July 2019 - dovecot - dovecot.org

GSSAPI vs group check
by Németh Ákos Ferenc 05 Aug '19

05 Aug '19

Dear All, Is it possible to make any authorization (eg. checking of group membership) in case of GSSAPI authentication? Our dovecot authenticates the users against PAM and GSSAPI. In the PAM file I'm able to check if a user is a member of a selected (e.g mailreader) group. If the user is member, he can login otherwise not (see below). If the user has a valid Kerberos ticket and he tries to login via GSSAPI, I can't restrict him if he is not a member of the selected group. How can I overcome this issue? My config: passdb { driver = pam # [session=yes] [setcred=yes] [failure_show_msg=yes] [max_requests=<n>] # [cache_key=<key>] [<service name>] #args = dovecot } userdb { # <doc/wiki/AuthDatabase.Passwd.txt> driver = passwd # [blocking=no] #args = # Override fields from passwd #override_fields = home=/home/virtual/%u } ...in PAM file: auth [success=1 default=ignore] pam_succeed_if.so user ingroup mailreader auth [success=ignore default=2] pam_succeed_if.so user ingroup admins auth [success=ignore default=1] pam_succeed_if.so uid >= 1000 auth [success=3 default=ignore] pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login auth [success=ignore default=1] pam_succeed_if.so uid < 1000 auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass auth requisite pam_deny.so auth required pam_permit.so Thank you. Br, Ákos

