--- URL: "https://doc.dovecotpro.com/main/llms-full.txt" LLMS_URL: "https://doc.dovecotpro.com/main/llms-full.txt" --- # Doveadm "Doveadm" is Dovecot's administrative tools. They can be run either from the command line, via the doveadm protocol, or via the doveadm HTTP API. ## Commands See [[link,summary_doveadm]]. ## Error/Exit Codes The `doveadm` and `dovecot-lda` tools use mostly `sysexits.h` compatible error codes. | Code | Label | Status | Description | | ---- | ----- | ------ | ----------- | | 0 | | Success | | | 2 | | Success, but mailbox changed during the sync | This code can be safely ignored during intermediate migrations (any changes will be captured during a subsequent sync). For a final migration/cut-over, this error code indicates that the dsync command should be re-run to ensure that all changes made to the original mailbox are reflected in the new mailbox (i.e., a final migration should not be considered successful unless/until dsync returns 0). | | 64 | EX_USAGE | Incorrect parameters | Dsync was called with wrong parameters. This should never be seen in production migration usage (absent a bug). | | 65 | EX_DATAERR | Data error | Theoretically can happen, but should never happen in real-life usage. If seen, it should be handled as a failed migration, and details should be reported to Dovecot for further investigation. | | 66 | EX_NOINPUT | Cannot open input | | | 67 | EX_NOUSER | User no longer exists in user DB | Either this user should not be migrated (since they no longer exist) and this user should be removed from the migration list, or there is some issue interacting with the local identity backend, in which case this migration should be treated as a temporary failure (i.e. retry and/or requeue). | | 68 | EX_NOHOST | Hostname Unknown | Source or destination hostname is not known/resolvable. | | 69 | EX_UNAVAILABLE | Service Unavailable | | | 70 | EX_SOFTWARE | Internal Software Error | | | 71 | EX_OSERROR | System Error (e.g., system cannot fork) | Issue with operating system of host running dsync. | | 72 | EX_OSFILE | Critical OS File Missing | Issue with operating system of host running dsync. | | 73 | EX_CANTCREAT | Cannot create mailbox/message as user is out of quota | For migrations, this should not occur as new storage quotas should be equal/greater to the existing quota. If this error occurs, would possibly indicate an issue with the sync (i.e. duplicate message). In this case, the migration should be marked as failed and the user flagged for further investigation why the sync was unsuccessful. | | 74 | EX_IOERR | Input/Output Error | | 75 | EX_TEMPFAIL | Temporary failure | A temporary error that may be resolved by running the migration again. For migration purposes, if this code is returned dsync should be re-run. There should be some sort of maximum retry value defined; if exceeded, the account should either be marked as "error" or should be placed back in the queue to be attempted to be migrated at a later time. | | 76 | EX_PROTOCOL | Remote error in protocol | | | 77 | EX_NOPERM | Authentication failure | If authentication to the existing mail backend is via master user authentication, this error should not occur. If it does occur, there is a problem with the configuration (or, less likely, a bug in dsync) and all migrations should be suspended until the problem can be resolved. If authentication to the existing mail backend is via the user's current authentication credentials, this indicates that the credentials are no longer valid. This migration should be marked as either a temporary failure (if the authentication credentials are automatically updated when running the migration) or a permanent failure if there is no ability to obtain the new authentication credentials. Migrations into Dovecot (the new system) should be done via a master user, so this error should not be returned once the system is correctly configured. If this error still occurs and is triggered by a failure to connect to the new platform, all migrations should be suspended until the problem can be resolved. Note: EX_NOPERM error might also happen for other reasons, such as not having write permissions to a folder, but this shouldn't happen with dsync use in migration. | | 78 | EX_CONFIG | Invalid Settings/Configuration | This error should not be obtained once the migration system is correctly configured, e.g. after testing the migration system in a staging environment. If this error occurs, all migrations should be suspended until the problem can be resolved. | | 1003 | DOVEADM_EX_EXPIRED | Outdated/Expired | The command could not complete successfully because the requested contents are no longer valid or no longer up to date. [[added,doveadm_ex_expired_code]] | ### Other Issues: * Folder renames if the names are invalid or too long. dsync attempts to fix invalid folder names automatically. If the folder name is too long, a new generated GUID is given it as the name. A related issue is that if any renaming happens, the folder won't be synced incrementally because dsync doesn't realize that the folder was renamed (dsync is stateless). ## HTTP API ::: warning Do not expose Doveadm HTTP API to untrusted networks. It is an unsafe API with dangerous features. It should always be exposed only to your integration API with TLS enabled, secure and random password or API key configured, and relevant network level restrictions applied. ::: ### Configuration To be able to use doveadm HTTP API it's mandatory to configure either [[setting,doveadm_password]] for doveadm or an [[setting,doveadm_api_key]]. To configure password for doveadm service in `dovecot.conf`: ```doveconf[dovecot.conf] doveadm_password = secretpassword ``` Or, if preferred to use separate key for doveadm HTTP API, then it can be enabled by defining key in config: ```doveconf[dovecot.conf] doveadm_api_key = key ``` Enable the doveadm http listener: ```doveconf[dovecot.conf] service doveadm { unix_listener doveadm-server { user = vmail } inet_listener doveadm { port = 2425 } inet_listener http { port = 8080 #ssl = yes # uncomment to enable https } } ``` ### Usage Connecting to the endpoint can be done by using standard HTTP protocol and authentication headers. ::: info There is also https://github.com/dovecot/doveadm-http-cli that can be used for accessing the API. ::: All doveadm commands are accessed under the `/doveadm/v1` path. #### Command List To get the list of commands supported by the endpoint, send an authenticated GET request to the root of the endpoint (for all endpoint commands), or to `/doveadm/v1` path (for doveadm API commands). For example, using [[setting,doveadm_password]] authentication: ```console curl -X GET –u doveadm:password http://host:port/ ``` #### Authentication ##### Basic Auth Use password as configured in [[setting,doveadm_password]]. User name is `doveadm`. ``` curl -H "Authorization: Basic " http://host:port/doveadm/v1 ``` or ```console curl –u doveadm:password http://host:port/doveadm/v1 ``` ##### `X-Dovecot-API` Auth Use API Key as configured in [[setting,doveadm_api_key]]. ```sh curl -H "Authorization: X-Dovecot-API " \ http://host:port/doveadm/v1 ``` ### API Overview #### Request ```sh curl -H "Authorization: Basic " http://host:port/doveadm/v1 curl –u doveadm:password http://host:port/doveadm/v1 ``` There is also https://github.com/dovecot/doveadm-http-cli that can be used for accessing the API. ### API overview All commands sent to the API needs to be posted in json format using `Content-Type: application/json` in headers for the request type and the JSON content as payload in format: ```json [ [ "command1", { "parameter1": "value", "parameter2": "value", "parameter3": "value" }, "tag1" ] ] ``` Multiple commands can be submitted in one json payload: ```json [ [ "command1", { "parameter1": "value", "parameter2": "value" }, "tag1" ], [ "command2", { "parameter1": "value", "parameter2": "value" }, "tag2" ] ] ``` ::: warning For now it is safest not to send multiple commands in one payload, as some commands may kill the server in certain error conditions leaving you without any response. Also it is not guaranteed that the commands will be processed in order. ::: ::: info All commands are case sensitive. ::: #### Response Requests that fail *before* the doveadm command is run returns 400/500 HTTP response codes: | Code | Reason | | ---- | ------ | | 400 | Invalid request. Response body contains error message in text/plain. | | 401 | Unauthorized (missing authentication). | | 403 | Forbidden (authentication failed). | | 404 | Unknown doveadm command. | | 500 | Internal server error (see Dovecot logs for more information). | Otherwise, the response will be a 200 code, Content-Type `application/json`, and the body will be a JSON object. ##### Success ::: info Note All data returned in the JSON object will be strings (e.g., counting fields will be strings, not numbers/integers). ::: ```json [ [ "doveadmResponse", [], "tag1" ] ] ``` ##### Failure `exitCode` are the [[link,doveadm_error_codes]]. ```json [ [ "error", { "exitCode": 68, "type": "exitCode" }, "tag1" ] ] ``` ### Example Session Reload Dovecot configuration: ```json [ [ "reload", {}, "tag1" ] ] ``` Then we execute it with curl: ```sh curl -v -u doveadm:secretpassword -X POST http://localhost:8080/doveadm/v1 \ -H "Content-Type: application/json" -d '[["reload",{},"tag1"]]' ``` This is equivalent to the command [[doveadm,reload]]. ## Mailbox Commands These commands should be run on one of the Dovecot proxies. The proxy is then responsible for forwarding the command to be run in the correct backend. This guarantees that two backend servers don't attempt to modify the same user's mailbox at the same time (which might cause problems). ::: warning [[changed,doveadm_mailbox_commands_user]] All mail commands require providing `-u`, `-F` or `-A` parameter. `USER` environment variable is no longer supported. This will always be subject to user database lookup and requires access to auth userdb socket. ::: ### doveadm fetch See [[doveadm,fetch]]. Fetch mail contents or metadata. #### doveadm search [[doveadm,search]] does the same as [[doveadm,fetch,'mailbox-guid uid']]. It's useful for quick checks where you don't want to write the full fetch command. ### doveadm copy See [[doveadm,copy]]. Copy message to another folder, potentially to another user. ### doveadm deduplicate See [[doveadm,deduplicate]]. Deduplicate mails either by their GUID or by `Message-Id:` header. ### doveadm expunge See [[doveadm,expunge]]. Expunge mails (without moving to Trash). ### doveadm flags add/remove/replace See [[doveadm,flags add]], [[doveadm,flags remove]], [[doveadm,flags replace]]. Update IMAP flags for a mail ### doveadm force-resync See [[doveadm,force-resync]]. Try to fix a broken mailbox (or verify that all is ok). ### doveadm index See [[doveadm,index]]. Index any mails that aren't indexed yet. Mainly useful if [[plugin,fts]] is enabled. ### doveadm mailbox create/delete/rename See [[doveadm,mailbox create]], [[doveadm,mailbox delete]], [[doveadm,mailbox rename]]. Modify folders. ### doveadm mailbox list See [[doveadm,mailbox list]] List user's folders. ### doveadm mailbox subscribe/unsubscribe See [[doveadm,mailbox subscribe]], [[doveadm,mailbox unsubscribe]]. Modify IMAP folder subscriptions. ### doveadm mailbox status See [[doveadm,mailbox status]] Quickly lookup folder metadata (# of mails, # of unseen mails, etc.). ### doveadm move See [[doveadm,move]]. Move message to another folder, potentially to another user. # Dovecot Errors and Troubleshooting ## Client Issues ::: warning This section may contain old information. If you do find client(s) that need special configuration, or no longer need it, please let us know. ::: It seems to be quite difficult to implement a working IMAP client. [Best Practices for Implementing an IMAP Client](http://www.imapwiki.org/ClientImplementation) tries to help with it. ### Negative UIDs `Invalid messageset: 1181461470:-1181461446.` IMAP uses unsigned 32bit integers for unique message identifiers. Unfortunately a lot of IMAP clients use 32bit signed integers, which means that if the UIDs go higher than 2147483647, they'll wrap to negative integers. This causes errors such as above. However normally the UIDs should never go that high, so it's possible to avoid this problem. Earlier Dovecot versions had bugs which could cause `X-UID:` headers in incoming messages to grow the UIDs too high. Some spam messages especially contained these intentionally broken `X-UID:` headers. With newer Dovecot versions these broken `X-UID:` headers aren't practically ever used. It happens only if the mail has a valid `X-IMAPbase`: header, `X-UID:` header, and the mail is written to an empty mbox file. Note that this can happen only to new mboxes, because expunging all messages in a mailbox causes Dovecot to create a metadata message at the beginning of the mbox file. In any case it's still a good idea to filter out `X-UID:` and other metadata headers in your MDA. [[link,lda]] does this internally. See [[link,mbox_header_filter]]. #### Fixing Fixing is done by letting Dovecot update UIDVALIDITY value and recreate the UIDs beginning from one. This means that client's local cache will be invalidated and the client will be required to download all the messages again. ##### mbox Delete Dovecot's index files (eg. `.imap/INBOX/`) and `X-IMAP:` and `X-IMAPbase:` headers from the mbox file. ##### Maildir This should really never be a problem with Maildir. If however you have managed to cause it somehow (by receiving 2 billion mails?), you can recreate the UIDs by deleting `dovecot-uidlist` file. ### Specific Clients If not listed in this section, there are no known issues. #### Apple Mail.app On Mac OS X Leopard 10.5 Mail.app appears to support subscribe/unsubscribe by right clicking on a mailbox, selecting 'Get Account Info' and selecting 'Subscription List' from tabs. This however doesn't really work with any IMAP server. Apple Mail 3.6 (that comes with OS X 10.5 Leopard) supports subscribing/unsubscribing to folders in the public namespace. #### Outlook - You should enable [[setting,pop3_client_workarounds,outlook-no-nuls]] workaround with POP3. - If some Outlook users don't see new or sent mails in the appropriate folders after a migration from UW IMAPd even if they are visible in other clients (e.g. Roundcube, Thunderbird, or on the disk itself), and you get the error message "BAD Error in IMAP command UID: Invalid UID messageset" in the log or rawlog: It helps to remove the problematic IMAP account completely from Outlook and recreating it again there. It speaks a different IMAP afterwards, so there are reasons to believe it caches the details of some server on the first connect and doesn't refresh them even if you change the server's hostname in the account settings. #### Thunderbird - If you're using [[link,mbox]], [[link,dbox]], or [[link,maildir]] with `:LAYOUT=fs` you should enable [[setting,imap_client_workarounds,tb-extra-mailbox-sep]] workaround for IMAP. ([Bug report](https://bugzilla.mozilla.org/show_bug.cgi?id=29926)) - If you're using [[link,mbox]], and if you are not using a technique to allow folders that contain both sub-folders and messages (see [[link,mbox_child_folders]]) then you will have to disable "Server supports folders that contain sub-folders and messages" setting from Thunderbird. ([Enhancement request](https://bugzilla.mozilla.org/show_bug.cgi?id=284933)) - Thunderbird may display incorrect new mail counts in the New Mail notification box. This is due to a bug in Thunderbird's handling of the CONDSTORE extension. See [Bug Report](https://bugzilla.mozilla.org/show_bug.cgi?id=885220) for details and a client-side workaround. ## Time Moved Backwards Error Dovecot isn't very forgiving if your system's time moves backwards. There are usually three possibilities why it's moving backwards: 1. You're running `ntpdate` periodically. This isn't a good idea. 2. You're using some kind of a virtual server and you haven't configured it right (or it's buggy). 