September 2021 - dovecot

Looking for SNI feature
by Sherin A 10 Sep '21

10 Sep '21

Hello, I am looking for an alternative feature for SNI certificates in dovecout. Current dovecot need to integreate the sni codes into the configuration as follows, local_name imap.example.org { ssl_cert = </etc/ssl/certs/imap.example.org.crt ssl_key = </etc/ssl/private/imap.example.org.key } I have thousands of domain in the server. So during the ssl certificate creation of each domain , I need to add the codes to the configuration and reload the service. That looks not a suitable feature. So my question is Do dovecot have a feature to read the certificate of every domain from another service , let us say I have service that will send the above sni setting to a socket and dovecot read it from that socket. Kindly let me know if dovecot have any such feature exists. This feature may be like the authentication using dictionary proxy service ? -- Regards Sherin A

1 0

Failed to do incremental sync
by Andrea Gabellini 09 Sep '21

09 Sep '21

Hello, Two dovecot server with replication and version 2.3.10.1 Today i have many warnings like those: Sep 9 12:13:43 dovecot: doveadm: Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync (uidnext 4465 < 4517) Sep 9 12:13:56 dovecot: doveadm: Warning: Failed to do incremental sync for mailbox INBOX, retry with a full sync (Modseq 4016 no longer in transaction log (highest=4106, last_common_uid=3451, nextuid=3452)) Do you have some suggestions on how to debug this? Or something I can check? Thanks, Andrea -- __________________________ There were computers in Biblical times. Eve had an Apple. __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

2 2

Using %{ssl_security} in the policy server
by Andrea Gabellini 09 Sep '21

09 Sep '21

Hello, I am looking for a way to verify, at the moment of the connection, who does not use encryption or uses weak encryption. My choice was the use of the policy server because I would like to block only a certain number of users per day, so as not to overload the support service. In the call to the policy server, only tls = true / false is passed as information. I would also be interested in %{ssl_security} but it is not present among the usable variables. Is there any way, perhaps using userdb/passdb, to be able to pass this variable to the policy server? Thanks, Andrea -- __________________________ Seen it all, done it all, can't remember most of it __________________________ TIM San Marino S.p.A. Andrea Gabellini Engineering R&D TIM San Marino S.p.A. - https://www.telecomitalia.sm Via Ventotto Luglio, 212 - Piano -2 47893 - Borgo Maggiore - Republic of San Marino Tel: (+378) 0549 886237 Fax: (+378) 0549 886188 -- Informativa Privacy Questa email ha per destinatari dei contatti presenti negli archivi di TIM San Marino S.p.A.. Tutte le informazioni vengono trattate e tutelate nel rispetto della normativa vigente sulla protezione dei dati personali (Reg. EU 2016/679). Per richiedere informazioni e/o variazioni e/o la cancellazione dei vostri dati presenti nei nostri archivi potete inviare una email a privacy(a)telecomitalia.sm. Avviso di Riservatezza Il contenuto di questa e-mail e degli eventuali allegati e' strettamente confidenziale e destinato alla/e persona/e a cui e' indirizzato. Se avete ricevuto per errore questa e-mail, vi preghiamo di segnalarcelo immediatamente e di cancellarla dal vostro computer. E' fatto divieto di copiare e divulgare il contenuto di questa e-mail. Ogni utilizzo abusivo delle informazioni qui contenute da parte di persone terze o comunque non indicate nella presente e-mail potra' essere perseguito ai sensi di legge.

2 1

SSL errors after certificate renewal
by Amol Kulkarni 08 Sep '21

08 Sep '21

Hello, After I replaced my certificate with a new one yesterday, I'm seeing some ssl related errors. There are successful pop/imap logins using SSL also. So I think the certificate in itself is fine. No user has complained as yet, so I don't know for sure. However the count of errors has surely increased after installing the new certificate. There are 2 errors seen : dovecot: imap-login: Disconnected (no auth attempts in 1 secs): user=<>, rip=, lip =, TLS handshaking: SSL_accept() failed: error:14094416:SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown: SSL alert number 46, session=<9m0AnVnL 2pHf4hso> dovecot: imap-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=, lip =, TLS: SSL_read() failed: error:14094412:SSL routines:SSL3_READ_BYTES:sslv3 alert bad certificate: SSL alert number 42, session=<ww/b6VfLmeR7yTog> Kindly help with some pointers. Thanks and Regards, Amol

8 8

How can I always send a vacation response with sieve?
by Steve Dondley 07 Sep '21

07 Sep '21

I don't want dovecot to wait X days before sending out another vacation response. However, setting the :days to "0" doesn't work. RFC https://www.rfc-editor.org/rfc/rfc5230.html#section-4.1 says: 4.1. Days Parameter The ":days" argument is used to specify the period in which addresses are kept and are not responded to, and is always specified in days. The minimum value used for this parameter is normally 1. Sites MAY define a different minimum value as long as the minimum is greater than 0. Sites MAY also define a maximum days value, which MUST be greater than 7, and SHOULD be greater than 30. If ":days" is omitted, the default value is either 7 or the minimum value (as defined above), whichever is greater. If the parameter given to ":days" is less than the minimum value, then the minimum value is used instead. If ":days" exceeds the site-defined maximum, the site-defined maximum is used instead. Sorry if this is more of a sieve question and is slightly off topic.

