February 2021 - dovecot

sieve_after seems to not bring any effect to life in dovecot 2.3.13 dovecot-pigeonhole-0.5.13
by Bug Report 26 Feb '21

26 Feb '21

dovecot 2.3.13 (89f716dc2) dovecot-pigeonhole-0.5.13 OS: FreeBSD amd64 12.2-RELEASE After following code ------ require ["copy"]; # rule:[redirect] if true { redirect :copy "mail(a)mail.com"; keep; } ------ (both with keep and without keep) is executed sieve_after seems to not execute at all. Same code together with sieve_after was working as supposed in earlier versions.

3 7

doveadm user '*' vs sssd: enumeration works only once
by Heiko Schlittermann 25 Feb '21

25 Feb '21

Hi, I've a quite simple setup using sssd (id_provider, auth_provider: AD), and dovecot. doveadm user * returns the full user list only once. A 2nd invocation of the same command within a small timeframe returns a subset of the local users only (the users I've in /etc/passwd with uid >= first_valid_uid). If I wait until the dovecot/auth worker processes are gone (or if I kill them), I get the full list again. Calling getent passwd repeateadly always returns the full list of users. Question: - [ ] unfortunate configuration (see attachment) - [ ] misbehaviour of sssd (more specifically its nss module) - [ ] misbehaviour of dovecot/auth processes? Dovecot: 2.3.4.1 (f79e8e7e4) Operating System: Debian GNU/Linux 10 (buster) Sssd: 1.16.30 Best regards from Dresden/Germany Viele Grüße aus Dresden Heiko Schlittermann -- SCHLITTERMANN.de ---------------------------- internet & unix support - Heiko Schlittermann, Dipl.-Ing. (TU) - {fon,fax}: +49.351.802998{1,3} - gnupg encrypted messages are welcome --------------- key ID: F69376CE -

2 8

doveadm copy not respecting quotas?
by MAREN ZUBIZARRETA 24 Feb '21

24 Feb '21

Hello: I have a problema with the quotas at my system with dovecot 2.3.9.2, y use: quota_rule5 = RECUPERADOS_VGTIC:ignore I want to be free of quota limits at that mailbox RECUPERADOS_VGTIC when copying messages from "lazy_expunge" folder To recover from backup I use doveadm copy: doveadm copy -u nppgiibi RECUPERADOS_VGTIC mailbox .BORRADOS_VGTIC/sent-mail ALL But when I do so, quota for this mailbox RECUPERADOS_VGTIC is not ignored, and it grows to 200% Is this a bug? Or there is something that I'm doing wrongly? Thanks for your help. Maren PD: My config file for quotas follows below: /etc/dovecot/conf.d/90-quota.conf # Quota mail_vsize_bg_after_count = 100 # Limits plugin { quota = count:User quota quota_rule = *:storage=10G #for backups and lazy expunge quota_rule3 = .BORRADOS:ignore quota_rule4 = Recuperados_VGTIC:ignore quota_rule5 = RECUPERADOS_VGTIC:ignore quota_rule6 = BORRADOS_VGTIC:ignore quota_rule7 = .BORRADOS_VGTIC:ignore # This is required quota_vsizes = yes } -----Mensaje original----- De: dovecot <dovecot-bounces(a)dovecot.org> En nombre de Aki Tuomi Enviado el: miércoles, 24 de febrero de 2021 8:37 Para: Mark Constable <markc(a)renta.net>; dovecot(a)dovecot.org Asunto: Re: LMDB support? > On 24/02/2021 08:15 Mark Constable <markc(a)renta.net> wrote: > > > Hi all, is there any way I could use LMDB for userdb and passdb lookups? You can use Lua userdb/passdb. See https://doc.dovecot.org/configuration_manual/authentication/lua_based_authe… Aki

1 0

LMDB support?
by Mark Constable 24 Feb '21

24 Feb '21

Hi all, is there any way I could use LMDB for userdb and passdb lookups?

