote(a)DOMAIN.TLD (Test4) and delete one old message (Test3). Deliver two messages to local(a)DOMAIN.TLD (Subjects Test5 and Test6) and delete one message (Test2). In sum both mailboxes look like this: remote(a)DOMAIN.TLD has Test1,2,4 and local(a)DOMAIN.TLD has 1,3,5,6. Now sync: * doveadm -o imapc_user="remote(a)DOMAIN.TLD" -o imapc_password="PW" -o imapc_host="localhost" -o mail_prefetch_count=20 -o imapc_features="rfc822.size fetch-headers" sync -R -u local(a)DOMAIN.TLD imapc: dsync(local(a)DOMAIN.TLD): Warning: Mailbox changes caused a desync. You may want to run dsync again: 3 UIDs changed due to UID conflicts Rerun again and see that mails start duplicating and deletings are not synced: remote(a)DOMAIN.TLD: Test1,2,4,3,5,6,5,6,6,5,3,4 (12 mails) and local(a)DOMAIN.TLD: 1,6,4,3,5,6,4,3,5,6,5 (11 mails) When I re-run again I sometimes see the above error message again, mails keep duplicating in both mailboxes and the mailboxes are not synced at all. Am I using doveadm sync wrongly? Is there a way to use "sync" directly w/o backup from the beginning (i.e., how to get rid of the error "Error: Backend didn't update mailbox Trash GUID"). Context: # 2.2.27 (c0f36b0): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.16 (fed8554) # OS: Linux 4.9.0-8-amd64 x86_64 Debian 9.8 imap_client_workarounds = delay-newmail I can't upgrade to latest Dovecot right now. :( -- Best regards, Sven Strickroth PGP key id F5A9D4C4 @ any key-server

1 0

Mail account brute force / harassment
by Marc Roos 12 Apr '19

12 Apr '19

Say for instance you have some one trying to constantly access an account Has any of you made something creative like this: * configure that account to allow to login with any password * link that account to something like /dev/zero that generates infinite amount of messages (maybe send an archive of virusses?) * transferring TB's of data to this harassing client. I think it would be interesting to be able to do such a thing.

3 2

Emails redownloading
by azurit＠pobox.sk 12 Apr '19

12 Apr '19

Hi, recently, we had a problem on one of our mail servers and, after reboot, HDD with emails wasn't mounted into system. Until we fixed it, LOTS of users logged in (Dovecot allowed login and recreated directory structure of mailboxes) and saw empty mailboxes. Now they are redownloading all email, which isn't fun, as it's about 2 TB of data. Anyway, is there a way how to prevent this in the future? Can i set Dovecot to disallow logins in such situations? Thanks. azur

3 5

Doveadm stats
by ＠lbutlr 12 Apr '19

12 Apr '19

Are there any examples of the utility of doveadm stats? in the man page: > dump accepts following types: command, session, user, domain, ip and > global. > > Filter can be > > user=<wildcard> > Match given user. I've tried the following commands after looking at the (sparse and example-less) man page. # doveadm stats dump metric_name field count sum min max avg median stddev %95 # doveadm stats dump user Error: Extraneous arguments found: user # doveadm stats dump user user="*" Error: Extraneous arguments found: user user=* # doveadm stats dump global Error: Extraneous arguments found: global # doveadm stats dump global user="*" Error: Extraneous arguments found: global user=* # I assume there is more to the configuration for stats than merely making it not report an error. So, the first question is what sorts of stats would be most likely to be useful and what do I do in the configuration to get those? Second question is why is this required to be enabled if, by default, it has no functionality? -- Beware of geeks bearing .GIF's

2 1

Mailbox INBOX: Opening INBOX failed: Mailbox doesn't exist: INBOX. Maybe master user + namespace problem?
by Usuario prueba 12 Apr '19

12 Apr '19

2 2

Secure Client-Initiated Renegotiation
by sergio 12 Apr '19

12 Apr '19

Hello. I've just tested my system that runs dovecot 2.3.4.1 on debian buster with testssl.sh (https://testssl.sh/) and is says: Secure Renegotiation (CVE-2009-3555) not vulnerable (OK) Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), potential DoS threat Is this a configuration or a compilation issue and how to solve it? -- sergio.