5 7

Dovecot - FTS Solr: disk usage & position information?
by Vincent Brillault 07 Sep '21

07 Sep '21

Dear all, On a local dovecot cluster currently hosting roughly 2.1TB of data, using Solr as its FTS backend, we now have 256GB of data in Solr, split in 12 shard (to which replication adds 256GB of data through 12 additional cores). I'm now trying to see if we can optimize that data. Looking at one core at random (22G), I see that the data is split mostly between - .pos files: 12G - .tim files: 4.2G - .doc files: 3.8G - .cfs files: 1.8G Looking around a bit, I found https://lucene.apache.org/core/6_2_0/core/org/apache/lucene/codecs/lucene50… (which is unfortunately a bit outdated I think) that explains each file content: - .tim: Term Dictionary - .tip: Term Index - .doc: Frequencies and Skip Data - .pos: Positions - .pay: Payloads and Offsets So clearly the file naming convention have changed, but still if .pos is really position information ("lists of positions that each term occurs at within documents."), this sounds rather useless for the dovecot integration. Looking at Solr documentation on search (https://solr.apache.org/guide/8_6/the-standard-query-parser.html) it seems that position aware query are written as `"term1 term2"~[0-9]+`. Looking at the dovecot code (https://github.com/dovecot/core/blob/master/src/plugins/fts-solr/fts-backen…) I don't see this kind of query being made, `~` only being used for fuzzy search. Has anyone ever tried to set omitTermFreqAndPositions or omitPositions to true for the text fields in the Solr Schema? It sounds that this could improve a lot the disk space used by Solr without losing any feature. The only thing I'm not too clear about is the "autoGeneratePhraseQueries" which is enabled in https://github.com/dovecot/core/blob/master/doc/solr-schema-7.7.0.xml. Thanks in advance, Vincent Brillault PS: I have attached the schema we are using for completeness. It's based on the one in the dovecot repo, with a bit of simplification for headers that don't really require as much massaging.

3 7

Solr FTS - when does indexing happen?
by Shawn Heisey 05 Sep '21

05 Sep '21

I have Solr FTS on my dovecot install. I followed the instructions on the dovecot wiki. How long a delay should I expect to see between new mail being delivered with the dovecot LDA and an indexing request sent to Solr? Because I get a LOT of email from various mailing lists, and I do not see any activity in Solr's log. When I did doveadm index -A -q '*' there was a lot of indexing activity in Solr's log, as expected. One time I looked at the Solr index and it had been 23 hours since it's last update ... I can guarantee that I received a lot of new messages in that time. What do I need to look at for further troubleshooting? I can confirm that when I issue a search in the TypeApp app on my phone (an IMAP app for android), I see the query in Solr's logfile. Thanks, Shawn

2 4

Dovecot, Last Login Plugin and PostfixAdmin
by White, Daniel E. (GSFC-770.0)[NICS] 03 Sep '21

03 Sep '21

https://doc.dovecot.org/configuration_manual/lastlogin_plugin/ Is there any documentation about how to get the "Last Login" info into the PostfixAdmin database ?

2 1

100 MB RAM per clinet in an imap-proxy setup ...
by Tobias Oetiker 03 Sep '21

03 Sep '21

Hi All, I spent some quality time yesterday, tuning dovecot on a server which serves as an imap-proxy in front of a zimbra setup the imap proxy does ldap client-cert authentication and works well. BUT I found that the imap-login processes seem to gain 100 MB per connection they are accepting ... this seems pretty hefty. It does not seem to be a leak, since the setup is stable when client_limit and process_limit are set appropriately. Any ideas what part of the code I should be looking at ? Or is this a configuration problem ? cheers tobi -- Tobi Oetiker, OETIKER+PARTNER AG, Aarweg 15 CH-4600 Olten, Switzerland www.oetiker.ch tobi(a)oetiker.ch +41 62 775 9902

2 4

Using a DICT PROXY with SQL for AUTH
by dovecot＠ptld.com 02 Sep '21

02 Sep '21

https://doc.dovecot.org/configuration_manual/dict/#dict-sql https://doc.dovecot.org/configuration_manual/dict/#dict-proxy https://doc.dovecot.org/configuration_manual/dict/proxy/ I can't get the complete picture from these pages how to implement proxy with sql. I have direct sql setup now, how do i use this with proxy? passdb { driver = sql args = /etc/dovecot/mysql_login } userdb { driver = prefetch } /etc/dovecot/mysql_login: driver = mysql connect = host=/var/lib/mysql/mysql.sock dbname=redacted user=redacted password=redacted default_pass_scheme = redacted password_query = SELECT ... I feel like there is a disconnect. It says how to make a proxy service with service dict{} and it says put a dict name but where? And how do i connect my password_query to a dict? Or can you not use the proxy service for auth service? "The <destination dict> contains the dict name in the dict { .. } settings" service dict(1) { unix_listener dict(2) { mode = 0600 user = vmail } } What is the dict name, the first dict(1) or the second dict(2) or neither? Can you change "dict" in the service or unix_listner or does it always have to be "dict"? Can you use dict-async with sql?

1 0