2 3

dovecot/imap crashes on Centos 7
by marvin alcantara 30 Jul '19

30 Jul '19

Hi All, I have my dovecot/imap crashing on my Centos7 server. Below is the stacktrace I got: #0 0x00007f32d9b84e58 in array_count_i (array=0x55b332a1f8f8) at array.h:155 No locals. #1 array_get_i (count_r=<synthetic pointer>, array=0x55b332a1f8f8) at array.h:209 No locals. #2 seq_range_lookup (array=0x55b332a1f8f8, seq=7715, idx_r=0x7ffe5d719574) at seq-range-array.c:14 data = <optimized out> idx = <optimized out> left_idx = <optimized out> right_idx = <optimized out> count = <optimized out> #3 0x00007f32d9b859ae in seq_range_exists (array=array@entry=0x55b332a1f8f8, seq=seq@entry=7715) at seq-range-array.c:391 idx = 32766 #4 0x00007f32d9e4b3d9 in mailbox_search_result_add (result=result@entry=0x55b332a1f8e0, uid=7715) at mailbox-search-result.c:121 __FUNCTION__ = "mailbox_search_result_add" #5 0x00007f32d9eb0f30 in index_search_result_update_appends (result=result@entry=0x55b332a1f8e0, old_messages_count=<optimized out>) at index-search-result.c:168 t = 0x55b332a417d0 search_ctx = 0x55b332a1a580 mail = 0x55b332ae8e58 search_arg = {next = 0x55b332a7c0a0, type = SEARCH_SEQSET, value = {subargs = 0x0, seqset = { arr = {buffer = 0x55b3329da360, element_size = 8}, v = 0x55b3329da360, v_modifiable = 0x55b3329da360}, str = 0x0, time = 0, size = 0, flags = 0, search_flags = (unknown: 0), date_type = 0, thread_type = MAIL_THREAD_NONE, modseq = 0x0, search_result = 0x0, mime_part = 0x0}, initialized = {search_args = 0x0, keywords = 0x0, mailbox_glob = 0x0}, context = 0x0, hdr_field_name = 0x0, match_not = 0, match_always = 0, nonmatch_always = 0, fuzzy = 0, no_fts = 0, result = -1} message_count = 160 ret = <optimized out> __FUNCTION__ = "index_search_result_update_appends" #6 0x00007f32d9ebbc37 in search_result_update (result=0x55b332a1f8e0, ctx=0x55b332a2ed90) at index-sync-search.c:78 No locals. #7 index_sync_search_results_update (ctx=ctx@entry=0x55b332a2ed90) at index-sync-search.c:88 results = 0x55b332a3b4a0 i = <optimized out> count = <optimized out> #8 0x00007f32d9ebc4b4 in index_mailbox_sync_deinit (_ctx=0x55b332a2ed90, status_r=0x55b332a1f858) at index-sync.c:353 ctx = 0x55b332a2ed90 sync_rec = {seq1 = 0, seq2 = 0, type = MAILBOX_SYNC_TYPE_EXPUNGE} delayed_expunges = true ret = <optimized out> #9 0x00007f32d9e9e400 in mailbox_list_index_sync_deinit (ctx=0x55b332a2ed90, status_r=0x55b332a1f858) at mailbox-list-index.c:976 ibox = 0x55b332a3f990 box = 0x55b332a3b098 #10 0x00007f32d9e3b568 in mailbox_sync_deinit (_ctx=<optimized out>, status_r=<optimized out>) at mail-storage.c:1953 ctx = <optimized out> box = <optimized out> errormsg = <optimized out> error = MAIL_ERROR_NONE ret = <optimized out> #11 0x000055b33188c431 in imap_sync_finish (ctx=ctx@entry=0x55b332a1f7e0, aborting=aborting@entry=false) at imap-sync.c:279 client = 0x55b3329fb6a8 ret = 0 #12 0x000055b33188cfed in imap_sync_more (ctx=0x55b332a1f7e0) at imap-sync.c:594 str = <optimized out> ret = 1 __FUNCTION__ = "imap_sync_more" #13 0x000055b33188d676 in cmd_sync_continue (sync_cmd=0x55b3329fce58) at imap-sync.c:629 cmd = 0x55b3329f5b20 prev = <optimized out> client = 0x55b3329fb6a8 ctx = 0x55b332a1f7e0 ret = <optimized out> __FUNCTION__ = "cmd_sync_continue" #14 0x000055b33188db34 in cmd_sync_client (sync_cmd=0x55b3329fce58) at imap-sync.c:720 ctx = <optimized out> flags = <optimized out> client = 0x55b3329fb6a8 imap_flags = <optimized out> no_newmail = <optimized out> #15 cmd_sync_delayed_real (client=0x55b3329fb6a8) at imap-sync.c:833 cmd = <optimized out> first_expunge = <optimized out> first_nonexpunge = <optimized out> #16 cmd_sync_delayed (client=client@entry=0x55b3329fb6a8) at imap-sync.c:841 _data_stack_cur_id = 3 #17 0x000055b331873707 in client_input_append (cmd=0x55b3329fce58) at cmd-append.c:121 ctx = 0x55b3329fcff0 client = 0x55b3329fb6a8 reason = <optimized out> finished = <optimized out> lit_offset = <optimized out> __FUNCTION__ = "client_input_append" #18 0x00007f32d9b72be2 in io_loop_call_io (io=0x55b3329f5c70) at ioloop.c:600 ioloop = 0x55b3329e29c0 t_id = 2 __FUNCTION__ = "io_loop_call_io" #19 0x00007f32d9b742cf in io_loop_handler_run_internal (ioloop=ioloop@entry=0x55b3329e29c0) at ioloop-epoll.c:223 ctx = 0x55b3329e44e0 events = <optimized out> list = 0x55b3329e5f40 io = <optimized out> tv = {tv_sec = 3, tv_usec = 487057} events_count = <optimized out> msecs = <optimized out> ret = 1 i = 0 call = <optimized out> __FUNCTION__ = "io_loop_handler_run_internal" #20 0x00007f32d9b72c7c in io_loop_handler_run (ioloop=ioloop@entry=0x55b3329e29c0) at ioloop.c:649 No locals. #21 0x00007f32d9b72e38 in io_loop_run (ioloop=0x55b3329e29c0) at ioloop.c:624 __FUNCTION__ = "io_loop_run" #22 0x00007f32d9af7c03 in master_service_run (service=0x55b3329e2860, callback=callback@entry=0x55b33188de30 <client_connected>) at master-service.c:724 No locals. #23 0x000055b331873262 in main (argc=1, argv=0x55b3329e25f0) at main.c:484 set_roots = {0x55b331a9e700 <imap_setting_parser_info>, 0x7f32da3475a0, 0x0} login_set = {auth_socket_path = 0x55b3329da048 "\001", postlogin_socket_path = 0x0, postlogin_timeout_secs = 60, callback = 0x55b33188e600 <login_client_connected>, failure_callback = 0x55b33188df40 <login_client_failed>, request_auth_token = 1} service_flags = <optimized out> storage_service_flags = <optimized out> username = 0x0 auth_socket_path = <optimized out> c = <optimized out> Dovecot version: dovecot-2.2.36-3.el7.x86_64 I would like to ask for your inputs regarding this.Thank you very much for your help! Regards,Marvin