2 1

Re: High availability of Dovecot
by Gerald Galster 12 Apr '19

12 Apr '19

> Am 11.04.2019 um 11:48 schrieb luckydog xf <luckydogxf(a)gmail.com>: > > As your statement, nothing speical is needed to do except setting up DNS MX records, right? MX records are for incoming MAIL: yourdomain.com <http://yourdomain.com/> IN MX 100 mail1.yourdomain.com <http://server1.yourdomain.com/> yourdomain.com <http://yourdomain.com/> IN MX 100 mail2.yourdomain.com <http://mail2.yourdomain.com/> -> both priority 100 = 50/50 load balancing (globally, not when checked on a single resolver!) Then you need A Records (AAAA for ipv6) mail1.yourdomain.com IN A 192.168.10.1 mail2.yourdomain.com <http://mail2.yourdomain.com/> IN A 192.168.20.1 mail.yourdomain.com IN A 192.168.10.1 mail.yourdomain.com IN A 192.168.20.1 mail1/mail2 is for direct connection (MTAs) Your users (outlook, thunderbird, ...) connect to mail.yourdomain.com <http://mail.yourdomain.com/> which returns the two ip addresses. In this scenario MUA just connects to mail.yourdomain.com <http://mail.yourdomain.com/> and randomly uses one of the two ips. You can't control which one, but this gives you active/active loadbalancing. In case one server is down the MUA just uses the other ip. dsync replicates bi-directionally so that both servers are up-to-date. You don't need shared storage, every server is a copy of the other. If you want to use shared storage, then dsync is not for you because there is nothing to sync at that stage. I would use shared storage only if you need to have more than two servers. The above setup has no locking problems and is performant due to local filesystems. It depends on how many users you have and how much storage you need. You could buy two 2HE servers with 24 2.5" disks each (up to 96 with 4 HE), which may be sufficient for your needs. > User's mail store is running on shared storage, basically user's MUA connects to primary MX , the backup one is used once Primary is down. If you're not using Maildir beware of locking issues with concurrent access. It could crash indices. > It's a native HA of email system? I'll test those solution out. Yes, it works well with small setups. For big setups you'd typically use dovecot director, shared storage, object storage ... but you need more servers and it is way more complex and expensive. Best regards Gerald

3 3

failed: read(/var/run/dovecot/dns-client)
by Laura Smith 12 Apr '19

12 Apr '19

=== dsync(foobar(a)example.com): Error: imapc(foobar.example.com:993): dns_lookup(foobar.example.com) failed: read(/var/run/dovecot/dns-client) failed: read(size=512) failed: Connection reset by peer dsync(foobar(a)example.com): Error: Failed to initialize user: imapc: Login to foobar.example.com failed: Disconnected from server === Initially I thought "oh no, not another AppArmor block". But then surely the second message would not appear if the DNS lookup was not successful ? Also "dig foobar.example.com" works fine. How should I be troubleshooting this ? And if it is still likely to be AppArmor, what is calling it ? "doveadm" itself or something else ? What does "/var/run/dovecot/dns-client" do and why doesn't dovecot use standard OS calls like everyone else ? So many questions !

