June 2021 - dovecot - dovecot.org

Multiple non-plaintext mechanisms using multiple passdbs.
by Jesús Ángel del Pozo Domínguez 17 Jun '21

17 Jun '21

Hi there, Although I have set up TLS in my Dovecot installation, I would like to also set up some non-plaintext authentication mechanism, specifically CRAM-MD5 and SCRAM-SHA-1. As I read in the documents, "The problem with non-plaintext auth mechanisms is that the password must be stored either in plaintext, or using a mechanism-specific scheme that’s incompatible with all other non-plaintext mechanisms". I will not be storing the user's passwords in plaintext, so I will have to use different mechanism-specific hash schemes. I was wondering whether it would be possible to have several auth databases, one for each non-plaintext mechanism. Well, in reality, I will have just one database with multiple hashes: SHA512-CRYPT, CRAM-MD5 and SCRAM-SHA-1 but then I am going to set up three different passdb instances in dovecot, each one with its own SQL configuration. For example: passdb { driver = sql args = /etc/dovecot/dovecot-sql-plain.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-cram-md5.conf.ext } passdb { driver = sql args = /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext } Most users would use TLS and PLAIN as authentication mechanism so the last two password databases will not be used at all. However, those users using CRAM-MD5 or SCRAM-SHA-1 would try the other databases. My users table would be somewhat like this: CREATE TABLE users ( username VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(77) NOT NULL, password_cram_md5 VARCHAR(74) NOT NULL, password_scram_sha_1 VARCHAR(100) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL, active CHAR(1) DEFAULT 'Y' NOT NULL ); username: foo(a)bar.com domain: bar.com password: {SHA512-CRYPT}$6$Mih5.y90z...CqxX2LxfMJMqoC42NvBK1 password_cram_md5: {CRAM-MD5}a457...2a74f63442e7473e9576cf2e password_scram_sha_1: {SCRAM-SHA-1}4096,4...9AYjadouwXqiqc3UM= Obviously, the SQL query in each dovecot-sql-....ext file would be different. For instance: /etc/dovecot/dovecot-sql-plain.conf.ext default_pass_scheme = SHA512-CRYPT password_query = \ SELECT username, domain, password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-cram-md5.conf.ext default_pass_scheme = CRAM-MD5 password_query = \ SELECT username, domain, password_cram_md5 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' /etc/dovecot/dovecot-sql-scram-sha-1.conf.ext default_pass_scheme = SCRAM-SHA-1 password_query = \ SELECT username, domain, password_scram_sha_1 AS password, home AS userdb_home, uid AS userdb_uid FROM users WHERE username = '%n' AND domain = '%d' Could you please tell me whether this set up would work? Do you believe is worth the complexity or maybe I had better keep it more simple and use just PLAIN auth with TLS? Cheers, Jesús Ángel

1 0

Mapping usernames used for authentication to UNIX usernames
by Frank Volf 17 Jun '21

17 Jun '21

Hi, I'm looking for some advice or pointers how to best solve a small problem that I have. I have no doubt that this can be done in dovecot, but I'm struggling to find the easiest way to implement it. First of all, what I have: I have a relative small dovecot setup for a dozen domains, and about 50 users in total. All users use IMAP to retrieve mail, and SMTP submission protocol to submit email. Because of the small size, every user has its own UNIX account, authentication is done using PAM and mail is stored in a Maildir folder in their home directory. Works perfectly! There is one minor inconvenience. When a new mail client is configured, users (often guided by the auto config generator of the mail client) tend to use their email address as the username to authenticate instead of their UNIX account name, which fails of course. Would it be possible to configure something that will map an email address to the UNIX account name and use the account name for authentication and obtaining the related information (uid, gid, home dir)? I do have two concerns: 1) I do not want to break existing mail configurations, so authentication with the UNIX username should still be possible. 2) I cannot do a simple reg. exp for the translation because every email domain has e.g. an info(a)domain.com mailbox, and I do not want them all to go to UNIX user "info". As said, I would appreciate any advice on how this can be configured the easiest. Thanks in advance. Kind regards, Frank

