August 2019 - dovecot

Dovecot and Oauth
by Michael Hallager 20 Aug '19

20 Aug '19

Hi all, I am considering expanding a mail server to support Oauth with Google. I have read through the following: https://wiki.dovecot.org/PasswordDatabase/oauth2 however, it doesn't work and appears to me to be missing important information, the least of which is API authorisation. Searching with Google, I can't find any more information beyond what amounts to C&P'ing of the above link. Has anyone successfully deployed Oauth with Google and could they please send me their config files? Thanks, Michael

2 1

Dovecot and hard links?
by ＠lbutlr 18 Aug '19

18 Aug '19

I was looking at a mail folder and I noted that a file in the inbox had a total of 11 hard links to it: 👹 # exa -lH cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl .rw------- 11 8.6k vpopmail 19 Jul 19:59 cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl 👹 # find . -samefile cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl [6:59] [/usr/local/virtual/kreme(a)kreme.com/Maildir] ./.Junk/cur/1564253637.M808919P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253637.M808920P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977674P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977675P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564253723.M977676P50422.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1563587951.M591499P47868.mail.covisp.net,S=8572,W=8738:2, ./.Junk/cur/1564851795.M381461P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564851795.M381462P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Junk/cur/1564852369.M760020P10380.mail.covisp.net,S=8572,W=8738:2,bc ./.Trash/cur/1563587951.M591499P47868.mail.covisp.net,S=8572,W=8738:2,S ./cur/1564249738.M167990P53982.mail.covisp.net,S=8572,W=8738:2,Sgl A bit of background: a few weeks ago I had thousands of files in the mail store that had hundreds of links, and I got that all cleaned up through juggling some grep and awk to delete all but one of the linked files. I figured this was caused by something I’d done when I moved local users into being virtual users and eliminated pam authentication in favor of sql. But this gives me pause. I think it’s normal for a file in the INBOX that is marked as junk or as deleted to have a single hard link (or at least it is since the default was set to maildir_copy_with_hardlinks), but 11? And when do these hard links get cleaned off? If I delete the trashed and junked messages, when does dovecot go through and removed the linked files in the cur/ folder? (It’s not immediate, I trashed those copies in Junk and Trash and the original file is still in the cur folder) -- There is nothing so stupid that some person somewhere will not, with earnestness, say it.

3 5

Re: Submission and TLS client certificate
by Christian Rößner 18 Aug '19

18 Aug '19

Hi, > Am 18.08.2019 um 16:52 schrieb Stephan Bosch via dovecot <dovecot(a)dovecot.org>: > > > >>> On 18/08/2019 10:09, Christian Rößner via dovecot wrote: >> Hi, >> is there some configuration parameter in Dovecot, which sends a TLS client certificate to the SMTP server? I would need this to have XCLIENT enabled and TLS with Postfix. This way I could permit sending based on the certificates fingerprint. > > Can you elaborate? Are you talking about the submission relay service or submission of outgoing messages from e.g. Sieve? The submission relay service. I like the idea of this service. Currently I did not activate the relay trust option, because I have no idea on how I could give permissions on the Postfix side. If Dovecot would send the certificate as reply to the smtpd_ask_ccert option, I could turn on XCLIENT in Dovecot and give permission based on the certificate fingerprint. At the moment I do STARTTLS from Dovecot to Postfix and have added Dovecot‘s IP to mynetworks in Postfix. But I would prefer XCLIENT. Thanks in advance Christian > > Regards, > > Stephan. > >> Thanks in advance >> Christian >> Von unterwegs aus gesendet >> -- >> Rößner-Network-Solutions >> Karl-Bröger-Str. 10, 36304 Alsfeld <x-apple-data-detectors://0/0> >> Fax: +49 6631 78823409 <tel:+49%206631%2078823409>, Mobil: +49 171 9905345 <tel:+49%20171%209905345> >> USt-IdNr.: DE225643613, https://roessner.website <https://roessner.website/> >> PGP Fingerprint: 8FB3 132F 85D8 C9C7 A9F1 9A3F 5183 D46C B885 897E

1 0

Submission and TLS client certificate
by Christian Rößner 18 Aug '19

18 Aug '19

Hi, is there some configuration parameter in Dovecot, which sends a TLS client certificate to the SMTP server? I would need this to have XCLIENT enabled and TLS with Postfix. This way I could permit sending based on the certificates fingerprint. Thanks in advance Christian Von unterwegs aus gesendet -- Rößner-Network-Solutions Karl-Bröger-Str. 10, 36304 Alsfeld Fax: +49 6631 78823409, Mobil: +49 171 9905345 USt-IdNr.: DE225643613, https://roessner.website PGP Fingerprint: 8FB3 132F 85D8 C9C7 A9F1 9A3F 5183 D46C B885 897E