3 18

auth-worker unknown user
by Laura Smith 11 Apr '19

11 Apr '19

pam(foobar(a)example.com,192.0.1.1,<9zMTUUCGNfHZzMpL>): unknown user (SHA1 of given password: ff75068c2f4d700a49dae204d56477a5ffa5d23d) The password is correct, i.e. 'echo -n 'passed' | openssl dgst -sha1' matches. The user is setup correctly in /etc/dovecot/users (the /etc/dovecot/users was copied from another known-good server, so the syntax is correct and appropriate adjustments have been made for chmod and directory). doveconf -N follows: # 2.3.3 (dcead646b): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.3 (f018bbab) # OS: Linux 4.12.14-lp150.12.48-default x86_64 # Hostname: foobar auth_mechanisms = plain login auth_verbose = yes auth_verbose_passwords = sha1 doveadm_password = # hidden, use -P to show it first_valid_uid = 471 imapc_features = rfc822.size fetch-headers imapc_host = foobar.example.com imapc_password = # hidden, use -P to show it imapc_port = 993 imapc_ssl = imaps imapc_user = %u mail_location = maildir:~/Maildir mail_plugin_dir = /usr/lib64/dovecot/modules mail_prefetch_count = 20 mailbox_list_index = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body environment mailbox date ihave enotify namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } passdb { driver = pam name = } plugin { sieve = file:~/.dovecot.sieve } protocols = imap lmtp service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } } service imap-login { process_min_avail = 3 } service lmtp { process_min_avail = 5 unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0660 user = postfix } user = my_virtmailuser } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieves { address = port = 5190 ssl = yes } } ssl = required ssl_ca = </etc/dovecot/ssl/certbot_ca.pem ssl_cert = </etc/dovecot/ssl/certbot.pem ssl_cipher_list = ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS ssl_client_ca_dir = /etc/ssl/certs ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it ssl_min_protocol = TLSv1.2 ssl_options = no_compression ssl_prefer_server_ciphers = yes userdb { driver = passwd name = } userdb { args = scheme=ARGON2ID username_format=%u /etc/dovecot/users auth_verbose = yes driver = passwd-file name = } protocol lmtp { mail_plugins = sieve postmaster_address = foobar(a)example.com } protocol lda { deliver_log_format = msgid=%m: %$ mail_plugins = sieve postmaster_address = postmaster quota_full_tempfail = yes rejection_reason = Your message to <%t> was automatically rejected:%n%r } protocol imap { mail_max_userip_connections = 20 }