4 3

Re: N-way replication, multiple masters
by Henry 17 Jun '21

17 Jun '21

1 GB data per day is very little volume ,I think dovecot replication, rsync also suitable. Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:30:23 [GMT+8] 寫道： #yiv6469694122 #yiv6469694122 -- _filtered {} _filtered {} _filtered {} _filtered {} _filtered {}#yiv6469694122 #yiv6469694122 p.yiv6469694122MsoNormal, #yiv6469694122 li.yiv6469694122MsoNormal, #yiv6469694122 div.yiv6469694122MsoNormal {margin:0cm;font-size:11.0pt;font-family:sans-serif;}#yiv6469694122 a:link, #yiv6469694122 span.yiv6469694122MsoHyperlink {color:blue;text-decoration:underline;}#yiv6469694122 span.yiv6469694122EmailStyle19 {font-family:sans-serif;color:#1F497D;font-weight:normal;font-style:normal;}#yiv6469694122 .yiv6469694122MsoChpDefault {font-size:10.0pt;} _filtered {}#yiv6469694122 div.yiv6469694122WordSection1 {}#yiv6469694122 Hi Mail replication – honestly, I don’t have any hard metrics for that. I’m anticipating its less than 1 GB per day. Link speed – being AWS inter AZ its 100Mbps-1GBps. I’m conscious if I go inter region the strategy may need to change. Thanks Raymond From: Henry <hl1723(a)yahoo.com.hk> Sent: Thursday, 17 June 2021 3:20 PM To: Raymond Sellars <raymond.sellars(a)orionhealth.com> Subject: Re: N-way replication, multiple masters How many data for mail replication ? and the link speed? Raymond Sellars (<raymond.sellars(a)orionhealth.com>) 在 2021年6月17日星期四上午11:10:23 [GMT+8] 寫道：

1 0

N-way replication, multiple masters
by Raymond Sellars 17 Jun '21

17 Jun '21

Hi Looking for some guidance on how to setup a dovecot cluster with more than 2 servers. Ideally as multiple masters so I don't have the complexity of back recovery/synchronisation in failover situations. And I can utilised upstream load balancers (director or other) to automatically move between available nodes. Current pattern is: High availability at one site (AWS availability zone) with two active servers behind dovecot directors and an AWS network load balancer in front of the directors. A third dovecot server as a disaster recovery instance (another availability zone or region), with ideally real time and bidirectional replication. Behind a different network and NLB access path. Dovecot --version = 2.3.14 Centos 7 Previously for the HA pair we utilised NFS but the AWS EFS equivalent doesn't perform ( very high latency and NFS meta data caching required). And then for DR we utilised the dovecot replication. 2 way so I have automated recovery and could do active active testing/verification as required with no down time. This help verify recovery pathways. https://doc.dovecot.org/configuration_manual/replication/# - reading the documentation is seems clear that replication only supports a PAIR of masters. Any ideas on how I can add in a 3rd replication node? Two pairs? I'm happy to utilise a star pattern. HA 1 <-> HA2, HA 1 <-> DR. Not possible? Can I run more than one replicator? Or should I utilise doveadm sync via cron jobs and 2-way sync. Any thoughts, suggestions most welcome. How are others achieving > 2 clusters for dovecot servers supporting the same domain? Most of this is for availability rather than purely performance scaling. Thanks Raymond

1 0

working locally not externally, how to check what failed?
by Voytek Eymont 16 Jun '21

16 Jun '21

this morning I noticed not getting any email on remote to server mail client, though, in webmail/squirellmail on mail host there were new emails restarting with doveadm stop/dovecot 'fixed it' what could've gone wrong, what to look for in the logs ? thanks for any pointers long running dovecot/postfix/mysql setup dovecot --version 2.3.14 (cee3cbc0d)

1 0

Piping to doveadm pw
by Kevin N. 16 Jun '21

16 Jun '21

Hello everybody, I am using 'doveadm pw' from inside a bash script to generate the salted hash for a user provided password. I call it like: doveadm pw -s SHA256-CRYPT -u $user -p $password Is there any possible way to use piping (so it won't show up in ps for example) to pass the username and password to 'doveadm pw' instead of using arguments? Dovecot version: 2.3.14 Many thanks, Kevin