2 1

exim+dovecot+sieve issue
by JM 18 Aug '19

18 Aug '19

Hi, We have mail server in production, with Exim + Dovecot + Mailman + OpenLDAP + Roundcube webmail server. Openldap keeps mail accounts in db, exim uses lmtp transport to deliver messages to dovecot. Mailman is responsible for mailing lists, Roundcube webmail has managsieve module to create sieve filters. Exim router,transport for dovecot > localuser: > driver = accept > domains = +local_domains : +virt_domains > check_local_user > transport = dovecot_lmtp > cannot_route_message = Unknown account > no_more > dovecot_lmtp: > driver = lmtp > socket = /var/spool/dovecot/lmtp > batch_max = 500 > rcpt_include_affixes It worked perfectly, but after upgrade from Dovecot 2.2 to Dovecot 2.3 major version, I've found a lot of strange errors in exim panic.log > mail exim[7821] Failed to get user name for uid 1175 > mail exim[7880]: Failed to get user name for uid 1173 etc where uids are ldap accounts and recognized by system (id 1175 shows user's name and group) Even worse, some clients start to receive notify email with strange content, when sending email to mailing lists > user(a)domain.com > Delay reason: error in redirect data: malformed address: > someuser1(a)domain.com may not follow someuser2(a)domain.com in " > someuser3(a)domain.com ..some crap here.." , where someuser addresses are > not related to recipient address and unknown for sender. After some investigation,I've found out that dovecot's sieve produces these errors (I suspect sieve vacation, when user creates vacation via Roundcube webmail). If set "submission_host = exim ip" in dovecot.conf, exim doesn't produce errors in panic.log anymore, but clients still receive email with malformed address. Please help me to find the root of the problem (some broken sieve filter in user's maildir, misconfiguration or breaking changes in new Dovecot version?) Current software Gentoo with 4.14.90 kernel Dovecot-2.3.7.1 Exim-4.92.1 Mailman 2.1.29 Openldap-2.4.47 Roundcube-1.3.8 Dovecot.conf attached Regards, Juri

2 1

2.3.7 + stats
by Matt Bryant 17 Aug '19

17 Aug '19

Is there any additional documentation/information around the new stats module. Have added some metrics just to see what they produce ## ## Metrics ### metric imap { event_name = imap_command_finished #source_location = example.c:123 #categories = fields = name args running_usecs bytes_in bytes_out #filter { # field_key = wildcard #} } metric sql { event_name = sql_query_finished } metric auth { event_name = auth_request_finished fields = user transport error successful } and get the following [root@stargate dovecot]# doveadm stats dump metric_name field count sum min max avg median stddev %95 imap duration 370 2007904499 130 62955249 5426768.92 2068 16436817.37 60026465 imap name 370 0 0 0 0.00 0 0.00 0 imap args 0 0 0 0 0.00 0 0.00 0 imap running_usecs 370 2007865330 81 62955127 5426663.05 1991 16436816.76 60026329 imap bytes_in 370 5366 2 173 14.50 8 19.04 35 imap bytes_out 370 2119971 0 941517 5729.65 41 53760.89 2082 sql duration 18 28991 991 2305 1610.61 1660 377.36 2305 auth duration 12 26046980 8146 7079879 2170581.67 847730 2457811.23 7079879 auth user 12 0 0 0 0.00 0 0.00 0 auth transport 12 0 0 0 0.00 0 0.00 0 auth error 0 0 0 0 0.00 0 0.00 0 auth successful 0 0 0 0 0.00 0 0.00 0 the main wiki page on stats/events doesnt really hold much detail whats stores for each event the above fields dont make much sense and top no longer works out of the box [root@stargate dovecot]# doveadm stats top usage: doveadm [-Dv] [-f <formatter>] stats <command> [<args>] dump [-s <stats socket path>] [-r] [-f <fields>] has is been removed ? do you need to specify something additional now ??? rgds Matt

3 2

James spooling messages problem
by Adam Raszkiewicz 16 Aug '19

16 Aug '19

For some reason my James setup is creating some kind of spooling queue of sending messages. It will queue 3 of them and then forth “sent” message will make 1st one to be sent outside. Any thoughts? Thanks -- Adam