2 1

Problem with fs:User quota: Postfix quota-status returns always DUNNO
by Niccolo Rigacci 23 Feb '21

23 Feb '21

I installed a mail server on a Debian GNU/Linux 10 Buster, which provide Dovecot 2.3.4.1. It works almost everything, but I'm unable to make the Postfix quota service to work as expected. First of all I verify that the Dovecot idea of quota is OK: doveadm quota get -u username(a)example.org Quota name Type Value Limit % User quota STORAGE 2752 3500 78 Then I ask the Postfix quota-status service: printf "recipient=username(a)example.org\nsize=3000000\n\n" \ | nc localhost 12340 action=DUNNO But a size of 3 Mb should trigger the "action=554 5.2.2 Quota exceeded" message. I find a workaround for this problem: just adding the following section will "fix" the problem: plugin { quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u } How the quota_over_flag_value is related to the quota over filesystem? Why should I add both the quota_over_flag_value AND the quota_over_script options? The script is executed always for each SMTP check (regardless of the quota_over_flag_value is FALSE or TRUE), obviously I provided a "do nothing" quota-warning script. Here the relevant parts of "dovecot -n" output: plugin { quota = fs:User quota:user quota_grace = 5%% quota_over_flag_value = FALSE quota_over_script = quota-warning mismatch %u quota_status_nouser = DUNNO quota_status_overquota = 554 5.2.2 Quota exceeded quota_status_success = DUNNO quota_warning = storage=90%% quota-warning 90 %u quota_warning2 = storage=80%% quota-warning 80 %u sieve = file:~/sieve;active=~/.dovecot.sieve sieve_before = ~/sieve_before.d/ sieve_extensions = +vnd.dovecot.filter sieve_filter_bin_dir = /usr/local/lib/dovecot/sieve-filter sieve_filter_socket_dir = sieve-filter sieve_plugins = sieve_extprograms } service quota-status { client_limit = 1 executable = quota-status -p postfix inet_listener { port = 12340 } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh unix_listener quota-warning { group = dovecot mode = 0666 user = dovecot } user = root } -- Niccolo Rigacci - http://www.rigacci.net/ Firenze/Prato - Italy Tel. Mobile: +39-327-5619352