1 0

Bug with latest GCC 9
by Martin Liška 29 Jul '19

29 Jul '19

Hi. As mentioned here: https://bugzilla.opensuse.org/show_bug.cgi?id=1123136 there's a new issue with GCC 9, it's related to: https://gcc.gnu.org/gcc-9/porting_to.html#complit in: /* Not const! Never return this as a result directly! */ #define SMTP_ADDRESS_LITERAL(localpart, domain) \ &((struct smtp_address){ (localpart), (domain) }) Thanks, Martin

2 4

sieve scripts not synching for 2.3.5.1 pre-built
by Jan-Pieter Cornet 28 Jul '19

28 Jul '19

Hi, We're synching mailboxes, changing format from maildir to mdbox, using doveadm backup/doveadm sync. When still running 2.2.36, 'doveadm backup' also synched the sieve scripts, without issues. After the upgrade to 2.3.5.1, the sieve sync stopped working. We're using the pre-built 2.3 packages from https://repo.dovecot.org/ce-2.3-latest/debian/stretch In fact, when I now remove the dovecot-2.3 packages, and use my own old 2.2.36 packages, using the exact same config, the sieve scripts are being copied again. In 2.2.36, when I migrate a mailbox, I do see Pigeonhole being initialized. Eg: userimap-dev1:~ # doveadm -D backup -u xtra30 "doveadm -D dsync-server -u xtra30+mdbox=.8d1&4&03&xtra30" (note: that strange destination user signals to the auth proxy that we want the new mdbox storage instead of the default for this user) Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib02_lazy_expunge_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_user_module (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so [...skipping a bunch of lines...] dsync-local(xtra30): Debug: brain M: Mailbox Spam: local=88b39d12998d9e5cbb700000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30): Debug: brain M: Mailbox Test: local=801bb932e98d9e5c3d6d0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30): Debug: brain M: Mailbox Trash: local=fc9b162b86479f5cc85a0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-remote(xtra30): Debug: brain S: Skipping unchanged mailbox e7c1961d84479f5c885a0000436edcce dsync-local(xtra30): Debug: doveadm-sieve: Iterating Sieve mailbox attributes dsync-local(xtra30): Debug: sieve: Pigeonhole version 0.4.24 () initializing dsync-local(xtra30): Debug: sieve: include: sieve_global is not set; it is currently not possible to include `:global' scripts. dsync-local(xtra30): Debug: sieve: file storage: Using active Sieve script path: /var/mail/.8d1/index/7/oldsieve/x/xt/xtra30/dovecot.sieve [... skipping a lot of sieve debug lines that seem fine ...] dsync-remote(xtra30): Debug: sieve: file script: Opened script `xtra30-testfilter' from `/var/mail/.8d1/index/4/03/xtra30/sieve/scripts/xtra30-testfilter.sieve' dsync-remote(xtra30): Debug: doveadm-sieve: Assigned value for key `vendor/vendor.dovecot/pvt/server/sieve/default' (last change: 2019-03-29 22:27:41) dsync-remote(xtra30): Debug: brain S: Import INBOX: Import attribute vendor/vendor.dovecot/pvt/server/sieve/default: Nonexistent locally dsync-remote(xtra30): Debug: brain S: Import INBOX: Last common UID=0. Delayed expunges= dsync-remote(xtra30): Debug: brain S: Import INBOX: Import change type=save GUID=1553894809.M254847P28859.userimap11.xs4all.net,S=1311,W=1342 UID=1 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found [...] Afterwards, the sieve scripts have been transferred, even including last-modified time of any scripts. However, with 2.3.5.1, it seems doveadm-sieve is never called from dsync. Output includes: userimap-dev1:~ # doveadm -D backup -u xtra30 "doveadm -D dsync-server -u xtra30+mdbox=.8d1&4&03&xtra30" Debug: Loading modules from directory: /usr/lib/dovecot/modules Debug: Module loaded: /usr/lib/dovecot/modules/lib02_lazy_expunge_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib10_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/lib20_zlib_plugin.so Debug: Loading modules from directory: /usr/lib/dovecot/modules/doveadm Debug: Skipping module doveadm_acl_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_acl_plugin.so: undefined symbol: acl_lookup_dict_iterate_visible_next (this is usually intentional, so just ignore this message) Debug: Skipping module doveadm_expire_plugin, because dlopen() failed: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_expire_plugin.so: undefined symbol: expire_set_deinit (this is usually intentional, so just ignore this message) Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_quota_plugin.so Debug: Module loaded: /usr/lib/dovecot/modules/doveadm/lib10_doveadm_sieve_plugin.so [... skipping some lines again ..] dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Spam: local=88b39d12998d9e5cbb700000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Test: local=801bb932e98d9e5c3d6d0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-local(xtra30)<SCSfIc5Wo1zTKAAAsPW7qw>: Debug: brain M: Mailbox Trash: local=fc9b162b86479f5cc85a0000436edcce/0/1, remote=00000000000000000000000000000000/0/0: mailbox not selectable yet dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Skipping unchanged mailbox e7c1961d84479f5c885a0000436edcce dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Import INBOX: Last common UID=0. Delayed expunges= dsync-remote(xtra30)<h8hfIs5Wo1zWKAAAsPW7qw>: Debug: brain S: Import INBOX: Import change type=save GUID=1553894809.M254847P28859.userimap11.xs4all.net,S=1311,W=1342 UID=1 hdr_hash= result=Mail's UID is above local UIDNEXT - No more local mails found [...] In the above output from 2.3.5.1, all lines starting with "Debug: doveadm-sieve: Iterating Sieve mailbox attributes" are absent. I have no idea why. We can "work around" it by explicitly doing an rsync of the sieve storage after the migration, but that's a bit of a hack. Attached is a doveconf -n output for 2.3.5.1. -- Jan-Pieter Cornet <johnpc(a)xs4all.net> Systeembeheer XS4ALL Internet bv www.xs4all.nl