2 7

LMTP, PAM session and home directory autocreation
by Ivars Strazdins 11 Apr '19

11 Apr '19

Hi, mail is delivered by Dovecot's LMTP locally and I need user's home directory to be created if it doesn't exist yet. There is a setting in Dovecot's configuration, "session=yes", in /etc/Dovecot/conf.d/auth-system.conf.ext, which should do that. passdb { driver = pam args = session=yes dovecot } But I think it does not work in my setup because I do not see any PAM log entry for Dovecot in system log when this error happens: Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Connect from local Apr 9 13:01:55 mailhost dovecot: lmtp(2935, testuser): Error: User initialization failed: Namespace '': mkdir(/home/testuser/Maildir) failed: Permission denied (euid=174000327(testuser) egid=174000327(testuser ) missing +w perm: /home, dir owned by 0:0 mode=0755) Apr 9 13:01:55 mailhost dovecot: lmtp(2935): Disconnect from local: Successful quit The error above seems expected, because it is not LMTP agent's job to create user's home directory but pam_oddjob_mkhomedir.so module should do that. Right? And there are common PAM log entries for every user session: Apr 9 13:24:42 mailhost auth: pam_sss(dovecot:auth): authentication success; logname= uid=0 euid=0 tty=dovecot ruser=validuser rhost=::1 user= validuser Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session opened for user validuser by (uid=0) Apr 9 13:24:42 mailhost auth: pam_unix(dovecot:session): session closed for user validuser How to debug this problem and find out why Dovecot does not open PAM session or - if I am wrong and it does, then what else is going wrong? Home directory autocreation is configured with command "authconfig --enablemkhomedir --update" and it works if user logs into system via shell or webmail. I tried to enable "mail_debug" in Dovecot's settings, but it did not give me any more information on PAM session. Running on Centos 7.6, with Dovecot 2.2.36. It looks like a common mistake or issue, because I am not alone: http://tinyurl.com/y6kjhsnw Thank you very much in advance for your time. Ivars /etc/pam.d/dovecot #%PAM-1.0 auth required pam_nologin.so auth include password-auth account include password-auth session include password-auth /etc/pam.d/password-auth #%PAM-1.0 # This file is auto-generated. # User changes will be destroyed the next time authconfig is run. auth required pam_env.so auth [default=1 success=ok] pam_localuser.so auth [success=done ignore=ignore default=die] pam_unix.so nullok try_first_pass auth requisite pam_succeed_if.so uid >= 1000 quiet_success auth sufficient pam_sss.so forward_pass auth required pam_deny.so account required pam_unix.so account sufficient pam_localuser.so account sufficient pam_succeed_if.so uid < 1000 quiet account [default=bad success=ok user_unknown=ignore] pam_sss.so account required pam_permit.so password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= password sufficient pam_unix.so sha512 shadow nullok try_first_pass use_authtok password sufficient pam_sss.so use_authtok password required pam_deny.so session optional pam_keyinit.so revoke session required pam_limits.so -session optional pam_systemd.so session optional pam_oddjob_mkhomedir.so umask=0077 session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid session required pam_unix.so session optional pam_sss.so doveconf -n # 2.2.36 (1f10bfa63): /etc/dovecot/dovecot.conf # Pigeonhole version 0.4.24 (124e06aa) # OS: Linux 3.10.0-957.10.1.el7.x86_64 x86_64 CentOS Linux release 7.6.1810 (Core) # Hostname: mailhost.example.com auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-master auth_username_format = %Ln auth_verbose = yes default_client_limit = 3500 default_process_limit = 500 disable_plaintext_auth = no first_valid_uid = 203 imap_client_workarounds = tb-lsub-flags tb-extra-mailbox-sep lda_mailbox_autocreate = yes lda_mailbox_autosubscribe = yes lmtp_save_to_detail_mailbox = yes mail_location = maildir:~/Maildir:INBOX=~/Maildir:LAYOUT=fs mail_plugins = " fts fts_lucene" mail_privileged_group = mail maildir_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve mbox_write_locks = fcntl namespace inbox { inbox = yes list = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / type = private } passdb { args = session=yes dovecot driver = pam } plugin { autocreate = Junk autocreate2 = Sent autocreate3 = Drafts autocreate4 = Trash autosubscribe = Junk autosubscribe2 = Sent autosubscribe3 = Drafts autosubscribe4 = Trash fts = lucene fts_lucene = whitespace_chars=@. imapsieve_mailbox1_before = file:/usr/lib64/dovecot/sieve/report-spam.sieve imapsieve_mailbox1_causes = COPY imapsieve_mailbox1_name = Junk imapsieve_mailbox2_before = file:/usr/lib64/dovecot/sieve/report-ham.sieve imapsieve_mailbox2_causes = COPY imapsieve_mailbox2_from = Junk imapsieve_mailbox2_name = * sieve = file:~/sieve;active=~/roundcube.sieve sieve_before = /var/lib/sieve/junk.sieve sieve_global_extensions = +vnd.dovecot.pipe +vnd.dovecot.environment sieve_pipe_bin_dir = /usr/lib64/dovecot/sieve sieve_plugins = sieve_imapsieve sieve_extprograms } pop3_client_workarounds = outlook-no-nuls oe-ns-eoh pop3_uidl_format = %v.%u protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/dovecot-auth { group = postfix mode = 0660 user = postfix } unix_listener auth-master { group = user mode = 0660 user = root } } service lmtp { unix_listener /var/spool/postfix/private/dovecot-lmtp { group = postfix mode = 0600 user = postfix } } ssl_cert = </etc/letsencrypt/live/webmail.example.com/fullchain.pem ssl_key = # hidden, use -P to show it syslog_facility = local0 userdb { driver = passwd } valid_chroot_dirs = /var/mail:/home protocol lmtp { mail_fsync = never mail_plugins = " fts fts_lucene sieve" postmaster_address = postmaster(a)example.com } protocol lda { mail_fsync = never mail_plugins = " fts fts_lucene sieve expire" } protocol imap { mail_max_userip_connections = 25 mail_plugins = " fts fts_lucene fts fts_squat expire imap_sieve" } protocol sieve { managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date } protocol pop3 { mail_max_userip_connections = 20 mail_plugins = " fts fts_lucene fts fts_squat expire" }