1 0

Bug renaming folder hierarchies
by Klaus Steinberger 23 Feb '21

23 Feb '21

Hi, we discovered a major problem with renaming folders with subfolders testszenario: folders: test1 test1/test1-1 test1/test1-2 all 3 folders contain a test message after renaming the top level folder test1 to test2 following folders exist: test2 test2/test1-1 test2/test1-2 the subfolders test1-1 and test1-2 are empty, the top level folder contains the correct message. Now renmaing test2 back to test1: Alle folders again contain their messages. So this looks like during renaming the top level folder just the message references for the subfolders got lost, and with renaming back they are there again. I can reproduce this behavior both with thunderbird and Horde Webmail as a client, also it happens with a second different dovecot setup Here is the dovecot config: root@dmz-sv-dovecot ~]# dovecot -n # 2.3.13 (89f716dc2): /etc/dovecot/dovecot.conf # Pigeonhole version 0.5.13 (cdd19fe3) # OS: Linux 3.10.0-1160.15.2.el7.x86_64 x86_64 Scientific Linux release 7.9 (Nitrogen) nfs4 # Hostname: dmz-sv-dovecot.physik.uni-muenchen.de auth_cache_negative_ttl = 5 mins auth_cache_size = 10 M auth_cache_ttl = 5 mins auth_socket_path = /var/run/dovecot/auth-userdb auth_username_format = %Ln auth_verbose = yes default_client_limit = 32768 default_process_limit = 8192 dict { acl = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_uid = 8 imap_capability = +SPECIAL-USE imap_hibernate_timeout = 1 mins imapc_features = rfc822.size imapc_host = zarafa.physik.uni-muenchen.de imapc_user = %u lda_original_recipient_header = X-Original-To mail_fsync = always mail_location = mdbox:/var/vmail/%Lu:FULLDIRNAME=DbOx-mAiLs:UTF-8:VOLATILEDIR=/var/dovecot-volatile/%Lu:INDEX=/var/vmail/%Lu/indexes mail_nfs_index = yes mail_plugins = quota acl lazy_expunge fts fts_lucene mail_prefetch_count = 20 mail_server_admin = mailto:helpdesk@physik.uni-muenchen.de mail_server_comment = IMAP Server Fakultätfür Physik LMU München mailbox_list_index_very_dirty_syncs = yes managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext mbox_write_locks = fcntl metric imap_command { filter = event=imap_command_finished AND tagged_reply_state=OK group_by = cmd_name } metric imap_select_no { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply_state=NO } metric imap_select_no_notfound { filter = event=imap_command_finished AND cmd_name=SELECT AND tagged_reply="NO*Mailbox doesn't exist:*" } metric push_notifications { filter = event=push_notification_finished } metric storage_http_gets { filter = event=http_request_finished AND category=storage AND method=get } mmap_disable = yes namespace { list = children location = mdbox:/var/vmail/%%Lu:FULLDIRNAME=DbOx-mAiLs:INDEX=/var/vmail/%%Lu/indexes:INDEXPVT=/var/vmail/%%Lu/indexes.pvt:UTF-8 prefix = shared/%%n/ separator = / subscriptions = no type = shared } namespace { hidden = yes list = children location = mdbox:/var/vmail/%Lu/expunged:FULLDIRNAME=DbOx-mAiLs:UTF-8 prefix = .EXPUNGED/ separator = / subscriptions = no type = private } namespace inbox { inbox = yes location = mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } prefix = separator = / subscriptions = yes type = private } passdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile:/etc/dovecot/dovecot.acl acl_shared_dict = file:/var/vmail/dovecot-dicts/shared-mailboxes fts = lucene fts_lucene = whitespace_chars=@. lazy_expunge = .EXPUNGED/ lazy_expunge_only_last_instance = yes quota = dict:User quota::proxy::quota quota_grace = 10%% quota_rule = *:storage=1G quota_rule2 = Trash:storage=+100M quota_rule3 = Spam:storage=+100M quota_rule4 = .EXPUNGED:ignore recipient_delimiter = + sieve = file:/var/vmail/%Lu/sieve;active=/var/vmail/%Lu/dovecot.sieve sieve_vacation_use_original_recipient = yes } postmaster_address = postmaster(a)physik.uni-muenchen.de protocols = imap lmtp sieve sieve quota_full_tempfail = yes service auth { unix_listener auth-userdb { group = daemon mode = 0666 user = mail } } service dict { unix_listener dict { group = daemon mode = 0600 user = vmail } } service imap-hibernate { client_limit = 8192 unix_listener imap-hibernate { user = vmail } } service imap-login { process_min_avail = 6 service_count = 0 vsz_limit = 1 G } service imap-postlogin { executable = script-login -d /etc/dovecot/acl_groups.py user = $default_internal_user } service imap { executable = imap imap-postlogin process_limit = 8192 unix_listener imap-master { user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } process_min_avail = 0 service_count = 1 vsz_limit = 64 M } service managesieve { process_limit = 1024 } service stats { unix_listener stats-reader { group = dovecot mode = 0660 user = vmail } unix_listener stats-writer { group = dovecot mode = 0660 user = vmail } } ssl = required ssl_cert = </etc/pki/tls/certs/dmz-sv-dovecot-with-chain.crt.pem ssl_client_ca_file = /etc/ssl/certs/ca-bundle.crt ssl_dh = # hidden, use -P to show it ssl_key = # hidden, use -P to show it userdb { args = /etc/dovecot/dovecot-ldap.conf.ext driver = ldap } verbose_proctitle = yes protocol lmtp { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve } protocol lda { mail_plugins = quota acl lazy_expunge fts fts_lucene sieve syslog_facility = mail } protocol imap { mail_max_userip_connections = 20 mail_plugins = quota acl lazy_expunge fts fts_lucene imap_quota imap_acl lazy_expunge } protocol sieve { mail_max_userip_connections = 10 managesieve_implementation_string = Dovecot Pigeonhole managesieve_logout_format = bytes=%i/%o managesieve_max_compile_errors = 5 managesieve_max_line_length = 64 k

