Upgrading from Dovecot Pro 3.1.x to Dovecot Pro 3.2.x

Dovecot Pro

• A passdb lookup returning an empty password now fails authentication instead of allowing login with an empty password. Passdb entries intended to have no fixed password should return the nopasswordextra field (e.g. user:::::::nopassword=yes in a passwd-file) instead of an empty password field; any non-empty client password is then accepted.
• An empty client-supplied password is now always rejected before the passdb lookup, for all passdb drivers. Previously only LDAP auth binds rejected it. nopassword does not allow an empty client password either; only mechanisms that authenticate without a password (EXTERNAL via client certificate, OAuth2) are unaffected.
• The EXTERNAL SASL mechanism now treats the client certificate as the authentication and no longer verifies any passdb password. Existing client-certificate setups (e.g. passwd-file entries with an empty password field) keep working. Passdbs that verify the password themselves no longer reject EXTERNAL logins either: e.g. an LDAP auth bind passdb attempts no bind - the lookup succeeds without verifying anything and only provides the extra fields, since the certificate already authenticated the user. For EXTERNAL loginspassdb { skip = authenticated } passdbs are now skipped and skip = unauthenticated passdbs run; if all passdbs are skipped, the login fails.

Changed Setting Defaults

These changes don't take effect until dovecot_config_version is changed to 3.2.0.

Setting	Old Default	New Default	Notes
service/fs-auth/client_limit	0	16384
service/metacache-worker/restart_request_count	1	1000
service/metacache-worker/process_limit	0	500
service/metacache/client_limit	0	$SET:service/auth/service_client_limit
@cluster_defaults/backend/service/cluster/process_min_avail	0	1
@cluster_defaults/proxy/service/cluster/process_min_avail	0	1
cluster_geodb/dict_proxy_idle_timeout	0	1min	Only within the cluster_geodb filter; the global dict_proxy_idle_timeout default is unchanged
@metric_defaults/proxy/metric		Adds proxy_session_established
@fs_dictmap_defaults/cassandra/obox_track_copy_flags	no	yes
fs_azure_user_sas_user_bound	no	yes
fts_message_max_size		0 is not allowed anymore to mean unlimited use unlimited instead
fts_search_read_fallback	yes	no
fts_dovecot_prefix	no	3-
last_valid_gid		0 is not allowed anymore to mean unlimited use unlimited instead
last_valid_uid		0 is not allowed anymore to mean unlimited use unlimited instead
lazy_expunge_only_last_instance	no	yes
mail_attachment_detection_options		add-flags content-type=!application/signature (except for mbox, imapc, maildir)
mail_access_groups		default_internal_group
mail_cache_max_header_name_length		0 is not allowed anymore to mean unlimited use unlimited instead
mail_cache_max_headers_count		0 is not allowed anymore to mean unlimited use unlimited instead
mail_sort_max_read_count		0 is not allowed anymore to mean unlimited use unlimited instead
mail_vsize_bg_after_count		0 is not allowed anymore to mean unlimited use unlimited instead
passdb_default_password_scheme	PLAIN	CRYPT
sieve_quota_script_count		0 is not allowed anymore to mean unlimited use unlimited instead
sieve_quota_storage_size		0 is not allowed anymore to mean unlimited use unlimited instead
submission_max_recipients		0 is not allowed anymore to mean unlimited use unlimited instead
passdb_passwd_file/passdb_default_password_scheme	PLAIN	CRYPT
passdb_sql/passdb_default_password_scheme	PLAIN	CRYPT
service/doveadm/service_extra_groups	default_internal_group
service/imap/service_extra_groups	default_internal_group
service/imap-urlauth-worker/service_extra_groups	default_internal_group
service/indexer-worker/service_extra_groups	default_internal_group
service/lmtp/service_extra_groups	default_internal_group
service/pop3/service_extra_groups	default_internal_group
service/submission/service_extra_groups	default_internal_group
service/managesieve/service_extra_groups	default_internal_group
obox/mailbox_list_index_include_inbox	no	yes	See mailbox_list_index_include_inbox
@mailbox_defaults/english/namespace/inbox/mailbox/Drafts/mailbox_auto	no	subscribe
@mailbox_defaults/english/namespace/inbox/mailbox/Junk/mailbox_auto	no	subscribe
@mailbox_defaults/english/namespace/inbox/mailbox/Sent/mailbox_auto	no	subscribe
@mailbox_defaults/english/namespace/inbox/mailbox/Trash/mailbox_auto	no	subscribe
unix_listener/anvil-auth-penalty/group		default_internal_group	The default mode is still 0 to disable anvil-auth-penalty, so this change shouldn't matter.
service/indexer-worker/service_restart_request_count	service_restart_request_count	1000
sieve_max_cpu_time	0 (unlimited)	30s

Added Features

Site Reachability Checks

When configured with multiple sites, proxies need to execute site-reachability checks for the other sites. See Site reachability checks for more details.

Feature	Notes
cluster_proxy_check_sites setting	Setting was added

Setting Type Changes

• New file path and directory path setting types: a leading ~/ in the value is expanded to the user's home directory, and directory paths also drop a trailing /. The mail location *_path settings and the rawlog directory settings use these types now. The following settings previously used a ~/ prefix literally; it is now expanded (or fails, if no user home is available):

  • rawlog_dir (imap, pop3, submission and managesieve)
  • http_client_rawlog_dir
  • http_server_rawlog_dir

• doveconf output no longer drops a trailing / from mail_path and the other directory path settings; the value is shown as written in the configuration.

Changed Features

Metacache Rescan

The metacache rescan was redesigned. For detailed information on how the new rescan works, see Obox Administration: Metacache Rescan. The changes are:

• Users' metacache directories are located based on the mail_home (and mail_chroot) template instead of searching the filesystem for .opened files. The metacache service fails to start if mail_home doesn't fulfill the requirements now described in the mail_home setting. Previously an unusable mail_home silently disabled the rescan.
• A user's index directory outside the directory structure expected by the mail_home template fails the mail storage initialization with an error "Index directory ... is outside expected mail_home base dir". See mail_index_path. Previously this only logged a warning "Index directory is outside metacache_roots", and the check could be disabled with metacache_roots = :.
• Directories without a valid .state file are deleted. Previously directories that had lost their .opened file were never deleted, and .state files without a username (written by versions older than v2.3.7) aborted the rescan with a warning "Found N .state files without usernames - can't finish rescan" and doveadm metacache rescan exit code 68.

Removed Features

Feature	Notes
acl_global_path setting	See ACL Settings Migration.
metacache_roots setting	The metacache root directory is always generated from mail_home. Only a single root is supported. See Obox Administration: Metacache Rescan.
doveadm metacache rescan root directories parameter	Only the root directory generated from mail_home can be rescanned.
doveadm_allowed_commands setting	The setting only matched the command name, while the commands it was typically used to allow already gave full access to any user's mails. Dovecot fails to start if this setting is present in the configuration. Give doveadm server access only to trusted clients. The Doveadm HTTP API no longer returns the 403 HTTP response code, which was used only for commands rejected by this setting.