1 0

High availability of Dovecot
by luckydog xf 11 Apr '19

11 Apr '19

Hi, list, I'm going to deploy postfix + dovecot + CephFS( as Mail Storage). Basically I want to use two servers for them, which is kind of HA. My idea is that using keepalived or Pacemaker to host a VIP, which could fail over the other server once one is down. And I'll use Haproxy or Nginx to schedule connections to one of those server based on source IP( Session stickiness), I'll use VIP as DNS record.etc, is my plan doable? I know MX could be server ones with different priority. But I think it brings along shortage that DNS couldn't know Email server is up or down, it just returns results to MUA, right? Thanks for any suggestions and ideas. -

7 6

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

All your approaches are not well thought out. The best solutions are always the simplest ones. KISS principle dictates so. On Thu, 11 Apr 2019 at 15:01, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > > How long have we been using the current strategy? Do we have less or > more abuse clouds operating? > > "Let the others bother with their own problems." is a bit narrow minded > view. If every one on this mailing list would have this attitude, there > would be no single answer to your question. > > > -----Original Message----- > From: Odhiambo Washington [mailto:odhiambo@gmail.com] > Sent: donderdag 11 april 2019 12:54 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > Marc, > > There is a strategy loosely referred to as "choose your battles well" > :-) > If you can, hack the server and dump the 500GB - you'll be using > resources transferring the 500GB as the other server receives it. Two > servers wasting resources because you think you are punishing an > offender! > > > On Thu, 11 Apr 2019 at 13:43, wrote: > > > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice > it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that > attacking my > servers, will result in the loss of abuse nodes, hence they will > not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get > less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly > access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any > password > * link that account to something like /dev/zero that > generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a > thing. > > > > > Instead of being evil, just use fail2ban to address this problem > :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > > > > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

Re: Mail account brute force / harassment
by Odhiambo Washington 11 Apr '19

11 Apr '19

Marc, There is a strategy loosely referred to as "choose your battles well" :-) Let the others bother with their own problems. If you can, hack the server and dump the 500GB - you'll be using resources transferring the 500GB as the other server receives it. Two servers wasting resources because you think you are punishing an offender! On Thu, 11 Apr 2019 at 13:43, Marc Roos <M.Roos(a)f1-outsourcing.eu> wrote: > Please do not assume anything other than what is written, it is a > hypothetical situation > > > A. With the fail2ban solution > - you 'solve' that the current ip is not able to access you > - it will continue bothering other servers and admins > - you get the next abuse host to give a try. > > B. With 500GB dump > - the owner of the attacking server (probably hacked) will notice it > will be forced to take action. > > > If abuse clouds are smart (most are) they would notice that attacking my > servers, will result in the loss of abuse nodes, hence they will not > bother me anymore. > > If every one would apply strategy B, the abuse problem would get less. > Don't you agree?? > > > > > > > -----Original Message----- > From: Odhiambo Washington > Sent: donderdag 11 april 2019 12:28 > To: Marc Roos > Cc: dovecot > Subject: Re: Mail account brute force / harassment > > > > On Thu, 11 Apr 2019 at 13:24, Marc Roos via dovecot > <dovecot(a)dovecot.org> wrote: > > > > > Say for instance you have some one trying to constantly access an > account > > > Has any of you made something creative like this: > > * configure that account to allow to login with any password > * link that account to something like /dev/zero that generates > infinite > amount of messages > (maybe send an archive of virusses?) > * transferring TB's of data to this harassing client. > > I think it would be interesting to be able to do such a thing. > > > > > Instead of being evil, just use fail2ban to address this problem :-) > > -- > > Best regards, > Odhiambo WASHINGTON, > Nairobi,KE > +254 7 3200 0004/+254 7 2274 3223 > "Oh, the cruft.", grep ^[^#] :-) > > > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