6 7

IMAP copy stopped copying flags
by Andrzej A. Filip 28 Jul '19

28 Jul '19

Is it intended behavior? It seems to be caused by upgrade to 1:2.3.2-2 on Debian/Testing. -- A. Filip

4 6

submission configuration issues
by Jean-Daniel Dupas 28 Jul '19

28 Jul '19

Hello, I'm having trouble configuring the submission proxy. I have configured the submission service as follow: submission_host = smtp.example.com submission_relay_host = localhost submission_relay_port = 8587 submission_relay_rawlog_dir = /var/log/dovecot/ submission_relay_trusted = yes My main issue is that until I login, dovecot-submission won't connect to the backend and query the capabilities and so won't report the right capabilities. That mean that the first EHLO message don't get the right capabilities list. " EHLO example.com 250-smtp.example.com 250-8BITMIME 250-AUTH PLAIN LOGIN 250-BURL imap 250-CHUNKING 250-ENHANCEDSTATUSCODES 250-SIZE 250 PIPELINING " This list don't contains VRFY, DNS, and SIZE is not specified (all of these is present in backend EHLO response). After login, if I send an new EHLO command, everything is properly reported. The raw log shows that unlike what the documentation says, dovecot don't try to connect to the backend until the user is properly logged. In my raw log I show that after I logged in dovecot-submission, the later open a connection to the backend and send a X-CLIENT command. Now, if I try to force the capabilities by using: submission_backend_capabilities = VRFY 8BITMIME DSN dovecot properly reports all SMTP capabilities in the first EHLO response, but it completely stops emitting X-CLIENT command to the backend and try to simply forward the command without authentication, which result in postfix rejecting the command with an unauthorized user error. What is wrong with my configuration ? Thanks. Jean-Daniel