3. Dovecot is started before time is synchronized at server startup. See [[link,time_synchronization]]. ## CentOS/RHEL8 Mail Location When installing dovecot on CentOS8 or RHEL8, you might experience problems with writing into mail location. This is due to several restrictions that need to be disabled. ### SystemD restrictions The packages distributed with CentOS8 come with restrictive systemd unit files. These restrictions are good from security perspective, yet the errors do not guide into the correct changes. If you see log messages such as: `dovecot: imap(test): Namespace '': mkdir(/home/mail/domain/test/Maildir) failed: Permission denied (euid=1005(vmail) egid=1005(vmail) missing +w perm: /home/mail/domain, UNIX perms appear ok (ACL/MAC wrong?))` You need to use `systemctl edit dovecot` to add following stanza ``` [Service] ReadWritePaths=/home/mail ``` And run `systemctl daemon-reload`. ### SELinux You can check `/var/log/audit/audit.log` for message such as: `type=AVC msg=audit(1586604621.637:6736): avc: denied { write } for pid=12750 comm="imap" name="Maildir" dev="dm-3" ino=438370738 scontext=system_u:system_r:dovecot_t:s0 tcontext=unconfined_u:object_r:etc_runtime_t:s0 tclass=dir permissive=0 type=SYSCALL msg=audit(1586604621.637:6736): arch=c000003e syscall=83 success=no exit=-13 a0=55b493a7f338 a1=1ed a2=ffffffff a3=fffffffffffffcd8 items=0 ppid=12735 pid=12750 auid=4294967295 uid=1005 gid=1005 euid=1005 suid=1005 fsuid=1005 egid=1005 sgid=1005 fsgid=1005 tty=(none) ses=4294967295 comm="imap" exe="/usr/libexec/dovecot/imap"subj=system_u:system_r:dovecot_t:s0 key=(null)` If you see this, you need to relabel your mail location to `mail_home_rw_t`. ```sh chcon -R -t mail_home_rw_t /home/mail ``` To make this change permanent, you need to add new fcontext rule: ```sh semanage fcontext --add --type mail_home_rw_t --range s0 '/home/mail(/.*)?' ``` After this, Dovecot should be able to write into your mail location again. ## dovecot.index.cache is Too Large ### Problem 1 `Error: Corrupted index cache file .../dovecot.index.cache: Cache file too large` The problem in these cases is that the user has a folder with a large number of messages. The only solution for now is to delete the `dovecot.index.cache` for that folder. Since v2.3.11 this is done automatically. The cache files generally are useful to reduce disk IO by being able to read commonly accessed data from the cache instead of opening the individual emails. However, usually these kind of huge folders are some kind of system accounts which just gather a lot of mails which are periodically deleted. In these cases the cache file usually isn't very useful. ### Problem 2 Alternatively you can encounter: `Fatal: master: service(imap): child ... returned error 83 (Out of memory (service imap { vsz_limit=1024 MB }, you may need to increase it))` and: `Error: mmap(size=...) failed with file .../dovecot.index.cache: Cannot allocate memory` These usually happen because the `dovecot.index.cache` file is so large that it can't fit into the memory. The solution is usually to either raise the imap service's [[setting,service_vsz_limit]] or to somewhat higher than the maximum cache file size. For example to `1500M`. An alternative solution to this is to reduce the maximum cache file size to be somewhat lower than the imap service's vsz_limit. See [[setting,mail_cache_max_size]]. ## UNIX Socket Resource Temporarily Unavailable Commonly visible as: `imap-login: Error: net_connect_unix(imap) failed: Resource temporarily unavailable` This means that there are more imap-login processes trying to connect to the "imap" UNIX socket than there are imap processes accepting the connections. The kernel's connection listener queue got full and it started rejecting further connections. So what can be done about it? ### Wrong Service Settings This can happen if `service imap { client_limit }` is set to anything else than 1. IMAP (and POP3 and other mail) processes do disk IO, lock waiting and such, so if all the available imap processes are stuck waiting on something, they can't accept new connections and they queue up in the kernel. For mail processes only `client_limit=1` is recommended. It can also happen if `service imap { process_limit }` is reached. Dovecot logs a warning if process_limit or client_limit is reached. ### Out of File Descriptors If the "ulimit -n" is too low, kernel stops notifying the process about incoming connections. Make sure that the limit is at least as high as the client_limit. Dovecot also internally checks this, and if it's too low it writes a warning to stderr at startup and to log. Note that Dovecot is not using "dovecot" user's or PAM's limits in general. Make sure the limits are correct with: `cat /proc/`pidof dovecot`/limits`. ### Master Process Busy Dovecot master process forks all of the new processes. If it's using 100% CPU, it doesn't have time to fork enough new processes. Even if it's not constantly using 100% CPU there may be fork bursts where it temporarily gets too busy. The solution is to make it do less work by forking less processes: - Most importantly switch to [[link,login_processes_high_performance]]. This alone might be enough. - You can also switch (most of the) other commonly forked processes to be reused. For example [[setting,service_restart_request_count,100]] reuses the process for 100 different connections before it dies. This is useful especially for imap, pop3 and managesieve services. It's better to avoid using [[setting,service_restart_request_count,unlimited]] in case there are memory leaks. - You can pre-fork some idling processes to handle bursts with [[setting,service_process_min_avail]]. See [[link,service_configuration]] before changing any service settings. Some services require specific values to work correctly. ### Listener Queue Size Dovecot uses [[setting,service_client_limit]] * [[setting,service_process_limit]] as the listener queue size. There is no upper limit in Dovecot. Most OSes use an even lower limit, typically `128`. In Linux you can increase this through: `/proc/sys/net/core/somaxconn`. ## Change Group Operation Not Permitted `imap(user): Error: chown(/home/user/mail/.imap/INBOX, group=12(mail)) failed: Operation not permitted (egid=1000(user), group based on /var/mail/user - see https://doc.dovecot.org/admin_manual/errors/chgrp_no_perm/)` This means that Dovecot tried to copy `/var/mail/user` file's group (mail) to the index file directory it was creating (`/home/user/mail/.imap/INBOX`), but the process didn't belong to the mail group, so it failed. This is important for preserving access permissions with [[link,shared_mailboxes]]. Group copying is done only when it actually changes the access permissions; for example with 0600 or 0666 mode the group doesn't matter at all, but with 0660 or 0640 it does. To solve this problem you can do only one of two things: 1. If the group doesn't actually matter, change the permissions so that the group isn't copied (e.g. `chmod 0600 /var/mail/\*`, see [[link,mbox]]). 2. Give the mail process access to the group (e.g., [[setting,mail_access_groups,mail]]). However, this is dangerous. [It allows users with shell access to read other users' INBOXes](https://dovecot.org/list/dovecot-news/2008-March/000060.html). # Events Design Dovecot supports events, which improves both logging and statistics. ::: tip See Also: * [[link,summary_events]], * [[link,stats]], * [[link,event_export]], and * [[link,event_filter]]. ::: Each logging call can be attached to a specific event, which can provide more metadata and context than just the log message string. This will eventually allow implementing things like machine-parsable (e.g. `JSON`) log lines containing key=value pairs, while still keeping the human readable text available. Each logging event can also be captured and sent to stats, even if it's not actually logged. Commonly statistics-related events are logged with debug level. Events have: * Categories, such as `storage`, `mailbox` or `auth`. * Fields, such as `user=foo@example.com` or `service=imap`. * Creation timestamp with microsecond precision. * Source code file and line number location when sending the event. * It may have an easy human-readable name. This is important for events that are expected to be used for statistics, so they can be easily referred to. * Forced debug-flag. Debug logging is enabled for this event regardless of the global debug log filters. A child event will inherit this flag. Events are hierarchical, so they can have parent events. The events always inherit all of their parents' categories and fields. A child event can replace a parent's field, and it can also remove a parent's field. Ideally most events would have a parent hierarchy that reaches the top event that was created for the current user/session. This allows statistics to track which events happened due to which users. In some cases this may not really be possible, such as an HTTP connection that is shared across multiple users in the same process. An event's lifetime is usually the same as the "object" it attaches to. For example an IMAP client connection should have a single event created at the beginning of the connection and destroyed at disconnection. The IMAP client connection event could be used for logging things like "Client connected" and "Client disconnected" and perhaps some other connection-specific events. However, most of the logging should be done by new events that have the IMAP client connection event as their parent. ::: tip There's an automatic "duration" statistics field that is calculated from the creation of the event to the (last) sending of the event, so for it to make sense the event lifetime and its logging also needs to make sense. So, for example, if the IMAP client connection event was used for logging many things throughout the session, the "duration" field would make little sense for most of those events. ::: ## Categories The event categories are hierarchical. Example: `mail` category has parent `mailbox`, which has parent `storage`. If an event filter contains `category=storage`, it will match the `mail` and `mailbox` child categories as well. ::: tip A category isn't the same as a service/process name, but there is a `service:` category. ::: So, for example, IMAP process has an `imap` category for its IMAP-related events, such as IMAP client connection and IMAP command related events. Because most events would be child events under these IMAP events, they would all inherit the `imap` category. So it would appear that using `category=imap` filter would match most of the logging from imap process. However, there would likely be some events that wouldn't have the IMAP client as their parent event, so these wouldn't match the imap category. ## Fields Each event can have any number of `key=value` fields. Parent event's fields are inherited by the child event. There are 4 types of fields: * strings * numbers (`intmax_t` = signed 64bit usually) * timestamp (`struct timeval`) * a list of strings The fields can be used for various purposes: * Filtering events with `field_name=value` matching * Counting fields in statistics (most commonly number fields) * They can include metadata that are internally used by the code. For example passing data from one plugin to others. * Later on these fields can be used by the logging system. * Field names should be consistent across the code. Besides making it easier for admins to configure the events, this allows statistics code to sum up fields from different unrelated events. * Example: if all the networking events include `ip`, `net_in_bytes`, and `net_out_bytes` fields, statistics can globally track how much network traffic Dovecot is doing from its own point of view, regardless of whether it's HTTP traffic or IMAP traffic or something else. # Dovecot HTTP Client HTTP requests within Dovecot are performed using its internal HTTP client (internally referred to as "lib-http"). ## Internal HTTP Response Codes Dovecot's lib-http uses custom HTTP response codes for some error conditions. In certain locations, e.g. [[link,lua_lib-http]], these codes may be visible to an admin or in logging, so these response codes must be handled in the same way that standard RFC codes are. | Number | Code | Description | | ------ | ---- | ----------- | | 9000 | ABORTED | The request was aborted. | | 9001 | INVALID_URL | Failed to parse HTTP target url. | | 9002 | HOST_LOOKUP_FAILED | Failed to perform DNS lookup for the host. | | 9003 | CONNECT_FAILED | Failed to setup any connection for the host and client settings allowed no more attempts. | | 9004 | INVALID_REDIRECT | Service returned an invalid redirect response for this request. | | 9005 | CONNECTION_LOST | The connection was lost unexpectedly while handling the request and client settings allowed no more attempts. | | 9006 | BROKEN_PAYLOAD | The input stream passed to the request using http_client_request_set_payload() returned an error while sending the request. | | 9007 | BAD_RESPONSE | The service returned a bad response. | | 9008 | TIMED_OUT | The request timed out (either this was the last attempt or the absolute timeout was hit). | # Importing Mailboxes For importing mails, dovecot has the [[doveadm,import]] command. ::: warning Do not use this tool for migrating mails to another system. See [[link,migrating_mailboxes]] instead. ::: The import command imports mails as is, and most importantly does not preserve UIDs or check if the mail is already there. Message flags are preserved. ## Importing Mails from Other Users To import mail from another user in the system, you can do ```sh doveadm import -U sourceuser -u destuser 'maildir:~/Maildir' Imported ALL ``` This will import all mails and folder structure from sourceuser to destuser, under folder `Imported`. This will require that both sourceuser and destuser have same system UID. You can also use imap client to do the import, which lets you import mail from users with different system UID, or users that reside on a remote system. ```sh doveadm import -U sourceuser -u destuser imapc: Imported ALL ``` This assumes you have configured imap client. See [[link,migration_mailboxes_imapc]] for details. ## Importing Mails from Filesystem You can also import mails from a filesystem location: ```sh doveadm import -u destuser maildir:/opt/backup/destuser/Maildir "" ALL ``` This will restore all mails from backup into mailbox root, with folder structure. The main difference to the previous example is that the `-U` parameter is not given. This causes the source location to be opened as `destuser`. Note that `destuser` must have read and privileges to the source location. If you have only read privileges, you can try using in-memory indexes: ```sh doveadm import -u destuser -p mail_index_path=MEMORY maildir:/opt/backup/destuser/Maildir "" ALL ``` ## Merging Storages In some disaster recovery cases you may end up having mails for the same user in two different locations, and need to merge them. For example the storage goes down and fixing it takes a long time, so during the fixing you can let the users access their emails as an empty account, which can receive new mails. Later on you can use [[doveadm,import]] to merge the mailboxes. Note that there is no way to make this solution perfect: * IMAP clients that have cached mails locally will delete their local caches and have to re-download mails later on. * POP3 clients that leave mails on server will notice all the mails are gone, and delete their local UIDL caches. When old mails come back, they're re-downloaded as new emails (duplicates). Also, there are 3 alternative ways of how mails can be imported into mailboxes: 1. Old recovered mails are imported on top of the newly received mails. The downside here is that mails may now be sorted in a weird order. If the IMAP client shows the mails in the saved order, the new received emails show up as oldest emails. Although this may not be an issue, since many IMAP clients sort the mails by either Date: header or the received timestamp (IMAP INTERNALDATE). 2. New mails are imported on top of the old recovered mails. This avoids the sorting problems, so it's likely the preferred method. The downside here is that the IMAP/POP3 clients will have to re-download also the newly delivered emails, as well as the old ones. Another issue with this is that some IMAP clients might not show the old recovered mails without manually rebuilding local caches, because the mails become inserted to the beginning of the folders, which isn't allowed by the IMAP protocol. * Another thing to keep mind here is that IMAP clients shouldn't see IMAP UIDs pointing to different emails before/after the merge. Otherwise their local cache could point to a different email, which could even cause the user to delete wrong messages. This shouldn't be an issue as long as new mail deliveries and all user access is disabled during the merging. The old mails have the old UIDs, and newly delivered mails would all have higher UIDs (because the UIDNEXT value is not shrunk during index rebuild that clears out the mailbox). 3. New recovered mails are imported under a separate `Recovered/` folder, i.e. there will be `Recovered/INBOX`, `Recovered/Sent`, etc. The user will need to manually merge the folders. The upside here is that POP3 clients won't re-download any mails as duplicates, but otherwise it's not much different from the 1st case. ### Example For the 2nd case ("New mails are imported on top of the old recovered mails") where mail storage broke down, but a separate index storage is ok, and index storage supports snapshots: * Snapshot the current index volume at the time of breakage. * Make sure [[setting,mailbox_list_iter_from_index_dir]] setting is enabled, so folder listing is done using the index volume rather than the mail volume. * Mount a new empty mail volume. * The first time IMAP/POP3 client attempts to access an existing mail, Dovecot rebuilds the indexes for the folder. This makes the folder look empty. The folder structure is preserved, as long as the [[setting,mailbox_list_iter_from_index_dir]] setting is used. * Once the original mail volume is recovered, first disable all user access and all new mail deliveries. * Create another snapshot of the index volume. * Mount the old mail volume to the original mountpoint. * Replace the index volume with the first created snapshot. Now the storage looks exactly like it was at the time of breakage. * Mount the new mail volume to some temporary mountpoint. * Mount the second index snapshot to some temporary mountpoint. * Use [[doveadm,import]] to recover new mails: ```sh doveadm import -u user@example.com \ -p mail_index_path=/mnt/temp-index-storage/user \ -p mail_control_path=/mnt/temp-index-storage/user \ -p mailbox_list_iter_from_index_dir \ sdbox:/mnt/temp-mail-storage/user "" all ``` If you have other [[link,mail_location,mail location settings]], you may also want to specify them using some temporary locations. For example using [[setting,mail_volatile_path]], [[setting,mailbox_list_index_prefix]]: ```sh doveadm import -u user@example.com \ -p mail_volatile_path=/tmp/doveadm-import/user \ -p mailbox_list_index_prefix=/tmp/doveadm-import/user/dovecot.list.index # other settings ``` Delete the directories after finishing the import. # Dovecot Limits Dovecot contains various configurable and built-in resource limits designed to prevent denial of service situations. This page lists those limits. ::: todo This list is currently incomplete. ::: ## Storage Size Limits ### See Also * [[link,quota_root]] ## User Concurrency Limits ## Memory Limits * [[link,service_vsz_limit]] * [[link,service_process_limit]] * [[link,service_client_limit]] ## Message Headers There is a `10 MB` limit for a single message header block, and a `50 MB` limit for all header blocks in a message. ## MIME Parts Maximum number of MIME parts per message is 10000. A maximum of 100 MIME parts can be nested in the same hierarchy path. # Dovecot Logging **Dovecot always logs a detailed error message** if something goes wrong. If it doesn't, it's considered a bug and will be fixed. However, almost always the problem is that **you're looking at the wrong log file**; error messages may be logged to a different file than informational messages. By default Dovecot uses the syslog service with mail facility. Dovecot can also be configured to log to files directly. ## Log File Location You can find the log file locations by running [[doveadm,log find]]. ## Last Errors You can easily print the last 1000 error messages of a running Dovecot: [[doveadm,log errors]]. ## Changing Log File Paths If you don't want to use syslog, you can make Dovecot log to files directly: ```doveconf[dovecot.conf] log_path = /var/log/dovecot.log # If not set, use the value from log_path info_log_path = /var/log/dovecot-info.log # If not set, use the value from info_log_path debug_log_path = /var/log/dovecot-debug.log ``` The warning and error messages go to the file specified by [[setting,log_path]] while informative messages goes to [[setting,info_log_path]] and debug messages goes to [[setting,debug_log_path]]. ## Syslog You can change Dovecot's syslog facility using [[setting,syslog_facility]]. The syslog configuration is often in `/etc/syslog.conf` or `/etc/rsyslog*` files. When using syslog, Dovecot uses 5 different logging levels: | Level | Description | | ----- | ----------- | | `debug` | Debug-level message. | | `info` | Informational messages. | | `warning` | Warnings that don't cause an actual error, but are useful to know about. | | `err` | Non-fatal errors. | | `crit` | Fatal errors that cause the process to die. | Where exactly these messages are logged depends entirely on your syslog configuration. Often everything is logged to `/var/log/mail.log` or `/var/log/maillog`, and err and crit are logged to `/var/log/mail.err`. This is not necessarily true for your configuration though. In an ideal configuration the errors would be logged to a separate file than non-errors. For example you could set [[setting,syslog_facility,local5]] and set: ``` local5.* -/var/log/dovecot.log local5.warning;local5.error;local5.crit -/var/log/dovecot-errors.log ``` Here all the Dovecot messages get logged into `dovecot.log`, while all the important error/warning messages get logged into `dovecot-errors.log`. Sometimes syslog is configured to log all info level logging to `/var/log/messages`. You can disable such duplicates for mail by adding ";local5.none". For example: ``` *.info;local2.none;authpriv.none;cron.none;local5.none /var/log/messages ``` ### Syslog Rate Limiting rsyslog is configured with flood control enabled by default. Since Dovecot can log a lot in some situations, especially with debug logging enabled, this causes log messages to be lost. The rate limiting should be disabled in `/etc/rsyslog.conf`: ``` $SystemLogRateLimitInterval 0 ``` ## Rotating Logs You can use logrotate to maintain the Dovecot log files so they don't grow beyond a manageable size. Save the below scriptlet as `/etc/logrotate.d/dovecot`: ``` /var/log/dovecot.log { weekly rotate 4 missingok notifempty compress delaycompress sharedscripts postrotate doveadm log reopen endscript } ``` ::: info doveadm is not working properly with SELinux (e.g. doveadm cannot read config file when called from logrotate context). SELinux safe postrotate alternative scriptlet: ``` postrotate kill -s 0 `cat /var/run/dovecot/master.pid` || kill -s USR1 `cat /var/run/dovecot/master.pid` endscript ``` ::: ## Internal Errors If IMAP or POP3 processes encounter some error, they don't show the exact reason for clients. Instead they show: ``` Internal error occurred. Refer to server log for more information. [2006-01-07 22:35:11] ``` The point is that whenever anything unexpected happens, Dovecot doesn't leak any extra information about it to clients. They don't need it and they might try to exploit it in some ways, so the less they know the better. The real error message is written to the error log file. The timestamp is meant for you to help you find it. ## Logging Verbosity There are several settings that control logging verbosity. By default they're all disabled, but they may be useful for debugging. * [[setting,auth_verbose,yes]] enables logging all failed authentication attempts. * [[setting,log_debug,category=auth]] enables all authentication debug logging (also enables [[setting,auth_verbose]]). Passwords are logged as ``. * [[setting,auth_debug_passwords,yes]] removes password hiding (but only if you are not using PAM, since PAM errors aren't written to Dovecot's own logs). * [[setting,log_debug,category=mail]] enables all kinds of mail related debug logging, such as showing where Dovecot is looking for mails. * [[setting,verbose_ssl,category=ssl]] enables logging SSL errors and warnings. Even without this setting if connection is closed because of an SSL error, the error is logged as the disconnection reason. * [[setting,auth_verbose_passwords,no|plain|sha1]]: If authentication fails, this setting logs the used password. If you don't really need to know what the password itself was, but are more interested in knowing if the user is simply trying to use the wrong password every single time or if it's a brute force attack, you can set this to `sha1` and only the SHA1 of the password is logged. That's enough to know if the password is same or different between login attempts. * [[setting,log_debug]]:Flexible debug logging configuration. # Login Process Proxying Proxying using login processes is done for IMAP, POP3, Submission, and ManageSieve protocols. LMTP and doveadm protocols implement their own proxying, but they try to be mostly compatible. ## Proxying States If login fails, the error message shows the connection state when the disconnection or timeout happened. For example `timed out in state=login/banner` with IMAP means that connection timed out while waiting for LOGIN command reply. ### IMAP States IMAP states are a bit more complicated. They describe both what commands the proxy has sent towards the backend and also what was the last received reply from the backend. The proxy can also send multiple commands pipelined, which are listed in the state. For example the state could be `capability+login/banner` to mean that CAPABILITY and LOGIN commands have been sent, but only the IMAP banner reply has been received so far. The list of sending states (left side of `/`): | States | Description | | ------ | ----------- | | `id` | ID command used to send session ID and original IMAP client IP/port. | | `starttls` | STARTTLS command. | | `capability` | CAPABILITY command. Only used if backend doesn't send it automatically. | | `login` | LOGIN command. | | `authenticate` | AUTHENTICATE command. Sent if LOGIN command couldn't be used, e.g., because using master user login or non-cleartext authentication mechanism. | | `auth-continue` | SASL continuation sent for AUTHENTICATE command. | The list of received states (right side of `/`): | States | Description | | ------ | ----------- | | `none` | Nothing has been received so far. | | `banner` | IMAP banner received ("\* OK Dovecot ready"). | | `id` | ID command reply received. | | `starttls` | STARTTLS command reply received. | | `capability` | CAPABILITY command reply received. | | `auth-continue` |AUTHENTICATE command asked for continuation (`+` reply). | | `login` | LOGIN or AUTHENTICATE command reply received. | ### POP3 States POP3 states work a bit differently than IMAP states: | States | Description | | ------ | ----------- | | `banner` | Nothing has been received so far (banner has NOT been received). | | `starttls` | STLS command has been sent. | | `xclient` | XCLIENT command has been sent. | | `login1` | USER command has been sent. | | `login2` | PASS or AUTH command has been sent. | ### Submission States Submission states are similar to POP3: | States | Description | | ------ | ----------- | | `banner` | Nothing has been received so far (banner has NOT been received). | | `ehlo` | EHLO command has been sent. | | `starttls` | STLS command has been sent. | | `tls-ehlo` | EHLO command after STLS has been sent. | | `xclient` | XCLIENT command has been sent. | | `authenticate` | AUTH command has been sent. | ### ManageSieve States | States | Description | | ------ | ----------- | | `none` | Nothing has been received so far. | | `tls-start` | STARTTLS command has been sent. | | `tls-ready` | STARTTLS command was accepted. TLS handshake was started. | | `xclient` | XCLIENT command has been sent. | | `auth` | AUTHENTICATE command has been sent. | # Dovecot Lua Support Dovecot supports Lua scripting in several configuration areas. See: * [[link,auth_lua]] * [[plugin,push-notification]] ::: tip Info Dovecot supports [Lua 5.3](https://www.lua.org/manual/5.3/) and [Lua 5.4](https://www.lua.org/manual/5.4/). ::: ## Modules Dovecot contains two modules that support Lua scripting: * [[link,lua_lib-lua]] * [[link,lua_mail-lua]] # Lua: lib-lua Dovecot provides a lib-lua internal helper as part of libdovecot.so. It has facilities for loading scripts from various sources, and also helps with reusing scripts by keeping track of which scripts are loaded. Each script has it's own memory pool, which is guaranteed to be released when script is unloaded. ::: danger Never use `os.exit()` from a Lua script. This will cause the whole process to exit instead of just the script. ::: ## Initialization When script is loaded, `script_init()` function is called, if found. ::: warning [[changed,lua_script_init]] `script_init()` return value is no longer checked. Use error() instead if necessary. ::: ## De-initialization When script is being unloaded, `script_deinit()` function is called, if found. ## C API ### `struct event *dlua_check_event(lua_State *L, int arg)` Check the argument with index `arg` from stack and try to convert it to an Dovecot Event. Throws an error if the argument is not a valid Dovecot Event. ### `void dlua_dovecot_register(struct dlua_script *script)` Register dovecot variable. This item can also be extended by context specific tables, like authentication database adds `dovecot.auth`. ### `void dlua_push_event(lua_State *L, struct event *event)` Pushes an Dovecot Event to stack. ### `void dlua_push_timeval(lua_State *L, const struct timeval *tv)` Pushes an timeval struct to stack as integer. ## Lua API ### Base Functions ### HTTP Functions #### Object `http_client` #### Object `http_request` #### Object `http_response` #### Example HTTP Client Code ```lua local json = require "json" local http_client = dovecot.http.client { timeout = 10000; max_attempts = 3; debug = true; } function auth_password_verify(request, password) local auth_request = http_client:request { url = "https://endpoint/"; method = "POST"; } local req = {user=request.user, password=password} auth_request:set_payload(json.encode(req)) local auth_response = auth_request:submit() local resp_status = auth_response:status() if resp_status == 200 then return dovecot.auth.PASSDB_RESULT_OK, "" else return dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH, "" end end ``` ### Object `event` ### Object `event_passthrough` ### Object `dict` ::: tip Currently, this object cannot be created within the Lua code itself. ::: #### Object `dict.transaction` ### Object `dns_client` [[added,lua_dns_client]] ::: tip Currently, this object cannot be created within the Lua code itself. ::: # Lua: mail-lua mail-lua is a plugin that can be loaded to provide API for mail storage Lua plugins. mail-lua provides a common script to be used in mail storage instead of per-plugin scripts. See [[plugin,mail-lua]]. ## Initialization When mail user is created, a script is loaded if present as `mail_lua_script()` and `mail_user_created()` is called if present in script. ## De-initialization On deinitialization, `mail_user_deinit_pre()` is called first, if present, followed by `mail_user_deinit()`. ## C API ### `void dlua_register_mail_storage(struct dlua_script *script)` Parameters: : * `script`: `dlua_script` to add mail storage. Register storage Lua interface to script context. ### `bool mail_lua_plugin_get_script(struct mail_user *user, struct dlua_script **script_r)` Parameters: : * `user`: `mail_user` * `script`: `dlua_script` Returns script context if available. If FALSE is returned, no Lua script has been loaded, and you should optionally deal this yourself. ### `void dlua_push_mail_user(struct dlua_script *script, struct mail_user *user)` Parameters: : * `script`: `dlua_script` * `user`: `mail_user` Pushes a mail user on top of stack. ### `void dlua_push_mailbox(struct dlua_script *script, struct mailbox *box)` Parameters: : * `script`: `dlua_script` * `mailbox`: `mailbox` Pushes a mailbox on top of stack. ### `void dlua_push_mail(struct dlua_script *script, struct mail* mail)` Parameters: : * `script`: `dlua_script` * `mail`: `mail` Pushes a mail on top of stack. ## Lua API ### Object `dovecot.storage` ### Object `mail_user` * Has `tostring()` * Is comparable (by username) #### Functions #### Variables ### Object `mailbox` * Has `tostring()` * Is comparable (by full mailbox name) #### Functions #### Variables ##### `mailbox.attribute` Full mailbox name. ##### `mailbox.name` Mailbox name. ### Table `mailbox_status` #### Variables ### Object `mail` * Has `tostring()` * Is comparable (within same mailbox, by UID) #### Functions *None yet.* #### Variables # Migrating Mailboxes ::: warning Badly done migration will cause your IMAP and/or POP3 clients to re-download all mails! Read this page carefully! ::: This guide assumes that the target host has a v2.3 or newer version of Dovecot. You should use migration when you are changing Dovecot storage configuration, such as compression, encryption or mail location driver; or want to restructure your mails in some way. Things that you should consider in your config: * [[link,mail_location]] * IMAP client settings (when needed) * [[link,namespaces,Namespace definitions including public and shared namespaces]] * [[plugin,acl,ACL settings]] * [[plugin,quota]]: Quota without rules (to make sure quota gets calculated, but not enforced) * [[link,mail_cache]] * [[setting,mail_attachment_detection_options]] * [[setting,mail_attribute]] * [[plugin,mail-compress]] and [[plugin,mail-crypt]] settings * [[link,nfs]] related settings Sometimes, if your production configuration file has complex authentication flows, push notifications, or other settings that might cause unwanted effects during migration, you can make a separate migration configuration file. To use this configuration file, you can store it as, for example, `/etc/dovecot/dovecot-migration.conf`, and use it with `doveadm -c /etc/dovecot/dovecot-migration.conf sync`. Other settings to use: * [[setting,dsync_features,empty-header-workaround]] * This is sometimes needed with some broken servers. * [[setting,mail_prefetch_count,20]] * Read multiple mails in parallel; improves performance. * [[setting,dsync_commit_msgs_interval,100]] * If you have very large mailboxes, you might want to tune this * [[setting,dsync_hashed_headers,Date Message-ID]] * If you need to hash other headers for whatever reason, you can change this * [[setting,mail_fsync,never]] * Avoid useless I/O. ## Testing It is a very good idea to do some test migrations first using test accounts to ensure everything works. When migrating mails from another server, you should make sure that these are preserved: 1. Message flags * Lost flags can be really annoying, you most likely want to avoid it. 2. Message UIDs and UIDVALIDITY value * If UIDs are lost, at a minimum clients' message cache gets cleaned and messages are re-downloaded as new. * Some IMAP clients store metadata by assigning it to specific UID, if UIDs are changed these will be lost. 3. Mailbox subscription list ## Migrating Mailboxes from Another Dovecot Server ### Preparations If the old system is running v2.1.14+ , you can use doveadm protocol to migrate your mails. If the old system is older, see [migrating messages over IMAP](#migrating-messages-over-imap). First, setup doveadm service on old server: ```doveconf[dovecot.conf] service doveadm { inet_listener doveadm { port = 12354 } } doveadm_password = supersecret ``` Then set doveadm password on new server: ```doveconf[dovecot.conf] doveadm_password = supersecret ``` Now you are ready to migrate. ### Executing Migration If you want to avoid any changes to your source system, unidirectional synchronization is recommended. To migrate users, use: [[doveadm,backup,-Ru username tcp:host:port]]. If you are experiencing problems, run: ```sh doveadm -D backup -Ru username tcp:host:port ``` This will enable debug logging. The doveadm backup command forces the destination to look exactly like the source, deleting mails and mailboxes if necessary. If it's possible that the destination already has new mails (or other changes), use [[doveadm,sync,-1]] instead: ```sh doveadm -o imapc_password=bar sync -1Ru user imapc: ``` You can run the command again to perform incremental updates. Note that Public and Shared namespaces are synchronized automatically (see caveats). #### Caveats * Migrating shared namespaces is difficult prior to v2.3.15+. To migrate Shared namespaces, you need to use `-n Shared -n Shared/Mailbox`. * If you are using ACLs, some ACL types can cause problems. Especially if you have ACLs that only permit writing to folder, but not reading it. This applies to shared folders only. * Migration can cause unexpectedly high loads on the source system. Beware! There is no way to throttle the synchronization. * Avoid accessing the target mailboxes before the first sync. At best this causes warnings about GUID or UIDVALIDITY changes, and at worst it fails the sync entirely. ## Migrating mailboxes over IMAP When migrating mails over IMAP, you need to have valid credentials to the source system. You can either use master password, master user, or individual user authentication. This depends entirely on the source system. See [[link,auth_master_users]] for more details. ### Preparations Configure authentication on the source system to match your preference. Ensure both source and target system agree on usernames. Configure IMAP client on the target system. ::: tip [[changed,migration_imapc_features]] All IMAPC features are auto-enabled by default. Please refer to [[setting,imapc_features]] for description on individual flags on how to turn these off when necessary. ::: * [[setting,imapc_list_prefix,INBOX]] * If the old IMAP server uses `INBOX.` namespace prefix, set this. * [[setting,imapc_host,remotehost]] * Remote hostname. * [[setting,imapc_ssl,imaps]] and [[setting,imapc_port,993]] * Set, if using TLS. * [[setting,imapc_ssl,starttls]] and [[setting,imapc_port,143]] * Set, if using STARTTLS. * [[setting,ssl_client_ca_dir,/etc/ssl/certs]] or [[setting,ssl_client_ca_file,/etc/ssl/ca-certificates.pem]] * These default to system. Master password auth: ```doveconf[dovecot.conf] imapc_user = %{user} imapc_password = supersecret ``` Master user auth: ```doveconf[dovecot.conf] imapc_user = %{user} imapc_master_user = master-user imapc_password = master-password ``` Individual password auth: ```doveconf[dovecot.conf] imapc_user = %{user} # doveadm -o imapc_password=password backup -Ru user imapc: ``` You can verify that the settings are done correctly with: ```sh doveadm -o imapc_password=password -o mail_driver=imapc -o mail_path= mailbox list -u user ``` ### POP3 notes If you need to retain POP3 support on your new system, you should use [[plugin,pop3-migration]]. ```doveconf[dovecot.conf] pop3c_host = hostname # Authenticate as masteruser / masteruser-secret, but use a separate login # user. # If you don't have a master user, remove the pop3c_master_user setting. pop3c_user = %{user} pop3c_master_user = masteruser pop3c_password = masteruser-secret # if you are using TLS pop3c_ssl = pop3s pop3c_port = 995 # if you are using StartTLS pop3c_ssl = starttls pop3c_port = 110 namespace pop3-migration { prefix = POP3-MIGRATION-NS/ mail_driver = pop3c mail_path = list = no hidden = yes } protocol doveadm { mail_plugins { pop3_migration = yes } } pop3_migration_mailbox = POP3-MIGRATION-NS/INBOX ``` You can alternatively configure compatible UIDL format in Dovecot. See [[setting,pop3_uidl_format]]. ### Executing Migration To migrate users, use: ```sh doveadm -o imapc_password=bar -o pop3c_password=bar backup -Ru user imapc: ``` If you are experiencing problems, enable debugging with the `-D` parameter: ```sh doveadm -D -o imapc_password=bar -o pop3c_password=bar backup -Ru username imapc: ``` The doveadm backup command forces the destination to look exactly like the source, deleting mails and mailboxes if necessary. If it's possible that the destination already has new mails (or other changes), use [[doveadm,sync,-1]] instead: ```sh doveadm -o imapc_password=bar -o pop3c_password=bar sync -1Ru user imapc: ``` Note that Public and Shared namespaces are synchronized automatically (see caveats). See [[link,doveadm_error_codes]] for details on how to handle errors. #### Caveats * You cannot migrate **to** imap, only from. #### POP3 Caveats * POP3 message order (when it's different from IMAP message order) is not preserved with [[link,mbox]]. * If source POP3 server merges multiple IMAP mailboxes into one POP3 INBOX, the migration won't be transparent. * If source IMAP and POP3 servers return messages somehow differently, [[plugin,pop3-migration]] might not be able to match the messages * Don't trust the migration tools blindly. Verify manually that the UIDLs are correct before exposing real clients to Dovecot. You can do this by logging in using your old POP3 server, issuing UIDL command and saving the output. Then log in using Dovecot and save its UIDL output as well. Use e.g. `diff` command to verify that the lists are identical. Note that: * If a client already saw changed UIDLs and decided to start re-downloading mails, it's unlikely there is anything you can do to stop it. Even going back to your old server is unlikely to help at that