3 4

LMTP with hardlinks ?
by Vladislav Kurz 16 Jun '21

16 Jun '21

Hello, I'm looking for deduplication of mails via hardlinks during delivery. I.e. a mail that is sent to multiple recipients (to, cc, bcc) should be stored only once. I did some search and found only some non-complete information. dovecot-lda has a "-p path" option that does the delivery using symlinks if possible (i.e. same uid/gid and same filesystem). This is working by hand, but could not find any hints how to use this with postfix. Found only suggestion of a wrapper, that was probably never implemented - in this thread: https://dovecot.org/pipermail/dovecot/2008-June/031158.html In this message: https://dovecot.org/list/dovecot/2013-February/088540.html there is statement that: LMTP always delivers the mail to the first user. Then it tries to copy the first mail to the second user, because in some setups this can be done using hard links. I was not able to get this in my setup, and I'd like to know if this statement is really true. I have all mail in /var/vmail, all owned by vmail user, but still mail delivered to multiple users is duplicated. If this is really supposed to make hardlinks (which would be great), is there any way to debug it? E.g. see if the hardlink was attempted but failed for some reason, or if the message was delivered in the same LMTP session ? -- Best Regards Vladislav Kurz

1 1

lda to lmtp
by Laura Steynes 14 Jun '21

14 Jun '21

Hi, Although dovecot-lda serves us fine, we only average 8k messages an hour, peaking at 11k, over 4 machines (mostly for redundancy, we've run this fine on just 1 machine, but sometimes clamav makes things get upset, so we added some more especially since we are growing rapidly, we decided to see if lmtp would be of benefit, so far, we cant tell any difference, I guess it is only 120-130 messages a minute, maybe if we were doing 200 a minute we might see gain? The question is with lda we used postfix settings destination_recipient_limit=1, we have not added this with lmtp,is this needed?

6 9

sieve not updating headers?
by Daniel J. Luke 13 Jun '21

13 Jun '21

Hello, I've recently converted from using procmail as an lda to using lmtp+sieve (and it's overall great). My setup is currently doing post-queue spamassassin to pickup user rules (and to be substantially similar to how it worked before). It mostly works, but I get some mail forwarded from another host that also runs spamassassin, so the mail comes with X-Spam headers already set. I can see that my sieve_before script successfully sends the message off to spamc/spamd - however the message ends up in my mailbox with only the pre-existing X-Spam headers (I had expected them to be replaced or to see duplicates). I thought I'd try to just strip them from incoming mail so I used deleteheader, I got a trace saying it matches and deletes the headers, then sends the mail off to spamc/spamd - but the message that ends up in my mailbox has the headers that were presumably deleted. My before.sieve looks like this: require ["vnd.dovecot.filter","editheader"]; # rule:[spamfilter] if size :under 10485760 { deleteheader :matches "X-Spam-Flag" "*"; deleteheader :matches "X-Spam-Status" "*"; deleteheader :matches "X-Spam-Level" "*"; deleteheader :matches "X-Spam-Checker-Version" "*"; filter "spamc" ["-s","10485760","-U","/var/run/spamd.sock"]; } Trace file says: ## Started executing script 'before' 6: size :under test 6: comparing message size 4197 6: with lower limit 10485760 6: jump if result is false 6: not jumping 11: deleteheader command 11: deleting matching occurrences of header `X-Spam-Flag' 11: header `X-Spam-Flag' not found 12: deleteheader command 12: deleting matching occurrences of header `X-Spam-Status' 12: starting `:matches' match with `i;ascii-casemap' comparator: 12: matching value `No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DKIM_.. .' 12: with key `*' => 1 12: deleting header with value `No, score=-0.2 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALI D_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham au tolearn_force=no version=3.4.2' 12: finishing match with result: matched 13: deleteheader command 13: deleting matching occurrences of header `X-Spam-Level' 13: header `X-Spam-Level' not found 14: deleteheader command 14: deleting matching occurrences of header `X-Spam-Checker-Version' 14: starting `:matches' match with `i;ascii-casemap' comparator: 14: matching value `SpamAssassin 3.4.2 (2018-09-13) on braeburn.macports.org' 14: with key `*' => 1 14: deleting header with value `SpamAssassin 3.4.2 (2018-09-13) on braeburn.macports.org' 14: finishing match with result: matched 16: filter action 16: execute program `spamc' 16: executed program successfully 16: changed message ## Finished executing script 'before' It then falls through my personal sieve filter and hits the implicit keep at the end and ends up in my inbox - with the original headers. So, two questions: 1. What am I missing? 2. Is there a way to match any X-Spam-* header? (when I tried deleteheader :matches "X-Spam*" it didn't match anything). Thanks. -- Daniel J. Luke