1 0

Some questions about mail_crypt setups
by deano-dovecot＠areyes.com 23 Feb '21

23 Feb '21

Some questions about mail_crypt setups I have global mail enecryption working nicely, and replication works nicely between two systems. The main problem is that the private and public keys are *right there* on the server in /etc/dovecot/private ... Fine for a completely controlled system, but not so fine when on a rented VPS etc. When are the keys read in by dovecot ? Are they ever read in again while dovecot is running, or does it cache them in ram until dovecot is restarted ? Would it be possible for dovecot to read the keys as output from a script ? I'm thinking of a small script that would reach out to an authentication service like Authy or Okta or similar. Admin gets an alert on their phone, taps OK, UNLOCK and the two keys are returned to the script, which then hands them back to dovecot and away it goes. The mail_crypt config normally contains > mail_crypt_global_private_key = </etc/dovecot/private/dovecot_crypt_privkey > mail_crypt_global_public_key = </etc/dovecot/private/dovecot_crypt_pubkey Perhaps add another variable like > mail_crypt_global_script = </etc/dovecot/private/dovecot_crypt_script That script would run and feed the two keys back into dovecot (no matter how it got to them). So I started looking into per-user/per-folder encryption to see how that would work, and I have that setup nicely too. The config looks like this > # /etc/dovecot/conf.d/99-mailcrypt.conf > #-------------------------------------- > mail_attribute_dict = file:%h/Maildir/dovecot-attributes > plugin { > mail_crypt_require_encrypted_user_key = yes > mail_crypt_save_version = 2 > mail_crypt_curve = secp521r1 > } > > # /etc/dovecot/dovecot-sql.conf.ext > #---------------------------------- > # CREATE TABLE IF NOT EXISTS `users` ( > # `username` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'localpart of email-address', > # `domain` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'domain-part of email-address', > # `name` varchar(64) character set utf8 collate utf8_bin NOT NULL COMMENT 'Full name of user', > # `password` varchar(128) character set utf8 collate utf8_bin NOT NULL COMMENT 'base64-encoded SHA512 hash of password', > # PRIMARY KEY (`username`,`domain`) > # ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='users'; > > driver = mysql > connect = host=/var/run/mysqld/mysqld.sock dbname=emailers user=dovecot password=RandomPassword > default_pass_scheme = SHA512-CRYPT > > password_query = SELECT username, password, '%w' AS userdb_mail_crypt_private_password, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' > > # For LDA: > user_query = SELECT '/var/mail/%d/%n' AS home, 'vmail' AS uid, 'vmail' AS gid FROM users WHERE username = '%n' AND domain = '%d' > > # For using doveadm -A: > iterate_query = SELECT username, domain FROM users Except that replication doesn't work due to the user password not being available. Actually, indexing fails too for the same reason. > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Failed to read mailbox INBOX mail UID=1 stream: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=fts indexing) > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Mail search failed: Internal error occurred. Refer to server log for more information. [2021-02-21 14:02:13] > > Feb 21 14:02:13 indexer-worker(testuser(a)example.com)<120846><l8W9BzWuMmAK2AEAqNyxgw:MyoJDDWuMmAO2AEAqNyxgw>: Error: Mailbox INBOX: Transaction commit failed: FTS transaction commit failed: transaction context (attempted to index 1 messages (UIDs 1..1)) > > Feb 21 14:02:13 dsync-local(testuser(a)example.com)<TGxiDTWuMmAN2AEAqNyxgw>: Error: Mailbox INBOX: UID=1: read() failed: read(/var/mail/example.com/testuser/Maildir/INBOX/new/1613934133.M132059P12… failed: Private key not available: Cannot decrypt key f64e7c12a60b3df12ebf865a70bec57fedd3e9b4fd98df93205f1096db14fda7: Cannot decrypt key eca099273f525ca46b2f5640253770ad19e0578543244d8cd34bde183e996bd5: Password not available (read reason=prefetch) What are the options here for providing the decryption password or key ? The user password is already stored in the mysql database as a SHA512-CRYPT so we don't want to store it unencrypted ... I saw the mail_crypt docs (https://doc.dovecot.org/configuration_manual/mail_crypt_plugin/) mention > mail_crypt_private_key - Private key to decrypt user's master key, can be base64 encoded I'm assuming that can just be a key generated with > openssl ecparam -name secp521r1 -genkey | openssl pkey but that leaves the situation almost the same as with a global key - they key is local on the system, though a bit better in that it's not just visible there as a simple file, it can be buried in the database. One could retrieve it with > password_query = SELECT username, password, privkey AS userdb_mail_crypt_private_key, '/var/mail/%d/%n' AS userdb_home, 'vmail' AS userdb_uid, 'vmail' AS userdb_gid FROM users WHERE username = '%n' AND domain = '%d' How are other people handling mail store encryption ? -- Dean Carpenter deano is at areyes dot com 203 six oh four 6644

4 3

doveadm sync different local vs remote account/mailbox name
by Gregory Sloop 22 Feb '21