4 7

Help with IMAP IDLE
by Jorge Bastos 28 Jul '19

28 Jul '19

Hi, I'm becaming crazy about this! I've asked before, not no matter what i do or conf, never works. How can i make IDLE work for real with MSOutlook, so that i can receive emails when they arrive, instead of changing folder/get out and in my account? Here's my conf, should it be reflected in postconf -n (is it the running conf?): ================== root@fastmail:/etc/dovecot# grep -ir idle * conf.d/20-imap.conf.ucf-dist:# If nothing happens for this long while client is IDLEing, move the connection conf.d/20-imap.conf.ucf-dist:# IDLEing. conf.d/20-imap.conf.ucf-dist:#imap_idle_notify_interval = 2 mins conf.d/20-imap.conf:imapc_max_idle_time = 1440 mins conf.d/20-imap.conf:# IDLEing. conf.d/20-imap.conf:#imap_idle_notify_interval = 2 mins conf.d/20-imap.conf:imap_idle_notify_interval = 1 min conf.d/20-imap.conf:#imap_client_workarounds = outlook-idle conf.d/10-mail.conf.ucf-dist:# When IDLE command is running, mailbox is checked once in a while to see if conf.d/10-mail.conf.ucf-dist:#mailbox_idle_check_interval = 30 secs conf.d/10-mail.conf:# When IDLE command is running, mailbox is checked once in a while to see if conf.d/10-mail.conf:#mailbox_idle_check_interval = 30 secs root@fastmail:/etc/dovecot# postconf -n|grep -i idle root@fastmail:/etc/dovecot#

7 16

Since multiple ,matches
by ＠lbutlr 27 Jul '19

27 Jul '19

I have a rule in sieve like the following: if anyof (header :contains ["to"] [ "box", "change", "cornell”, “twitter”]) { setflag "\\Seen"; fileinto :create "misc"; stop; } The messages that come in are using address extensions, so user+twitter(a)example.com, for example. The trouble is, this sieve recipe doesn’t get triggered and the message gets filed into the extension folder “twitter” or “cornell” instead of “misc”. I have a very similar recipe following that one: if header :contains "to" "root" { setflag "\\Seen"; addflag "$label5"; fileinto :create "root"; stop; } And that one works as I expect. Is that multiple match format valid for :contains (I’ve only seen it used for :regex)? I don’t get an error. Is there a way to run a debug log for the sieve recipe? Preferably for a single user. -- Vernon: Now this is the thought that wakes me up in the middle of the night. That when I get older, these kids are going to take care of me Carl: I wouldn't count on it.

1 1

Re: Dovecot, FreeBSD, and Solr?
by J. de Meijer 27 Jul '19

27 Jul '19

> Hello, > > Does anyone have this combination going? I'm running freebsd and dovecot, to which i'd like to add solr text search. I am stuck on xml schema integration, if anyone has any notes i'd appreciate them. I basically followed https://www.c0ffee.net/blog/mail-server-guide/ And dovecot with solr is running fine on freebsd for me.

3 3

corrupt mdbox index / zero mails showing in imap
by Mike 27 Jul '19

27 Jul '19

Hi, I have recently migrated (under emergency conditions) a dovecot imap/pop based server to a new instance. The mailboxes used mdbox format and due to various screwups I had corrupt indexes. I thought I'd cleaned this up but then I found that this new instance hadn't been set up correctly for nfs. Long story short, I still get users with new cases of corrupt indexes. The symptom is imap either showing NO mail in their inbox, or, not showing any recently delivered mail in the box, until I rm -f dovecot.map.index / doveadm force-resync -u user. It would be a huge help if there could be some method to detect if this is the case for any given user and to proactively do the force-resync process for them instead of waiting for that support call (or service cancellation...). I have looked around and have not found any tool capable of 'linting' an mdbox format inbox, and it seems like something like this should have been or would be an extremely useful debugging tool both during development as well as to troubleshoot stuff in the field. I would love to know if anyone either has such a tool, or any general suggestion how I could go about finding these cases and addressing them. I believe I have the nfs issue resolved and will not be creating new cases, so I just want to fix the ~3000 boxes I have now and move forward. Thank you. Mike-

2 2