2 1

Re: Lua Push Notification Plugin
by Sami Ketola 11 Apr '19

11 Apr '19

Hi, doveadm mailbox metadata get -u victim INBOX /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify or doveadm mailbox metadata set if you are not using appsuite as your mail frontend then you need to set the metadata manually or make sure that your mail frontend does set it. Sami > On 11 Apr 2019, at 11.50, Pabsky <j0hnw0rk3r(a)gmail.com> wrote: > > Sami, > > the package 'appsuite' is not mentioned in the documentation, also I already enabled imap metadata. > > What do you mean by 'It's not supposed to be a file. It's supposed to be a attribute on the users INBOX'? > > I'm attaching my dovecot configuration file for you to examine. Thanks Sami! > > On 11/04/2019 4:37 PM, Sami Ketola wrote: >> >> >>> On 11 Apr 2019, at 11.00, Pabsky via dovecot <dovecot(a)dovecot.org <mailto:dovecot@dovecot.org>> wrote: >>> >>> Thanks AKI! I'm a step closer to achieving my goals. >>> >>> However, I'm getting a new error as indicated from below: >>> >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set) >>> Apr 11 01:45:34 lmtp(user(a)mydomain.com <mailto:user@mydomain.com>)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>: Debug: push-notification: Push notification transaction completed >>> >>> By the way, the file /private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify does not exist on my server. >> >> It's not supposed to be a file. It's supposed to be a attribute on the users INBOX. Also you need to enable imap metadata or appsuite can't set the attribute. >> >> Sami >> >> > <dovecot.conf>

1 0

Passord change problem. (INTERNAL)
by Arvid.Eikas＠telenor.com 11 Apr '19

11 Apr '19

Hi, We have a strange problem with login after password change. We need to kill the auth_worker processes to activate the new password. It doesn't work with SIGHUP on pid, it doesn't help to run "doveadm auth cache flush". It runs flush xx but the new password still doesn't work. Are there any suggestions for how this can be resolved? Our release is 2.3.5. Arvid

1 0

Re: Lua Push Notification Plugin
by Pabsky 11 Apr '19

11 Apr '19

Thanks AKI! I'm a step closer to achieving my goals. However, I'm getting a new error as indicated from below: Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification-ox: Skipped because not active (/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify METADATA not set)* Apr 11 01:45:34 lmtp(user(a)mydomain.com)<20801><pVlIEJ7wrlxBUQAAUdwEFQ>:*Debug: push-notification: Push notification transaction completed *By the way, the file****/private/vendor/vendor.dovecot/pvt/server/vendor/vendor.dovecot/http-notify* *does not exist on my server. Again, I appreciate the help :) ** > On 11 April 2019 07:57 Robust Coding via dovecot <dovecot(a)dovecot.org> wrote: > > > Hi Admin, > > I hope you consider reading and addressing my concern promptly. > > For the past few days I've been setting up a VPS with cPanel and WHM > pre-installed on Bluehost. I want to enable push notification plugin in > Dovecot2.3.5. I tried OX and Lua plugins and got errors. > > For using OX plugin: > push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 > user_from_metadata > And got this error on runtime: > Error: push-notification-ox: Skipped because unable to get attribute: Mailbox > attributes not enabled > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > When using Lua: > mail_plugins = $mail_plugins mail_lua notify push_notification > push_notification_lua > > plugin { > push_notification_driver = lua:file=/path/to/lua/push.lua > } > And got this order: > Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot > You do not have push_notification_lua installed. > I think I'm missing something here but I can't figure it out. Please HELP! > > Sincerely, > John Lopena > > -- > > "Become a programmer - Lose your brain's virginity" Aki