point. * Some (many?) POP3 clients also require that the message ordering is preserved. * Some clients re-download all mails if you change the hostname in the client configuration. Be aware of this when testing. ## Migration from Gmail to Dovecot You can use dsync migration via IMAP protocol, but there are a few things different with Gmail compared to other IMAP servers. With Gmail, when you delete a mail from POP3, the mail is only hidden from future POP3 sessions, but it's still available via IMAP. If you wish to preserve this functionality, there's a [[setting,pop3_deleted_flag]] setting. Gmail has labels. If a message has multiple labels, it shows up in multiple IMAP folders, but it's still the same message and uses quota only once for that message. Dovecot currently doesn't have label support, so the migration will copy the message to multiple folders and each instance will use up quota. There's currently no easy fix for this. Even though the quota is duplicated, it doesn't mean that the storage usage has to be duplicated. Use the doveadm sync's `-a` parameter to attempt to copy mails with the same GUIDs. A virtual `All Mails` mailbox needs to be configured using the virtual plugin. Then you need to give this mailbox as `-a` parameter, e.g.: ``` doveadm sync -a "Virtual/All Mails" ... ``` Currently this is implemented by reading through all the GUIDs in the virtual mailbox. This of course isn't very efficient for things like incremental replication. Gmail has virtual folders: `All Mail`, `Starred` and `Important`. From migration point of view, this means that the migration should skip most of these folders, since their mails are in other folders anyway. You can tell dsync to skip these folders: ``` doveadm sync -x '\Flagged' -x '\Important' ``` By using the `\flag` parameters, dsync finds the folders by their `SPECIAL-USE` flag rather than their name (which may be different for users depending on their language). The `All Mail` folder contains also "archived mails" that don't exist in any other folder. These mails need to be migrated. See below. Google requires that SSL/TLS be enabled to connect through IMAP. See [migrating messages over IMAP](#migrating-messages-over-imap) for information on the various SSL/TLS related flags. Google has very limited support for username/password authentication, so you might have to use OAUTH2 or some other mechanism for logging in. ### GMail Migration Feature There is a [[setting,imapc_features,gmail-migration]] setting that helps with GMail migration. It will: * Set the [[setting,pop3_deleted_flag]] to mails that no longer exist in POP3. * Return POP3 UIDL in GMail format so dsync can preserve it. * Add a new `$GmailHaveLabels` keyword to archived mails in the `\All` mailbox, which means those mails are not archived. You probably don't want to migrate these mails. * Note that mails in the `\Important` and `\Flagged` mailboxes are marked with `\Important` and `\Starred` labels. If you don't migrate mails that have `$GmailHaveLabels` then you must not exclude the `\Flagged` and `\Important` mailboxes or some of the mails won't be migrated. For example use a command line: ```sh doveadm backup -a 'virtual/All' -O '-$GmailHaveLabels' -R -u user@domain imapc: ``` ## Optimizing Synchronization The `-s` (state) parameter can be used to significantly improve performance for incremental migrations. By using a "sync state string", dsync can avoid a full mailbox scan and only synchronize the changes that have occurred since the last synchronization. ### How it Works When you run dsync with the `-s` parameter, it will perform the synchronization as usual. At the end of the operation, doveadm will output a state string. This string is a snapshot of the mailbox's state. By providing this state string in the subsequent dsync call using the `-s` parameter, doveadm can avoid a full mailbox scan and instead only synchronize the changes that have occurred since the last synchronization. This can significantly reduce the time and resources required for the sync operation. ### Example Usage 1. **Initial sync:** ```sh doveadm sync -s "" ``` After the initial sync, doveadm will return a state string. 2. **Subsequent syncs:** Save the state string from the previous sync and use it in the next one: ```sh doveadm sync -s "" ``` This will perform an incremental sync based on the provided state. # Process Titles When [[setting,verbose_proctitle,yes]], Dovecot adds various extra information to its process titles. Besides the various self-descriptive command states, there are the following: ## Generic ### `[initializing]` [[added,process_title_initializing]] The process is still starting up and isn't yet ready to accept connections. This can especially happen if the process is still attempting to connect to the stats socket. ### `[idling]` The process is not doing anything except waiting for a client to be served. ### `[blocking on log write]` The log process is busy and not reading this process's logs. Try to debug (strace) the log process to see why. ## Log Process ### `[service too fast: FD/LISTEN_FD/LOG_PREFIX]` One specific service is sending logs faster than we can write them. The LOG_PREFIX is usually enough to identify the service. If not, the FD and LISTEN_FD can in theory be used to calculate which service it is. ### `[N services too fast, last: FD/LISTEN_FD/LOG_PREFIX]` Multiple services are sending logs faster than we can write them. The last service's information is shown. ### `[N services too fast]` Multiple services are sending logs faster than we can write them, but there is no additional information about which ones specifically. ## Mail Processes [[added,process_title_mail_processes]] This means imap, pop3, submission and managesieve processes. ### `[waiting on client]` Login process connected to the mail process, but it hasn't finished sending the request. ### `[auth lookup]` Mail process is waiting on auth process to finish userdb lookups. ### `[post-login script]` Mail process is waiting on post-login scripts to finish. ## IMAP Process [[added,process_title_imap_process]] ### `[waiting on unhibernate client]` imap-hibernate process connected to the imap process, but it hasn't finished sending the request. ### `[unhibernating]` The imap connection is still being unhibernated. # Rawlog Dovecot supports logging IMAP/POP3/LMTP/SMTP(submission) traffic (also TLS/SSL encrypted). There are several possibilities for this: 1. [[setting,rawlog_dir]] 2. Pre-login \*-login process via `-R` parameter. See below. 3. For proxying (in \*-login processes), use [[setting,login_proxy_rawlog_dir]]. 4. For lmtp, you need to use [[setting,lmtp_rawlog_dir]] and [[setting,lmtp_proxy_rawlog_dir]] settings. 5. For submission, you need to use [[setting,rawlog_dir]] and [[setting,submission_relay_rawlog_dir]] settings. 6. Using rawlog binary, which is executed as post-login script. This is the legacy method, which shouldn't be necessary anymore. See below. ## Pre-login Rawlog The pre-login rawlog is used before IMAP, POP3, Submission or ManageSieve client logs into the post-login process. Note that LMTP and doveadm protocols don't have a pre-login process. ::: info SSL/TLS sessions are currently not decrypted to rawlogs. ::: You can enable pre-login rawlog for all users by telling the login processes to log to a rawlog directory: ```doveconf[dovecot.conf] service imap-login { executable = imap-login -R rawlogs } ``` This attempts to write the rawlogs under `$base_dir/login/rawlogs` directory. You need to create it first with enough write permissions: ```sh mkdir /var/run/dovecot/login/rawlogs chown dovenull /var/run/dovecot/login/rawlogs chmod 0700 /var/run/dovecot/login/rawlogs ``` ## rawlog Binary This is the legacy method. [[setting,rawlog_dir]] is preferred nowadays. This works by checking if `dovecot.rawlog/` directory exists in the logged in user's home directory, and writing the traffic to `yyyymmdd-HHMMSS-pid.in` and `.out` files. Each connection gets their own in/out files. Rawlog will simply skip users who don't have the `dovecot.rawlog/` directory and the performance impact for those users is minimal. ### Home Directory ::: info For rawlog binary to work, your userdb must have returned a home directory for the user. ::: ::: warning The home directory must be returned by userdb, [[setting,mail_home]] won't work. Verify that [[doveadm,user,-u user@example.com]] returns the home directory, for example: ```sh doveadm user -u user@example.com ``` ``` userdb: user@example.com user : user@example.com uid : 1000 gid : 1000 home : /home/user@example.com ``` In the above configuration, rawlog would expect to find `/home/user@example.com/dovecot.rawlog/` directory writable by uid `1000`. ::: If your userdb can't return a home directory directly, you can add: ```doveconf[dovecot.conf] userdb db1 { # ... fields { home = /home/%{user} # or temporarily even e.g. home = /tmp/temp-home } } ``` You can also set `DEBUG` environment to have rawlog log an info message why it's not doing anything: ```doveconf[dovecot.conf] import_environment { DEBUG = 1 } ``` See [[setting,import_environment]]. ### Configuration To enable rawlog binary, use post-login scripting: ```doveconf[dovecot.conf] service imap { executable = imap postlogin } service pop3 { executable = pop3 postlogin } service postlogin { executable = script-login -d rawlog unix_listener postlogin { } } ``` You can also give parameters to rawlog: * `-b`: Write IP packet boundaries (or whatever read() sees anyway) to the log files. The packet is written between <<< and >>>. * `-t`: Log a microsecond resolution timestamp at the beginning of each line. * `-I`: Include IP address in the filename. * `-f in`: Log only to `*.in` files. * `-f out`: Log only to `*.out` files. # Running Dovecot ## Starting Dovecot can simply be started by running dovecot as root. If there are any problems, they're usually written to terminal, but they may also be written to error log at page [[link,logging]] as well. * See [[link,startup_scripts]] ## Stopping Killing the Dovecot master process with a normal TERM signal does a clean shutdown. This can be done easily with [[doveadm,stop]]. [[setting,shutdown_clients]] controls whether existing IMAP and POP3 sessions are killed. If you are using systemd, you need to set: ``` [Service] KillMode=none ExecStop=/usr/bin/doveadm stop ``` to avoid systemd from killing processes on restart. ## Processes When Dovecot is running, it uses several processes: ```sh ps auxw|grep "dovecot" ``` ``` root 7245 0.1 0.1 2308 1096 pts/0 S+ 19:53 0:00 dovecot dovecot 7246 0.0 0.0 2084 824 pts/0 S+ 19:53 0:00 dovecot/anvil root 7247 0.0 0.0 2044 908 pts/0 S+ 19:53 0:00 dovecot/log root 7250 0.0 0.3 4988 3740 pts/0 S+ 19:53 0:00 dovecot/config root 7251 0.0 0.2 10024 2672 pts/0 S+ 19:53 0:00 dovecot/auth root 7303 0.6 0.3 10180 3116 pts/0 S+ 19:57 0:00 dovecot/auth -w vmail 7252 0.0 0.1 3180 1264 pts/0 S+ 19:53 0:00 dovecot/imap vmail 7255 0.0 0.1 3228 1596 pts/0 S+ 19:54 0:00 dovecot/pop3 dovenull 7260 0.0 0.1 4028 1940 pts/0 S+ 19:54 0:00 dovecot/imap-login dovenull 7262 0.0 0.1 4016 1916 pts/0 S+ 19:54 0:00 dovecot/pop3-login ``` * `dovecot` process is the Dovecot master process which keeps everything running. * `anvil` keeps track of user connections. * `log` writes to log files. All logging, except from master process, goes through it. * `config` parses the configuration file and sends the configuration to other processes. * `auth` handles all authentication. * `auth -w` process is an authentication worker process. It's used only with some "blocking" authentication databases, such as [[link,auth_sql]]. * `imap-login` and `pop3-login` processes handle new IMAP and POP3 connections until user has logged in. They also handle proxying SSL connections even after login. * `imap` and `pop3` processes handle the IMAP and POP3 connections after user has logged in. ## Reloading Configuration Sending HUP signal to Dovecot reloads configuration. This can be done easily with: [[doveadm,reload]]. An acknowledgement is written to log file. ## Running Multiple Invocations of Dovecot You may wish to invoke a second session (or even multiple sessions) of Dovecot for testing different functionality, configurations, etc. In order to run multiple instances of Dovecot, you must: 1. Create a differently named copy of the `dovecot.conf` configuration file with these changes: 1. Change [[setting,base_dir]] to the new run directory. 2. Change services' `inet_listener` port numbers to new, unused values. 3. Optionally, change `instance_name` to show a different "dovecot/" prefix in ps output. 