4 6

Use of Sieve with Dovecot not possible cause of error
by DarkFish82 12 Jun '21

12 Jun '21

**What happened?** The description of the problem concerns the Thunderbird but also the stand alone version and other sieve editors. I would like to edit Sieve via the plugin/program. My mail account works without problems and can also send/receive. Creating a new account is possible without any problems. As soon as I click on "Connect", the loading bar is permanently there and nothing happens. I have activated debugging in the settings, but I don't know where it is saved. if someone tells me, I can submit the required log later. **Settings** Settings from Sieve: Server imap.xxxxxx.eu: 4190 (Secured connection) Username my(a)fancydomain.eu **Logs** dovecot-mailcow_1 | May 9 02:47:16 04888203e1b5 dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=92.123.123.123, lip=123.123.123.123, TLS handshaking: SSL_accept() failed: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate: SSL alert number 42 **What i tried?** 1. gnutls-cli --starttls -p 4190 imap.xxxxxx.eu Output: `Processed 129 CA certificate(s). Resolving "imap.xxxxxxxxx.eu:4190"... Connecting to "2a03:4000:34:522:981b:xxxx:xxxx:xxxx:4190"... Simple Client Mode: "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapflags notify imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready."` 2. telnet xxx.xxx.xxx.xxx 4190 output: Connected to xxx.xxx.xxx.xxx. Escape character is "^]". "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext vacation-seconds editheader imapflags notify imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Dovecot ready." 3. Added in dovecot.conf in "service managesieve-login" "ssl = no" and after that "ssl = true" but also not working. dovecot config: service managesieve-login { inet_listener sieve { port = 4190 ssl = no } inet_listener sieve_haproxy { port = 14190 haproxy = yes } service_count = 1 process_min_avail = 2 vsz_limit = 1G } **OS/Software Informations** Client Thunderbird: OS: Windows 10 Sieve Version: 0.5.3 Thunderbird Version: 78.11.0 Client Standalone: OS: Windows 10 Sieve Version: 0.5.2 Mailcow: OS: Ubuntu 20.04 Mailcow Versions: acme-mailcow (mailcow/acme:1.78) clamd-mailcow (mailcow/clamd:1.39) dockerapi-mailcow (mailcow/dockerapi:1.38) dovecot-mailcow (mailcow/dovecot:1.145) ejabberd-mailcow (mailcow/ejabberd:1.5) ipv6nat-mailcow (robbertkl/ipv6nat) memcached-mailcow (memcached:alpine) mysql-mailcow (mariadb:10.5) netfilter-mailcow (mailcow/netfilter:1.41) nginx-mailcow (nginx:mainline-alpine) olefy-mailcow (mailcow/olefy:1.7) php-fpm-mailcow (mailcow/phpfpm:1.74) postfix-mailcow (mailcow/postfix:1.61) redis-mailcow (redis:5-alpine) rspamd-mailcow (mailcow/rspamd:1.76) sogo-mailcow (mailcow/sogo:1.98) solr-mailcow (mailcow/solr:1.7) unbound-mailcow (mailcow/unbound:1.13) watchdog-mailcow (mailcow/watchdog:1.91) -- Sent from: http://dovecot.2317879.n4.nabble.com/

1 0