3 2

masteruser can not select INBOX
by Ludwig Wieland 11 Apr '19

11 Apr '19

Hello, My Dovecot Master can login but not not select INBOX ! What's wrong ? best regards Luda 1) USER can select INBOX: OK --------------------------------------------------- telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1 password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 5 EXISTS * 0 RECENT * OK [UNSEEN 1] First unseen. * OK [UIDVALIDITY 1328091893] UIDs valid * OK [UIDNEXT 6] Predicted next UID * OK [HIGHESTMODSEQ 11] Highest b OK [READ-WRITE] Select completed (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. 2) MASTER-USER can't select INBOX: ! --------------------------------------------------- admins$ telnet localhost imap Trying ::1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=CRAM-MD5 AUTH=DIGEST-MD5 AUTH=GSSAPI AUTH=PLAIN AUTH=LOGIN] Dovecot ready. a login test1*mailmaster password a OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE SEARCH=FUZZY SPECIAL-USE COMPRESS=DEFLATE QUOTA ACL RIGHTS=texk] Logged in b select INBOX b NO [SERVERBUG] Internal error occurred. Refer to server log for more information. [2019-04-09 08:20:46] (0.000 + 0.000 secs). c logout * BYE Logging out c OK Logout completed. Connection closed by foreign host. ---------------------------------------- An the Server Error log says: Apr 09 00:05:40 imap(pid 62335 user test1): Error: Opening INBOX failed: Mailbox doesn't exist: INBOX ---------------------------------------- admins$ doveconf -n # 2.2.24 (a82c823): /Library/Server/Mail/Config/dovecot/dovecot.conf # OS: Darwin 16.7.0 x86_64 hfs auth_master_user_separator = * auth_mechanisms = cram-md5 digest-md5 gssapi plain login apop auth_realms = xserver.mydomain.ch auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %n debug_log_path = /Library/Logs/Mail/mail-debug.log default_internal_user = _dovecot default_login_user = _dovenull disable_plaintext_auth = no first_valid_gid = 6 first_valid_uid = 6 imap_id_log = * imap_id_send = "name" * "version" * imap_urlauth_submit_user = submit info_log_path = /Library/Logs/Mail/mail-info.log log_path = /Library/Logs/Mail/mail-err.log login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c mail_access_groups = mail mail_attribute_dict = file:/Library/Server/Mail/Data/attributes/attributes.dict mail_location = maildir:/Library/Server/Mail/Data/mail/%u mail_log_prefix = "%s(pid %p user %u): " mail_plugins = quota zlib acl fts fts_sk managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date ihave mdbox_rotate_size = 200 M namespace acl-mailboxes { list = children location = maildir:/Library/Server/Mail/Data/mail/users/%%u:INDEX=/Library/Server/Mail/Data/mail/shared/%%u prefix = shared.%%u. separator = . subscriptions = no type = shared } namespace inbox { inbox = yes location = mailbox "Deleted Messages" { special_use = \Trash } mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } namespace list-archives { list = children location = maildir:/Library/Server/Mail/Data/listserver/messages/archive/lists/%%u:INDEX=/Library/Server/Mail/Data/listserver/messages/archive/shared/%%u prefix = archives.%%u. separator = . subscriptions = no type = shared } passdb { args = /Library/Server/Mail/Config/dovecot/master-users driver = passwd-file master = yes pass = yes } passdb { driver = od } passdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } plugin { acl = vfile:/Library/Server/Mail/Config/dovecot/global-acls:cache_secs=300 acl_shared_dict = file:/Library/Server/Mail/Data/shared/shared-mailboxes fts = sk quota = maildir:User quota quota_warning = storage=100%% quota-exceeded %u quota_warning2 = storage=80%% quota-warning %u sieve = /Library/Server/Mail/Data/rules/%u/dovecot.sieve sieve_dir = /Library/Server/Mail/Data/rules/%u stats_refresh = 30 secs stats_track_cmds = yes } postmaster_address = postmaster(a)xserver.myserver.ch protocols = imap pop3 lmtp sieve quota_full_tempfail = yes service auth { idle_kill = 15 mins unix_listener auth-userdb { user = _dovecot } } service dns_client { unix_listener dns-client { mode = 0600 } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } service_count = 0 } service imap { client_limit = 5 process_limit = 200 service_count = 0 } service indexer-worker { user = _dovecot } service lmtp { unix_listener lmtp { mode = 0600 } } service managesieve-login { inet_listener sieve { port = 4190 } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } service pop3 { client_limit = 5 process_limit = 200 service_count = 0 } service quota-exceeded { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-exceeded.sh unix_listener quota-exceeded { group = mail mode = 0660 user = _dovecot } user = _dovecot } service quota-warning { executable = script /Applications/Server.app/Contents/ServerRoot/usr/libexec/dovecot/quota-warning.sh unix_listener quota-warning { group = mail mode = 0660 user = _dovecot } user = _dovecot } service stats { fifo_listener stats-mail { mode = 0600 user = _dovecot } } ssl = required ssl_ca = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.chain.pem ssl_cert = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.cert.pem ssl_cipher_list = ALL:!LOW:!SSLv2:!EXP:!aNULL:!ADH:!eNULL ssl_key = </etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_key_path = /etc/certificates/myserver.ch.A9FFFFB4B4C0E4CA959917BC2F60BDECBC414D35.key.pem ssl_protocols = !SSLv2 !SSLv3 userdb { args = partition=/Library/Server/Mail/Config/dovecot/partition_map.conf global_quota=0 enforce_quotas=yes driver = od } userdb { args = /Library/Server/Mail/Config/dovecot/submit.passdb driver = passwd-file } verbose_proctitle = yes protocol lmtp { mail_plugins = quota zlib acl fts fts_sk sieve } protocol lda { mail_plugins = quota zlib acl fts fts_sk sieve } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota zlib acl fts fts_sk imap_acl imap_quota imap_zlib } protocol pop3 { mail_max_userip_connections = 6 }