1 0

SASL: encoded packet size too big
by Eugene 16 Aug '19

16 Aug '19

Hello! Dovecot uses it's own SASL implementation, doesn't it? Aug 14 23:45:23 example.com auth[10428]: GSSAPI client step 1 Aug 14 23:45:23 example.com auth[10428]: encoded packet size too big (813804546 > 65536) Aug 14 23:45:23 example.com dovecot[10085]: auth-worker(10428): Error: LDAP: Can't connect to server: ldap://ipa2.example.com Aug 14 23:45:23 example.com dovecot[10085]: auth: Error: auth worker: Aborted USER request for eugene: Lookup timed out Aug 14 23:45:23 example.com dovecot[10085]: imap: Error: auth-master: login: request [3847225345]: Login auth request failed: Internal auth failure (auth connected 60000 msecs ago, request took 60000 msecs, client-pid=10362 client-id=1) Looks like cyrus-sasl encountered same problem earlier. https://lists.andrew.cmu.edu/pipermail/cyrus-sasl/2017-March/003001.html I never have such an issue with ldapsearch. So, I assume there is a similar problem in Dovecot SASL implementation. -- Eugene Bright IT engineer Tel: + 79257289622

3 6

Re: Dovecot - Microsoft Azure AD
by Aki Tuomi 15 Aug '19

15 Aug '19

Hi! Dovecot supports Lua userdb, which can be used to implement custom user databases, maybe this might work for you? See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… for more details. Aki > On 15/08/2019 12:16 Lennart Boettcher <lennart.boettcher(a)secpoint.onmicrosoft.com> wrote: > > > Hello, > > Thank you for the quick reply. > > > > > > I have expressed myself wrongly. Our idea was to use the Azure-AD as userdb by doing the user lookup with the help of Microsoft's Graph API. OAuth2 would then of course only be the authorization procedure to access the user accounts using the Graph API. > > > > > > One would then implement a graph-userdb and no oauth-userdb. OAuth is, as you correctly mentioned, only an authorization mechanism. > > > > > > Here is a link to the GraphAPI: https://docs.microsoft.com/de-de/graph/api/overview?view=graph-rest-1.0 > > > And here is another link to the Graph Explorer, with which you can see how the GraphAPI works: https://developer.microsoft.com/en-us/graph/graph-explorer > > > > > We already use this procedure for the passdb lookup and it works very well. > > > > > Greetings > > Lennart Boettcher > > > > > ------------------------------ > > From: Aki Tuomi <aki.tuomi(a)open-xchange.com> > Sent: 14 August 2019 14:57 > To: Lennart Boettcher <lennart.boettcher(a)secpoint.onmicrosoft.com>; Lennart Boettcher via dovecot <dovecot(a)dovecot.org> > Subject: Re: Dovecot - Microsoft Azure AD > > > > On 14/08/2019 15:36 Lennart Boettcher via dovecot <dovecot(a)dovecot.org> wrote: > > > > > > > > Hello, > > > > I am currently trying to connect my Dovecot mail server to Microsoft's Azure-AD and use it as password and user database. I am using version 2.3.7.1. > > > > > > > > > > > > Using the Azure-AD as passdb already works. In this context I noticed that the scope implementation is not yet merged. > > > > > > > > > > > > Since I haven't found any hints for an OAuth2 userdb implementation yet, I wanted to ask if there are any plans for an implementation. > > > > > > > > > > Greetings > > > > Lennart Boettcher > > > > > > > > > > Dovecot 2.3 supports oauth2. I don't know how "oauth2 user database" would work, since oauth2 is an authentication mechanism. I suggest you use LDAP or static userdb, or set mail_* settings for user settings. > > Aki >

1 0

Dovecot not responding to external clients
by Edwin Humphries 15 Aug '19

15 Aug '19

Hi all I have Dovecot on my Linux-Mint workstation, running IMAP for the Thunderbird client thereon, but previously also for my phone and laptop clients as well. Since upgrading to Linux-Mint 19, however, although the Thunderbird client on the workstation works just fine, the other clients can't connect. I've disabled the firewall, and nmap shows the ports open, so it seems like some setting in the server. Can anyone help? > Dovecot version is 2.2.33.2 (d6601f4ec) > > dovecot -n output: > > # 2.2.33.2 (d6601f4ec): /etc/dovecot/dovecot.conf > # Pigeonhole version 0.4.21 (92477967) > # OS: Linux 4.15.0-55-generic x86_64 Linux Mint 19.1 Tessa > mail_location = mbox:~/mail:INBOX=/var/mail/%u > mail_privileged_group = mail > namespace inbox { > inbox = yes > location = > mailbox Drafts { > special_use = \Drafts > } > mailbox Junk { > special_use = \Junk > } > mailbox Sent { > special_use = \Sent > } > mailbox "Sent Messages" { > special_use = \Sent > } > mailbox Trash { > special_use = \Trash > } > prefix = > } > passdb { > driver = pam > } > protocols = " imap" > ssl_cert = </etc/dovecot/private/dovecot.pem > ssl_client_ca_dir = /etc/ssl/certs > ssl_key = # hidden, use -P to show it > userdb { > driver = passwd > } > -- Regards, Edwin Humphries

2 2