Upgrading from Dovecot Pro 3.1.x to Dovecot Pro 3.2.x
Dovecot Pro
- A passdb lookup returning an empty password now fails authentication instead of allowing login with an empty password. Passdb entries intended to have no fixed password should return the
nopasswordextra field (e.g.user:::::::nopassword=yesin a passwd-file) instead of an empty password field; any non-empty client password is then accepted. - An empty client-supplied password is now always rejected before the passdb lookup, for all passdb drivers. Previously only LDAP auth binds rejected it.
nopassworddoes not allow an empty client password either; only mechanisms that authenticate without a password (EXTERNAL via client certificate, OAuth2) are unaffected. - The EXTERNAL SASL mechanism now treats the client certificate as the authentication and no longer verifies any passdb password. Existing client-certificate setups (e.g. passwd-file entries with an empty password field) keep working. Passdbs that verify the password themselves no longer reject EXTERNAL logins either: e.g. an LDAP auth bind passdb attempts no bind - the lookup succeeds without verifying anything and only provides the extra fields, since the certificate already authenticated the user. For EXTERNAL logins
passdb { skip = authenticated }passdbs are now skipped andskip = unauthenticatedpassdbs run; if all passdbs are skipped, the login fails.
Changed Setting Defaults
These changes don't take effect until dovecot_config_version is changed to 3.2.0.
| Setting | Old Default | New Default | Notes |
|---|---|---|---|
service/fs-auth/client_limit | 0 | 16384 | |
service/metacache-worker/restart_request_count | 1 | 1000 | |
service/metacache-worker/process_limit | 0 | 500 | |
service/metacache/client_limit | 0 | $SET:service/auth/service_client_limit | |
@cluster_defaults/backend/service/cluster/process_min_avail | 0 | 1 | |
@cluster_defaults/proxy/service/cluster/process_min_avail | 0 | 1 | |
cluster_geodb/dict_proxy_idle_timeout | 0 | 1min | Only within the cluster_geodb filter; the global dict_proxy_idle_timeout default is unchanged |
@metric_defaults/proxy/metric | Adds proxy_session_established | ||
@fs_dictmap_defaults/cassandra/obox_track_copy_flags | no | yes | |
fs_azure_user_sas_user_bound | no | yes | |
fts_message_max_size | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
fts_search_read_fallback | yes | no | |
fts_dovecot_prefix | no | 3- | |
last_valid_gid | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
last_valid_uid | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
lazy_expunge_only_last_instance | no | yes | |
mail_attachment_detection_options | add-flags content-type=!application/signature(except for mbox, imapc, maildir) | ||
mail_access_groups | default_internal_group | ||
mail_cache_max_header_name_length | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
mail_cache_max_headers_count | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
mail_sort_max_read_count | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
mail_vsize_bg_after_count | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
passdb_default_password_scheme | PLAIN | CRYPT | |
sieve_quota_script_count | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
sieve_quota_storage_size | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
submission_max_recipients | 0 is not allowed anymore to mean unlimited use unlimited instead | ||
passdb_passwd_file/passdb_default_password_scheme | PLAIN | CRYPT | |
passdb_sql/passdb_default_password_scheme | PLAIN | CRYPT | |
service/doveadm/service_extra_groups | default_internal_group | ||
service/imap/service_extra_groups | default_internal_group | ||
service/imap-urlauth-worker/service_extra_groups | default_internal_group | ||
service/indexer-worker/service_extra_groups | default_internal_group | ||
service/lmtp/service_extra_groups | default_internal_group | ||
service/pop3/service_extra_groups | default_internal_group | ||
service/submission/service_extra_groups | default_internal_group | ||
service/managesieve/service_extra_groups | default_internal_group | ||
obox/mailbox_list_index_include_inbox | no | yes | See mailbox_list_index_include_inbox |
@mailbox_defaults/english/namespace/inbox/mailbox/Drafts/mailbox_auto | no | subscribe | |
@mailbox_defaults/english/namespace/inbox/mailbox/Junk/mailbox_auto | no | subscribe | |
@mailbox_defaults/english/namespace/inbox/mailbox/Sent/mailbox_auto | no | subscribe | |
@mailbox_defaults/english/namespace/inbox/mailbox/Trash/mailbox_auto | no | subscribe | |
unix_listener/anvil-auth-penalty/group | default_internal_group | The default mode is still 0 to disable anvil-auth-penalty, so this change shouldn't matter. | |
service/indexer-worker/service_restart_request_count | service_restart_request_count | 1000 | |
sieve_max_cpu_time | 0 (unlimited) | 30s |
Added Features
Site Reachability Checks
When configured with multiple sites, proxies need to execute site-reachability checks for the other sites. See Site reachability checks for more details.
| Feature | Notes |
|---|---|
cluster_proxy_check_sites setting | Setting was added |
Removed Features
| Feature | Notes |
|---|---|
acl_global_path setting | See ACL Settings Migration. |