3 8

Lua Push Notification Plugin
by Robust Coding 11 Apr '19

11 Apr '19

Hi Admin, I hope you consider reading and addressing my concern promptly. For the past few days I've been setting up a VPS with cPanel and WHM pre-installed on Bluehost. I want to enable push notification plugin in Dovecot2.3.5. I tried OX and Lua plugins and got errors. For using OX plugin: push_notification_driver = ox:url=http://staging.mydomain.com/mail-notify/v1 user_from_metadata And got this error on runtime: *Error: push-notification-ox: Skipped because unable to get attribute: Mailbox attributes not enabled* When using Lua: mail_plugins = $mail_plugins mail_lua notify push_notification push_notification_luaplugin { push_notification_driver = lua:file=/path/to/lua/push.lua} And got this order: *Plugin 'push_notification_lua' not found from directory /usr/lib64/dovecot* I think I'm missing something here but I can't figure it out. Please HELP! Sincerely, John Lopena -- *"Become a programmer - Lose your brain's virginity"*

2 1

ssl_cert: Can't open file permission denied
by Laura Smith 10 Apr '19

10 Apr '19

Dovecot 2.3.3 (dcead646b) openSUSE Leap 15.0 I am getting a weird error message: Fatal: Error in configuration file /etc/dovecot/local.conf line 16: ssl_cert: Can't open file /etc/foobar/ssl/certbot.pem: Permission denied I have tried the following: - chmod -R 655 /etc/foobar/ssl (/etc/foobar is 755) - create "ssl_users" group add dovecot to it chown -R dovecot:ssl_users /etc/foobar/ssl How can I fix this ? There's no obvious solution ?

5 7

/var/run/dovecot/stats-writer) failed: Permission denied
by ＠lbutlr 10 Apr '19

10 Apr '19

I am getting this error in logs net_connect_unix(/var/run/dovecot/stats-writer) failed: Permission den)) and I looked around the google results and it seems to be related to using service stats, which I am not using. # doveconf -n | grep stat # doveconf -n | head -3 # 2.3.5.1 (7ec6d0ade): /usr/local/etc/dovecot/dovecot.conf # Pigeonhole version 0.5.5 (2483b085) # OS: FreeBSD 11.2-RELEASE-p4 i386 Postfix is 3.4-20190106 (the newest version in ports) -- Over 3,500 gay marriages and, what, no hellfire? I was promise hellfire. And riots. What gives? -- Mark Morford

4 12

Restoring mailboxes from backup duplicates messages in POP clients
by Luis F. V. Gomes 10 Apr '19

10 Apr '19

Hello I had a disk problem and had to reformat it. All mailboxes were backed up using rsync. After I restored the mailboxes, the POP clients (Thunderbird) that were configured to leave the messages on the mailserver for, let's say, 30 days, didn't understand that some messages were already transfered and the users got duplicated messages in their Inbox. How can we avoid this? -- Thanks Luís F. Gomes IT Manager (55)(21) 3527-1220 Departamento de Engenharia Elétrica PUC-Rio R. Marques de S. Vicente 225/401L 22451-900 - Rio de Janeiro/RJ

3 4