22 Feb '21

I'm, trying to sync/backup mailboxes from a current dovecot instance to a new server. But the old server has real system accounts. The new server has virtual users. And the account/user-name is different. Example: Joe Sixpack is joes (on the old system) but is joes(a)sixpack.org (on the new system.) I'm using something like this to attempt the sync doveadm -o mail_fsync=never backup -R -u joes(a)sixpack.org imapc: This works from the new system, as it recognizes the user with a full @domain.com username - but the old system doesn't know who joes(a)sixpack.org is - and just wants joes. I don't see a way to specify the remote account username independently from the local one. What's the best way to handle this? TIA -Greg

1 1

BUG report
by Oleg Pyzin 22 Feb '21

22 Feb '21

Hello! I've compiled Dovecot on a macmini G4 PPC from ports, but couldn't launch it. When Dovecot is trying to launch it's stop launching because got an error. ------------- The error is: Feb 09 19:22:50 master: Panic: kevent(EV_ADD, READ, 21) failed: Invalid argument Feb 09 19:22:50 master: Error: Raw backtrace: 0 libdovecot.0.dylib 0x00216d58 askpass + 136 -> 1 libdovecot.0.dylib 0x00216e78 backtrace_get + 36 -> 2 libdovecot.0.dylib 0x00221fe8 i_set_debug_file + 248 -> 3 libdovecot.0.dylib 0x002220fc default_fatal_handler + 56 -> 4 dovecot 0x000039a0 dup2_append + 1884 -> 5 libdovecot.0.dylib 0x00221a8c i_panic + 120 -> 6 libdovecot.0.dylib 0x0022c13c io_loop_handle_add + 244 -> 7 libdovecot.0.dylib 0x0022f2c8 timeout_add_short + 416 -> 8 libdovecot.0.dylib 0x0022f574 io_add_to + 76 -> 9 dovecot 0x00007dd4 service_monitor_stop_close + 288 -> 10 dovecot 0x00008cdc services_monitor_start + 840 -> 11 dovecot 0x00004aa4 main + 3336 -> 12 dovecot 0x00003048 start + 68 ------------- dovecot -n: admin.MacPPC[/opt/local/var/log/dovecot] <467-7> $ sudo dovecot -n # 2.3.11.3 (): /opt/local/etc/dovecot/dovecot.conf # OS: Darwin 9.8.0 Power Macintosh hfs # Hostname: MacPPC.Dlink default_client_limit = 50 default_internal_group = _dovecot default_process_limit = 10 default_vsz_limit = 128 M info_log_path = /opt/local/var/log/dovecot/info listen = * log_path = /opt/local/var/log/dovecot/error login_plugin_dir = /opt/local/lib/dovecot mail_location = maildir:/private/srv/mail/%u namespace inbox { inbox = yes location = mailbox Drafts { special_use = \Drafts } mailbox Junk { special_use = \Junk } mailbox Sent { special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Trash { special_use = \Trash } prefix = } protocols = imap pop3 service imap { process_limit = 32 } service pop3 { process_limit = 32 } service submission { process_limit = 32 } ssl_cert = </etc/ssl/certs/dovecot.pem ssl_key = # hidden, use -P to show it userdb { driver = passwd }

2 1

Policy on folder's name and path's length
by Rupert Gallagher 22 Feb '21

22 Feb '21

Hello, Users can be really good at hanging everybody when you give them enough roope. I spotted a number of problems that I think are of interest to everybody and need mitigation. # length of path A busy Windows user wrote enough mail subfolders, and folder names with soo many characters, that exceed Windows maximum path length. To avoid taxing the mail server, their mail client (Thunderbird) is configured to keep a local copy of emails. I need to enforce a policy on the maximum path length they can create, and the maximum number of characters on any given folder name. # forbidden characters Another problem folder names was the presence of white spaces, note the plural, on both the beginning and end of folder names. For example, to emphasize the importance of folders, the user added white spaces in front of names: > Must be at the top > Very important > A bit less important >Normal stuff And to add insult to injury they wrote spaces at the end of folder names: > This is a folder name with two hidden spaces I need to enfoce a policy that forbids the use white spaces at the beginning and end of folder names, as well as the use of repeated characters: > ____ I spotted your policy and found this new trick # subfolders, everywhere... A user confused their IMAP account for a file system and mind map tool, so they created folders everywhere, including root folders at the same level of inbox, draft, junk, trash, and huge directories under inbox. I need to enforce a policy that allows the creation of folders only under /Archive. I think such policies make good sense on any dovecot server and should be enforced by default.

2 2