4. If you're using authentication sockets (for SMTP AUTH or deliver), you'll need to change them as well. [[setting,auth_socket_path]] specifies the socket path for deliver. * Alternatively, if all the instances have identical authentication configuration, you can have only a single Dovecot instance serve the auth sockets and have the other instances use them. 2. Invoke dovecot (and dovecot-lda) with the `-c` parameter and the modified configuration file, e.g.: `dovecot -c /usr/local/etc/dovecot2.conf` 3. In order to tell the logs apart, you can set different log facilities for the instances, e.g., `syslog_facility=local6`, then configure syslogd to write local6 into "dovecot-otherinstance.log". Alternatively specify the log paths directly in [[setting,log_path]] and related settings. ## Rotating Log Files If you specified log file paths manually in `dovecot.conf` instead of using syslog, you can send USR1 signal to Dovecot to make it close and reopen the log files. This can be done with: [[doveadm,log reopen]]. ## Troubleshooting If you can't see the Dovecot processes running after starting dovecot, something is most likely wrong in your dovecot.conf. Look at the error from Dovecot's log file. See [[link,logging]] for how to find the log. If you really can't find any error messages from any logs, try starting Dovecot with `dovecot -F`. If you see it crash like: `sh: segmentation fault (core dumped) dovecot -F` Then it's a bug in Dovecot. Please report it with your configuration file. If it simply quits without giving any error, then it wrote the error to a log file and you just didn't find it. Try specifying the log file manually and make sure you're really looking at the correct file. See also [[link,troubleshooting]]. # SASL SASL stands for "Simple Authentication and Security Layer". SASL itself is nothing more than a list of requirements for [[link,authentication_mechanisms]] and protocols to be SASL-compatible as described in [[rfc,4422]]. IMAP, POP3, SMTP, and ManageSieve protocols all have support for SASL. Many people confuse SASL with one specific SASL implementation: the Cyrus SASL library. Dovecot has its own SASL implementation which could (one day) be separated from Dovecot itself to "compete" against Cyrus SASL library as an alternative implementation. Dovecot can be used as the SASL server for several external SMTP/Submission servers. See [[link,howto_virtual_smtp_auth]]. # Testing ## Check Local Installation ### Check Dovecot is Running First check with `ps` that the `dovecot` process is actually running. If it's not, you had an error in `dovecot.conf` and the error message was written to log. Go back to [[link,running_dovecot]] and [[link,logging]] if you can't find it. ### Check Dovecot is Listening Next check that Dovecot is listening for connections: ```sh nc localhost 143 ``` ``` Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. ``` If you got "connection refused", make sure that Dovecot is configured to serve the imap protocol and listening on the expected interfaces/addresses. The simplest way to do that would be using [[man,doveconf]]: ```sh doveconf protocols listen ``` ```doveconf[dovecot.conf] protocols = imap pop3 lmtp sieve listen = *, :: ``` If the protocols setting doesn't contain `imap` then add it. Also make sure, that relevant `!include` or `!include_try` configuration lines are not commented. If the connection fails and dovecot emits a log "*auth: Fatal: Support not compiled in for passdb driver 'pam'*", then rebuild dovecot with the pam development headers package installed. In that case you have to re-run the configure script, possibly including option **--with-pam** to the configure command line. Next check that it also works from remote host: ```sh nc imap.example.com 143 ``` ``` Trying 1.2.3.4... Connected to imap.example.com. Escape character is '^]'. * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE STARTTLS AUTH=PLAIN] Dovecot ready. ``` If that didn't work, check all possible firewalls in between, and check that `listen` setting is `*` in `dovecot.conf`. If you have only imaps enabled, see [remote login](#check-dovecot-is-allowing-remote-logins) for how to test using `openssl s_client`. ### Check Dovecot is Allowing Logins ```sh nc localhost 143 ``` ``` a login "username" "password" ``` Replace the username and password with your local authentication credentials. Note that all IMAP commands begin with a tag, which is basically any string you want, but it must be there. So don't leave out the "a" in the above example. If the password contains `"` character, escape it with `\\` (e.g. `"foo\"bar"`). You should get an "a OK Logged in." reply. If you get "Authentication failed" error, set [[setting,auth_verbose,yes]] and [[setting,log_debug,category=auth]] in `dovecot.conf`, restart Dovecot and try again. The log file should now show enough information to help you fix the problem. ### Check Dovecot is Allowing Remote Logins You'll need to try this from another computer, since all local IPs are treated as secure: ```sh nc imap.example.com 143 ``` ``` a login "username" "password" ``` If the connection is hanging instead of giving "\* Dovecot ready", you have a firewall that's preventing the connections. Otherwise, the only difference here compared to step above is that you might get: ``` * BAD [ALERT] Plaintext authentication is disabled, but your client sent password in plaintext anyway. If anyone was listening, the password was exposed. a NO Plaintext authentication disabled. ``` If this is the case, you didn't set [[setting,auth_allow_cleartext,yes]]. You could alternatively use OpenSSL to test that the server works with SSL: - Test using imaps port (assuming you haven't disabled imaps port): ```sh openssl s_client -connect imap.example.com:993 ``` ``` * OK Dovecot ready. ``` - Test using imap port and STARTTLS command (works also with imap port): ```sh openssl s_client -connect imap.example.com:143 -starttls imap ``` ``` * OK Dovecot ready. ``` Check Dovecot Finds INBOX After logging in, check that the INBOX is found: ``` b select inbox * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) * OK [PERMANENTFLAGS (\Answered \Flagged \Deleted \Seen \Draft \*)] Flags permitted. * 1 EXISTS * 1 RECENT * OK [UIDVALIDITY 1106186941] UIDs valid * OK [UIDNEXT 2] Predicted next UID b OK [READ-WRITE] Select completed. ``` If anything goes wrong, set [[setting,log_debug,category=mail]] and try again. The log file should now contain debugging information of where Dovecot is trying to find the mails. Fix the [[link,mail_location]] and try again. ### Check Dovecot Finds Other Mailboxes If you already have other mailboxes created, you can check that Dovecot finds them: ``` c list "" * * LIST (\NoInferiors) "/" "test" * LIST (\NoInferiors) "/" "INBOX" c OK List completed. ``` If they weren't found, set [[setting,log_debug,category=mail]] and look at the debugging information. Fix the [[link,mail_location]] and try again. ### Check Other IMAP Commands If you already have some emails, you can try reading them: ``` 1 SELECT INBOX 2 FETCH 1:* (FLAGS INTERNALDATE BODY.PEEK[HEADER.FIELDS (SUBJECT)]) 3 FETCH 1 BODY[TEXT] ``` `1:*` means all messages You can also try moving a mail to Trash: ``` 4 CREATE Trash 5 COPY 1 Trash 6 STORE 1 +FLAGS \Deleted 7 EXPUNGE ``` ### Check Mail Clients Work Since mail clients can be configured in various ways, please check first if the problem is with Dovecot configuration or with the client's configuration. You can rule out it being Dovecot's problem with the "telnet" methods described above. If you can't log in, - Make sure SSL/TLS settings are correct. - Make sure the client uses plaintext authentication method, unless you've specifically configured Dovecot to accept others. If you can see only INBOX, - Clear out any "IMAP namespace prefix" or similar settings from clients. - Check if client is configured to show only "subscribed mailboxes". If so, you'll have to subscribe to the mailboxes you wish to see. You can see a list of subscribed mailboxes with: ``` d lsub "" * * LSUB () "/" "INBOX" d OK Lsub completed. ``` Most IMAP clients have been tested with Dovecot and they work. ### Gracefully Exit Session To close the connection to Dovecot issue a logout: ``` e logout * BYE Logging out e OK Logout completed. ``` ## Functional & Performance Testing Easiest way to test Dovecot is to use [ImapTest](https://dovecot.github.io/imaptest/). It can be used to flood a server with random commands and it can also attempt to mimic a large number of real-world clients. ### Test Preparation System configuration * Make sure your firewall is configured to allow incoming connections for the following tcp ports: 24, 110, 143, 993, 995, 4190. * Ensure ulimit is high enough to accept all the connections and open files. ### Dovecot Configuration Enable LMTP delivery times in the configuration: ```doveconf[dovecot.conf] deliver_log_format = msgid=%{msgid} from=<%{from}> size=%{size} vsize=%{vsize} session=%{session_time}ms delivery=%{delivery_time}ms: %{message} ``` You can then see log entries like: ``` Oct 06 12:40:13 lmtp(testuser_717@example.com): Info: iQBSCwulE1ZXMwAA0J78UA: msgid=unspecified from= size=155980 vsize=157963 session=161ms delivery=134ms: saved mail to INBOX ``` Increase the maximum user connections per IP [[setting,mail_max_userip_connections,1000]]. ### Troubleshooting You might run into problems where you have too few services running and you need to increase the number of services and/or modify client limit for the following: * auth * imap * pop3 * lmtp ### Sample Tests #### Functional Testing Simple imaptest to cover the basics: ```sh timeout 10s imaptest pass=supersecret host=127.0.0.1 mbox=testmbox.sm40k \ user=testuser1 Fetch2=100 store=100 delete=100 expunge=100 clients=1 ``` Check the output for errors. Verify that messages exist in INBOX: [[doveadm,mailbox status,-u testuser1 all INBOX]]. Copy a message with doveadm: [[doveadm,copy,-u testuser1 Trash mailbox INBOX 1]]. Copy messages with imaptest: ```sh imaptest pass=supersecret host=127.0.0.1 mbox=testmbox.sm40k user=testuser1 \ copybox=Trash ``` Move a message: [[doveadm,move,-u testuser1 Trash mailbox INBOX 1]]. #### Performance Testing: Test rapid delivery of lots of messages via IMAP APPEND (100k test users) ```sh imaptest - user=testuser%d pass=testpass mbox=testmbox append=100,0 logout=0 \ users=100000 clients=500 msgs=100000 no_pipelining secs=10 ``` Test rapid delivery of lots of messages via LMTP: ::: code-group ```sh[Command] imaptest profile=imaptest.profile mbox=testmbox secs=10 ``` ```[imaptest.profile] lmtp_port = 24 lmtp_max_parallel_count = 500 # Set to ~50-60% of total_user_count total_user_count = 800 rampup_time = 0s user lmtptest { username_format = testuser%{num} count = 100% mail_inbox_delivery_interval = 1s mail_spam_delivery_interval = 0 mail_action_delay = 0 mail_action_repeat_delay = 0 mail_session_length = 0 mail_send_interval = 0 mail_write_duration = 0 mail_inbox_reply_percentage = 0 mail_inbox_delete_percentage = 0 mail_inbox_move_percentage = 0 mail_inbox_move_filter_percentage = 0 } client lmtponly { count = 100% } ``` ::: #### Load Testing: 1h mixed test against proxy (10.41.1.135) with 2m users and 200 clients: ```sh timeout 1h imaptest pass=testpassword host=10.41.1.135 mbox=testmbox \ user=testuser%d users=1-2000000 Fetch2=100 store=100 delete=90 expunge=100 \ clients=200 ``` 8hr mixed test with 2m users; generally this would be run against multiple proxies (host=proxy ip) from multiple imaptest nodes. ```sh timeout 8h imaptest pass=testpassword host=127.0.0.1 mbox=testmbox \ user=testuser%d users=1-2000000 Fetch2=100 store=100 delete=90 expunge=100 \ clients=100 ``` ##### POP3 + LMTP Testing ::: code-group ```sh[Command] imaptest pass=testpassword mbox=testmbox.sm40k profile=pop3_2m_profile.conf \ no_tracking clients=10000 ``` ```[pop3_2m_profile.conf] lmtp_port = 24 lmtp_max_parallel_count = 1800 total_user_count = 2000000 rampup_time = 600s user pop3 { username_format = testuser%{num | fill('0', 7)} username_start_index = 1 count = 100% mail_inbox_delivery_interval = 1h mail_spam_delivery_interval = 0 mail_action_delay = 30s mail_action_repeat_delay = 1s } client pop3 { count = 70% connection_max_count = 1 protocol = pop3 pop3_keep_mails = no login_interval = 1m } client pop3 { count = 30% connection_max_count = 1 protocol = pop3 pop3_keep_mails = yes login_interval = 5min } ``` ::: ##### IMAP + LMTP Testing ::: code-group ```sh[Command] imaptest pass=testpassword mbox=testmbox profile=imap_4m_profile.conf \ clients=10000 ``` ```[imap_4m_profile.conf] lmtp_port = 24 lmtp_max_parallel_count = 15000 total_user_count = 4000000 rampup_time = 60s user imap_poweruser { username_format = testuser%{num | fill('0', 7)} username_start_index = 2000000 count = 50% mail_inbox_delivery_interval = 10m mail_spam_delivery_interval = 0s mail_action_delay = 1s mail_action_repeat_delay = 0 mail_session_length = 5s mail_send_interval = 2h mail_write_duration = 2m mail_inbox_reply_percentage = 50 mail_inbox_delete_percentage = 50 mail_inbox_move_percentage = 35 mail_inbox_move_filter_percentage = 10 } user imap_normal { username_format = testuser%7n username_start_index = 1 count = 50% mail_inbox_delivery_interval = 1h mail_spam_delivery_interval = 0 mail_action_delay = 3 min mail_action_repeat_delay = 10s mail_session_length = 30s mail_send_interval = 3h mail_write_duration = 2 min mail_inbox_reply_percentage = 5 mail_inbox_delete_percentage = 80 mail_inbox_move_percentage = 5 mail_inbox_move_filter_percentage = 10 } client Thunderbird { count = 60% connection_max_count = 1 imap_idle = yes imap_fetch_immediate = UID RFC822.SIZE FLAGS BODY.PEEK[HEADER.FIELDS (From To Cc Bcc Subject Date Message-ID Priority X-Priority References Newsgroups In-Reply-To Content-Type)] imap_fetch_manual = RFC822.SIZE BODY[] } client AppleMail { count = 40% connection_max_count = 1 imap_idle = yes imap_fetch_immediate = INTERNALDATE UID RFC822.SIZE FLAGS BODY.PEEK[HEADER.FIELDS (date subject from to cc message-id in-reply-to references x-priority x-uniform-type-identifier x-universally-unique-identifier)] MODSEQ imap_fetch_manual = BODYSTRUCTURE BODY.PEEK[] } ``` ::: ##### Generate Read Load (BODY FETCHs): ```sh imaptest - user=testuser%d select=100 fetch2=100,0 logout=0 clients=10 \ msgs=100000 no_pipelining users=400 no_tracking ``` # Timeouts Dovecot has a lot of timeouts in various components. Most of them have hardcoded values, because there's normally no need to change them. ## Protocol Proxies - Dovecot proxy handles IMAP, POP3 and Submission pre-login timeouts and invalid error command handling the same as Dovecot backend. After login the proxy will continue proxying until the client or the backend disconnects. - Connect timeout to backend is governed by [[setting,login_proxy_timeout]], which is 30 seconds by default. Can be overridden by `proxy_timeout` passdb extra field. - After connection has been established, there's still a login timeout `CLIENT_LOGIN_TIMEOUT_MSECS = MASTER_LOGIN_TIMEOUT_SECS*1000` = 3 minutes ([`login-common/client-common.h`](https://github.com/dovecot/core/blob/main/src/login-common/client-common.h#L33) and [`lib-master/master-interface.h`](https://github.com/dovecot/core/blob/main/src/lib-master/master-interface.h#L120)). ## IMAP - Before login: `CLIENT_LOGIN_TIMEOUT_MSECS = MASTER_LOGIN_TIMEOUT_SECS*1000` = 3 minutes (the same as proxies). - This may be shorter if all the available connections are in use `[[link,service_configuration,service imap-login { client_limit * process_limit }]]`. In that case the oldest non-logged in connection is disconnected. - After login: `CLIENT_IDLE_TIMEOUT_MSECS` = 30 minutes (minimum required by [[rfc,2060,5.4]]) - If IDLE command is started, Dovecot never disconnects. Only if the connection is lost there will be a disconnection. A dead connection is detected by Dovecot periodically sending "I'm still here" notifications to client ([[setting,imap_idle_notify_interval]], default every 2 minutes). - IMAP clients are supposed to send something before 30 minutes are up, but several clients don't do this. Some Outlook versions even stop receiving new mails entirely until manual intervention if IMAP server disconnects the client. - Dovecot also disconnects an IMAP client that sends too many invalid commands: - Before login: Disconnect on 3rd invalid command (`CLIENT_MAX_BAD_COMMANDS` in [`imap-login/imap-login-client.c`](https://github.com/dovecot/core/blob/main/src/imap-login/imap-login-client.c#L29). - After login: Disconnect on 20th invalid command (`CLIENT_MAX_BAD_COMMANDS` in [`imap/imap-common.h`](https://github.com/dovecot/core/blob/main/src/imap/imap-common.h#L14). ## POP3 - Before login: `CLIENT_LOGIN_TIMEOUT_MSECS = MASTER_LOGIN_TIMEOUT_SECS*1000` = 3 minutes (same as proxies). - This may be shorter if all the available connections are in use (`service pop3-login { client_limit * process_limit }`). In that case the oldest non-logged in connection is disconnected. - After login: `CLIENT_IDLE_TIMEOUT_MSECS` = 10 minutes ([`pop3/pop3-client.c`](https://github.com/dovecot/core/blob/main/src/pop3/pop3-client.c#L34). - Dovecot also disconnects an POP3 client that sends too many invalid commands: - Before login: Disconnect on 3rd invalid command (`CLIENT_MAX_BAD_COMMANDS` in [`pop3-login/client.c`](https://github.com/dovecot/core/blob/main/src/pop3-login/client.c#L25). - After login: Disconnect on 20th invalid command (`CLIENT_MAX_BAD_COMMANDS` in [`pop3/pop3-client.c`](https://github.com/dovecot/core/blob/main/src/pop3/pop3-client.c#L33). ## Submission and LMTP - Before login: `CLIENT_LOGIN_TIMEOUT_MSECS = MASTER_LOGIN_TIMEOUT_SECS*1000` = 3 minutes (submission, same as proxies). - This may be shorter if all the available connections are in use (`service submission-login { client_limit * process_limit }`). In that case the oldest non-logged in connection is disconnected. - After login: `CLIENT_IDLE_TIMEOUT_MSECS` = 5 minutes for LMTP and 10 minutes for Submission. [`lmtp/lmtp-client.c`](https://github.com/dovecot/core/blob/main/src/lmtp/lmtp-client.c#L28) and [`submission/submission-client.c`](https://github.com/dovecot/core/blob/main/src/submission/submission-client.c#L43). - Dovecot also disconnects an SMTP client that sends too many invalid commands: - Before login: Disconnect on 10th invalid command. (`CLIENT_MAX_BAD_COMMANDS` in [`submission-login/client.c`](https://github.com/dovecot/core/blob/main/src/submission-login/client.c#L23). - After login: Disconnect on 20th invalid command (`CLIENT_MAX_BAD_COMMANDS` in [`submission/submission-client.c`](https://github.com/dovecot/core/blob/main/src/submission/submission-client.c#L40). # Basic Configuration This page highlights some common authentication-related settings that may need to be set on your system. ## General Settings ### `auth_mechanisms` [[setting,auth_mechanisms,plain login]] Enables the `PLAIN` and `LOGIN` authentication mechanisms. The `LOGIN` mechanism is obsolete, but still used by old clients. ### `auth_verbose` [[setting,auth_verbose,yes]] Log a line for each authentication attempt failure. ### `auth_verbose_passwords` [[setting,auth_verbose_passwords,sha1:6]] Log the password hashed and truncated for failed authentication attempts. For example the SHA1 hash for "pass" is `9d4e1e23bd5b727046a9e3b4b7db57bd8d6ee684` but because of the setting of `:6` we only log `9d4e1e`. This can be useful for detecting brute force authentication attempts without logging the users' actual passwords. ### Authentication Penalty See [[link,auth_penalty]]. ### `auth_cache_size` [[setting,auth_cache_size,100M]] Specifies the amount of memory used for authentication caching (passdb and userdb lookups). ### `imap_id_retain` [[setting,imap_id_retain,yes]] If `imap_id_retain=yes`, imap-login will send the IMAP ID string to auth process. The variable `%{client_id}` will expand to the IMAP ID in the auth process. The ID string is also sent to the next hop when proxying. This allows passing the ID string to [[link,auth_policy]] requests ## Authentication After Proxies This section describes authentication tactics that can be used if an architecture is used where an edge Proxy authenticates a user and then redirects to an internal Backend. ::: tip Proxy already verifies the authentication (in the reference Dovecot architecture; password has been switched to a master password at this point), so we don't really need to do it again. We could, in fact, even avoid the password checking entirely, but for extra security it's still done in this document. ::: ### `auth_mechanisms` [[setting,auth_mechanisms,plain login]] Enables the `PLAIN` and `LOGIN` authentication mechanisms. The `LOGIN` mechanism is obsolete, but still used by some older clients. ### Authentication Penalty See [[link,auth_penalty]] for how to disable authentication penalty. The proxy already handled this. ### `auth_cache_size` [[setting,auth_cache_size,100M]] Specifies the amount of memory used for authentication caching (passdb and userdb lookups). ### `login_trusted_networks` [[setting,login_trusted_networks,10.0.0.0/24]] Space-separated list of IP/network ranges that contain the Dovecot Proxies. This setting allows Proxies to forward the client's original IP address and session ID to the Backends. ### `mail_max_userip_connections` [[setting,mail_max_userip_connections,10]] Maximum number of simultaneous IMAP4 or POP3 connections allowed for the same user from the same IP address (`10` = 10 IMAP + 10 POP3). ### SSL [[setting,ssl,no]], [[setting,auth_allow_cleartext,yes]] `Proxy` already decrypted the SSL connections. The Backends will always see only unencrypted connections (unless internal connections are also configured to use SSL). # Authentication Caching Dovecot supports caching the results of [[link,passdb]] and [[link,userdb]] lookups. The following rules apply to using the authentication cache: - Data is used from the cache if it's not expired ([[setting,auth_cache_ttl]] setting) - If authentication fails this time, but it didn't fail last time, it's assumed that the password has changed and a database lookup is done. - If a database lookup fails because of some internal error, but data still exists in the cache (even if expired), the cached data is used. This allows Dovecot to log in some users even if the database is temporarily down. The authentication cache can be flushed with the [[doveadm,auth cache flush]] command. The [[doveadm,auth cache status]] command shows the number of cache hits and misses, hit ratio, and cache size. You can use that information for tuning the cache size and TTL. Pass `--reset` to clear the hit/miss counters after reading them. ## Settings ::: tip It should be pretty safe to set very high TTLs, because the only field that usually can change is the user's password, and Dovecot attempts to catch those cases (see the rules above). ::: ## Password Changing Scenarios ## Normal 1. User logs in with password X. The password X is added to cache and login succeeds. 2. Password is changed to Y. 3. User logs in with password Y. The cached password X doesn't match Y, but since the previous authentication was successful Dovecot does another backend passdb lookup to see if the password changed. It did, so the password Y is cached and login succeeds. ## Old Cached Password 1. User logs in with password X. The password X is added to cache and login succeeds. 2. Password is changed to Y. 3. User logs in with password X. The cached password X matches X, so login succeeds. ## Early Change 1. User logs in with password X. The password X is added to cache and login succeeds. 2. User logs in with password Y. The cached password X doesn't match Y, but since the previous authentication was successful Dovecot does another backend passdb lookup to see if the password changed. It didn't, so the login fails. 3. Password is changed to Y. 4. User logs in with password Y. The cached password X doesn't match Y and the previous authentication was unsuccessful, so Dovecot doesn't bother doing another backend passdb lookup (until cache TTL expires). The login fails. # BSDAuth (`bsdauth`) ::: warning BSDAuth is deprecated. It will be maintained on a best-effort basis for Dovecot CE, based on community patches. Users are strongly advised to use [[link,auth_pam]] instead. ::: This is similar to [[link,auth_pam]], but used by OpenBSD. It supports `cache_key` parameter the same way as PAM. # Authentication via Remote IMAP Server (`imap`) ## Settings [[removed,auth_imap_arg_configuration_removed]]: The arg-based driver settings have been removed in favor of using the standard `imapc_*` settings. [[removed,settings_ssl_imapc_removed]]: The `ssl_ca_file`, `ssl_ca_dir` and `allow_invalid_cert` settings have been removed. The standard `ssl_*` settings can be used instead (also inside `passdb { ... }` if wanted). ## Example Authenticates users against remote IMAP server in IP address 192.168.1.123: ```doveconf[dovecot.conf] passdb imap { imapc_host = 192.168.1.123 imapc_port = 143 imapc_user = %{owner_user} imapc_rawlog_dir = /tmp/imapc_rawlog/ imapc_ssl = starttls ssl_client_require_valid_cert = no } ``` # LDAP Authentication (`ldap`) There are two ways to do LDAP authentication in [[link,passdb,passdb]]: * [Authentication Binds](#authentication-binds) * [Password Lookups](#password-lookups) LDAP can be used as [userdb ldap](#ldap-userdb). ## Connecting The LDAP server(s) endpoints must be specified as ldap URIs: * [[setting,ldap_uris]]: A space separated list of LDAP URIs to connect to. If multiple LDAP servers are specified, it's decided by the LDAP library how the server connections are handled. Typically the first working server is used, and it's never disconnected from. So there is no load balancing or automatic reconnecting to the "primary" server. ### Connection Authentication If LDAP server requires authentication, set: * [[setting,ldap_auth_dn]] * [[setting,ldap_auth_dn_password]] * [[setting,ldap_auth_sasl_mechanisms]] can be set to list of SASL mechanisms to authenticate with. Note that this is used only for the initial connection authentication, not for any subsequent [authentication binds](#authentication-binds). ### Worker Processes If [[setting,passdb_use_worker,no]] / [[setting,userdb_use_worker,no]] (default for passdb ldap), all LDAP lookups are performed by the auth master process. Each LDAP connection can keep up to 8 requests pipelined. For small systems this is sufficient and uses less resources, but it may become a bottleneck if there are a lot of queries. If [[setting,passdb_use_worker,yes]], `auth-worker` processes are used to perform the lookups. Each auth worker process creates its own LDAP connection so this can increase parallelism. ### Connection Optimization When using - [[setting,passdb_use_worker,no]], - [[setting,userdb_use_worker,no]], - auth binds and - userdb ldap lookups, the userdb lookups should use a separate connection to the LDAP server. That way it can send LDAP requests asynchronously to the server, which improves the performance. This can be done by specifying distinct [[setting,ldap_connection_group]] in the LDAP [[setting,passdb]] / [[setting,userdb]] sections. ::: code-group ```doveconf[dovecot.conf] passdb ldap { # ldap_connection_group left unchanged, the default is '' ... } userdb ldap { ldap_connection_group = different-connection-group ... } ``` ::: ### SSL/TLS You can enable TLS in two alternative ways: * Connect to ldaps port (636) by using "ldaps" protocol, e.g. `ldap_uris = ldaps://secure.domain.org` * Connect to ldap port (389) and use STARTTLS command. Use [[setting,ldap_starttls,yes]] to enable this. See the [[link,ssl_configuration]] settings for how to configure TLS. The default LDAP settings are read (by OpenLDAP) from `/etc/ldap/ldap.conf`. These are used by Dovecot, unless overridden by the Dovecot configuration. Note that if either [[setting,ssl_client_ca_file]] or [[setting,ssl_client_ca_dir]] is set, neither default is used from `ldap.conf`. Not all of Dovecot SSL settings are supported by the LDAP library. Below is the list of supported settings: #### Custom Certs If you need to connect to ldaps secured against a custom certificate of authority (CA), you will need to install the custom CA on your system. For OpenLDAP, by default, the CA must be installed under the directory specified in the `TLS_CACERTDIR` option found under `/etc/openldap/ldap.conf` (default value is `/etc/openldap/certs`). After copying the CA, you'll need to run "c_rehash ." inside the directory, this will create a symlink pointing to the CA. You can test the CA installation with this command: ```sh $ openssl s_client -connect yourldap.example.org:636 \ -CApath /etc/openldap/certs -showcerts ``` This should report "Verify return code: 0 (ok)". ## LDAP Settings ## LDAP-Specific Variables The following variables can be used inside the [[setting,passdb]] / [[setting,userdb]] sections: | Variable | Description | | -------- | ----------- | | `%{ldap:attrName}` | Fetches a single-valued attribute. Fails if the attribute is not present, unless the `\|default` filter is given. If there are multiple values, all except the first are ignored (with warning). | | `%{ldap_multi:attrName}` | [[added,ldap_multi_added]] Fetches a multi-valued attribute and outputs the values separated by tabs, with each value "tab-escaped". Use the `list` [[link,settings_variables_filters,filter]] to further convert it to a wanted value. For example: `mail_access_groups = %{ldap_multi:userGroups \| list \| default('mail')}` | | `%{ldap:dn}` | Retrieves the Distinguished Name of the entry. | ## Password Lookups Advantages over [Authentication Binds](#authentication-binds): - Faster, because Dovecot can keep sending multiple LDAP requests asynchronously to the server. With auth binds Dovecot must wait for each request to finish before sending the next one. - Supports non-plaintext [[link,authentication_mechanisms]] (if returning plaintext or [[link,password_schemes,properly hashed passwords]]). - When using [[link,lda]] or [[link,lmtp]] and [[link,auth_staticdb,static userdb]], deliver can check if destination user exists. With auth binds this check isn't possible. ### LDAP Server Permissions Normally LDAP server doesn't give anyone access to users' passwords, so you'll need to create an administrator account that has access to the `userPassword` field. With OpenLDAP this can be done by modifying `/etc/ldap/slapd.conf`: ::: code-group ```[/etc/ldap/slapd.conf] #---- there should already be something like this in the file access to attribute=userPassword #---- just add this line by dn="" read by anonymous auth by self write by * none ``` ::: Replace `` with the DN you specified in [[setting,ldap_auth_dn]] in `dovecot.conf`'s ldap settings. Alternatively, you can: 1. Create below text file and save it as `authuser_modify.ldif`. ::: code-group ```[authuser_modify.ldif] dn: olcDatabase={2}hdb,cn=config changetype: modify replace: olcAccess olcAccess: {0}to attrs=userPassword by self write by dn="cn=authuser,dc=test,dc=dovecot,dc=net" read by * auth olcAccess: {1}to * by self read by dn="cn=authuser,dc=test,dc=dovecot,dc=net" read by * auth ``` ::: 2. Run `ldapmodify` to apply the change. ```sh $ ldapmodify -Q -Y EXTERNAL -H ldapi:/// -f doveauth_access.ldif ``` ### Dovecot Configuration The two important settings in password lookups are: - [[setting,passdb_ldap_filter]] specifies the LDAP filter how user is found from the LDAP. You can use all the normal [[variable]] like `%{user}` in the filter. - [[setting,passdb_fields]] specifies a list of attributes that are returned and how to produce the returned value. Usually the LDAP attribute names aren't the same as [[link,passdb,the field names that Dovecot uses internally]]. You must create a mapping between them to get the wanted results. This is done by listing the [[setting,passdb_fields]] as ` = ` where expression can include ldap specific variables and other variables too. For example: ::: code-group ```doveconf[dovecot.conf] ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org passdb ldap { filter = (&(objectClass=posixAccount)(uid=%{user})) fields { user = %{ldap:uid} password = %{ldap:userPassword} } } ``` ::: This maps the LDAP "uid" attribute to Dovecot's "user" field and LDAP's "userPassword" attribute to Dovecot's "password" field. These two fields should always be returned, but it's also possible to return other special [[link,passdb_extra_fields]]. #### Password Most importantly, [[setting,passdb_fields]] must return a `password` field, which contains the user's password. The next thing Dovecot needs to know is what format the password is in. If all the passwords are in same format, you can use [[setting,passdb_default_password_scheme]] setting in `dovecot.conf` to specify it. Otherwise each password needs to be prefixed with `{password-scheme}`, for example `{plain}plaintext-password`. See [[link,password_schemes]] for a list of supported password schemes. #### Username LDAP lookups are case-insensitive. Unless the username is normalized, it's possible that a user logging in as "user", "User" and "uSer" are treated differently. By default Dovecot uses [[setting,auth_username_format, %{user | lower}]] to lowercase the username before it reaches the LDAP lookup. Alternatively, you may want to change the username to be exactly as it is in the LDAP database. You can do this by returning `user` field in [[setting,passdb_fields]] setting, as shown in the above example. ### Example A typical configuration would look like: ::: code-group ```doveconf[dovecot.conf] ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org passdb ldap { bind = no default_password_scheme = MD5 filter = (&(objectClass=posixAccount)(uid=%{user})) fields { user = %{ldap:uid} password = %{ldap:userPassword} } } ``` ::: ## Authentication Binds Advantages over [Password Lookups](#password-lookups) - LDAP server verifies the password, so Dovecot doesn't need to know what format the password is stored in. - A bit more secure, as a security hole in Dovecot doesn't give attacker access to all the users' password hashes. (And Dovecot admins in general don't have direct access to them.) You can enable authentication binds by setting [[setting,passdb_ldap_bind,yes]]. Dovecot needs to know what DN to use in the binding. There are two ways to configure this: lookup or template. ### DN Lookup DN is looked up by sending a [[setting,passdb_ldap_filter]] LDAP request and getting the DN from the reply. This is very similar to doing a [password lookup](#password-lookups). The only difference is that `userPassword` attribute isn't returned. Just as with password lookups, the [[setting,passdb_fields]] may contain special [[link,passdb_extra_fields]]. Example: ::: code-group ```doveconf[dovecot.conf] ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org passdb ldap { bind = yes filter = (&(objectClass=posixAccount)(uid=%{user})) fields { user = %{ldap:uid} } } ``` ::: ### DN Template You can do authentication binding using DN template by configuring it in the [[setting,passdb_ldap_bind_userdn]] setting. The main reason to use DN template is to avoid doing the DN lookup, so that the authentication consists only of one LDAP request. With IMAP and POP3 logins, the same optimization can be done by using [[link,auth_prefetch]] and returning userdb info in the DN lookup (a total of two LDAP requests per login in both cases). If you're also using Dovecot for SMTP AUTH, it doesn't do a userdb lookup so the prefetch optimization doesn't help. If you're using DN template, there is no LDAP lookup that returns fields, so [[setting,passdb_fields]] can't access any `%{ldap:*}` variables. Also, [[setting,passdb_ldap_filter]] setting is ignored. ::: code-group ```doveconf[dovecot.conf] ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org passdb ldap { bind = yes bind_userdn = cn=%{user},ou=people,o=org } ``` ::: ## LDAP userdb Usually your LDAP database also contains the [[link,userdb]]. If your home directory can be specified with a template, you're using only a single UID and GID, and you don't need any other user-specific fields, you should use [[link,userdb_static]] instead to avoid an unnecessary LDAP lookup. You can also use [[link,auth_prefetch]] to avoid the userdb LDAP lookup. Userdb lookups are always done using the [[setting,ldap_auth_dn]] bind. It's not possible to do the lookup using the user's DN (remember that e.g. [[link,lda]] or [[link,lmtp]] needs to do userdb lookups without knowing the user's password). The userdb lookups are configured in very much the same way as [password lookups](#password-lookups). [[setting,userdb_fields]] and [[setting,userdb_ldap_filter]], are used in the same way in passdb. If you're using a single UID and GID for all the users, you can specify them globally with [[setting,mail_uid]] and [[setting,mail_gid]] settings instead of returning them from LDAP. ```doveconf[dovecot.conf] ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org userdb ldap { filter = (&(objectClass=posixAccount)(uid=%{user})) fields { home = %{ldap:homeDirectory} uid = %{ldap:uidNumber} gid = %{ldap:gidNumber} } } ``` ### User Iteration For using `doveadm -A` or `-u` with wildcards you need to configure the userdb to support user iteration. This is done by adding [[setting,userdb_ldap_iterate_filter]] and [[setting,userdb_ldap_iterate_fields]] settings to the userdb: ```doveconf[dovecot.conf] userdb ldap { # filter = ... iterate_filter = (objectClass=posixAccount) iterate_fields { user = %{ldap:uid} } } ``` ### Attribute Templates You can mix static text with the value returned from LDAP by using `%{ldap:*}` variables, which expand to the named LDAP attribute's value. #### Examples Create a `quota_storage_size` field with value `B` where `` comes from "quotaBytes" LDAP attribute: ```doveconf[dovecot.conf] userdb ldap { fields { quota_storage_size = %{ldap:quotaBytes}B } } ``` Create a `mail_path` field with value `/var/mail//Maildir` where `` comes from "sAMAccountName" LDAP attribute: ```doveconf[dovecot.conf] userdb ldap { fields { mail_path = /var/spool/vmail/%{ldap:sAMAccountName}/Maildir } } ``` You can add static fields that aren't looked up from LDAP. For example create a "mail_path" field with value `/var/vmail/%{user | domain}/%{user | username}/Maildir`: ```doveconf[dovecot.conf] userdb ldap { fields { quota_storage_size = %{ldap:quotaBytes}B mail_path = /var/vmail/%{user | domain}/%{user | username}/Maildir } } ``` It is possible to give default values to nonexistent attributes by using e.g. `%{ldap:userDomain | default('example.com')}` where if userDomain attribute doesn't exist, example.com is used instead. ### Multiple Queries via userdbs Example: Give the user a class attribute, which defines the quota: ::: code-group ```doveconf[dovecot.conf] ldap_uris = ldap://ldap.example.org ldap_auth_dn = cn=admin,dc=example,dc=org ldap_auth_dn_password = secret ldap_base = dc=example,dc=org userdb ldap-user { driver = ldap result_success = continue-ok ldap_filter = (&(objectClass=posixAccount)(uid=%{user})) fields { class = %{ldap:userClass} } } userdb ldap-class { driver = ldap skip = notfound ldap_filter = (&(objectClass=classSettings)(class=%{userdb:class})) fields { quota_storage_size = %{ldap:quotaBytes}B } } ``` ::: # Lua Authentication Database (`lua`) You can implement passdb and userdb using [Lua](https://www.lua.org/) script. ## Authentication When used in authentication, additional module `dovecot.auth` is added, which contains constants for [[link,passdb]] and [[link,userdb]]. For details about Dovecot Lua, see [[link,lua]]. ## Initialization [[added,lua_auth_init]] When passdb or userdb is initialized, there will be a lookup for a function to get the `cache_key` for the userdb or passdb. These functions are called `auth_passdb_get_cache_key()` for passdbs and `auth_userdb_get_cache_key()` for userdbs. The global `script_init()` function is called for all Lua scripts and can be used to pass arguments to the script using [[setting,lua_settings]]. These settings can be used to pass out initialization parameters from Dovecot. ::: code-group ```doveconf[dovecot.conf] passdb lua { lua_file = /etc/dovecot/auth.lua lua_settings { password = {PLAIN}test } } ``` ```lua[/etc/dovecot/auth.lua] local password = nil function script_init(args) password = args["password"] return 0 end function auth_passdb_lookup(req) return dovecot.auth.PASSDB_RESULT_OK, { ["password"]=password } end function auth_passdb_get_cache_key() return "%{user | username}\t%{protocol}" end ``` ::: The lua script to be used is given to the passdb using [[setting,lua_file]] setting. ### Constants #### `dovecot.auth.PASSDB_RESULT_INTERNAL_FAILURE` #### `dovecot.auth.PASSDB_RESULT_SCHEME_NOT_AVAILABLE` Indicates password scheme that cannot be understood. #### `dovecot.auth.PASSDB_RESULT_USER_UNKNOWN` #### `dovecot.auth.PASSDB_RESULT_USER_DISABLED` #### `dovecot.auth.PASSDB_RESULT_PASS_EXPIRED` #### `dovecot.auth.PASSDB_RESULT_NEXT` Indicates that this passdb did not authenticate user, next passdb should do it. #### `dovecot.auth.PASSDB_RESULT_PASSWORD_MISMATCH` #### `dovecot.auth.PASSDB_RESULT_OK` #### `dovecot.auth.USERDB_RESULT_INTERNAL_FAILURE` #### `dovecot.auth.USERDB_RESULT_USER_UNKNOWN` #### `dovecot.auth.USERDB_RESULT_OK` ### Auth Request Auth init registers object `struct auth_request*` which allows access to various parts of the auth request. You should use the loggers associated with `auth_request` when possible. #### Methods ##### `auth_request#log_debug(text)` Logs debug message (if debug is enabled, noop otherwise). ##### `auth_request#log_error(text)` Logs error message. ##### `auth_request#log_info(text)` Logs informational message. ##### `auth_request#log_warning(text)` Logs warning message. ##### `auth_request#response_from_template(template)` [[removed,auth_lua_string_response_removed]] This was a bit unsafe function. Return the table instead with the necessary `auth_request#var_expand()` calls. Takes in `key=value` template and expands it using `var_expand()` and produces table suitable for passdb result. ##### `auth_request#var_expand(template)` Performs var expansion on the template using [[variable]]. ##### `auth_request#password_verify(crypted_password, plain_password)` Checks if the plain password matches the crypted or hashed password. ##### `auth_request#event()` Returns child event for the auth request. Can be used for logging and other events. Comes with a prefix. #### Subtables ##### `auth_request#passdb` ##### `auth_request#userdb` #### Members See [[variable]] for details. ##### `auth_request#auth_domain` ##### `auth_request#auth_user` ##### `auth_request#auth_username` ##### `auth_request#cert` ##### `auth_request#client_id` ##### `auth_request#domain` ##### `auth_request#domain_first` ##### `auth_request#domain_last` ##### `auth_request#home` ##### `auth_request#lip` ##### `auth_request#local_name` ##### `auth_request#login_domain` ##### `auth_request#login_user` ##### `auth_request#login_username` ##### `auth_request#lport` ##### `auth_request#master_user` ##### `auth_request#mech` ##### `auth_request#orig_domain` ##### `auth_request#orig_user` ##### `auth_request#orig_username` ##### `auth_request#password` ##### `auth_request#pid` ##### `auth_request#real_lip` ##### `auth_request#real_lport` ##### `auth_request#real_rip` ##### `auth_request#real_rport` ##### `auth_request#rip` ##### `auth_request#rport` ##### `auth_request#secured` ##### `auth_request#service` ##### `auth_request#session` ##### `auth_request#session_pid` ##### `auth_request#user` ##### `auth_request#username` #### Additional Members ##### `skip_password_check` Set if the password has already been validated by another passdb. ##### `passdbs_seen_user_unknown` If some previous passdb has not found this user. ##### `passdbs_seen_internal_failure` If some previous passdb has had internal failure. ##### `userdbs_seen_internal_failure` If some previous userdb has had internal failure. ## passdb To configure passdb in dovecot, use: ```doveconf[dovecot.conf] passdb lua { lua_file = /path/to/lua use_worker = yes # default is yes } ``` If `auth_password_verify` is found, it's always used. By default, dovecot runs Lua scripts in auth-worker processes. If you do not want this, you can disable using worker, and Lua script will be run in auth process. This can degrade performance if your script is slow or makes external lookups. ### Execution Modes Lua passdb supports two modes of function: #### Lookup Database Function signature is `auth_passdb_lookup(request)`. Function must return a tuple, which contains: * `dovecot.auth.PASSDB_RESULT_OK` and extra fields table * `dovecot.auth.PASSDB_RESULT_*` error and error string The extra fields table must be in key-value format, as it will be imported into auth request. [[removed,auth_lua_string_response_removed]] String can no longer be returned for `PASSDB_RESULT_OK`. #### Password Verification Database Function signature is `auth_password_verify(request, password)`. Function must return a tuple, which contains: * `dovecot.auth.PASSDB_RESULT_OK` and extra fields table * `dovecot.auth.PASSDB_RESULT_*` error and error string The extra fields table must be in key-value format, as it will be imported into auth request. [[removed,auth_lua_string_response_removed]] String can no longer be returned for `PASSDB_RESULT_OK`. ## userdb To configure userdb in dovecot, use: ```doveconf[dovecot.conf] userdb lua { lua_file = /path/to/lua use_worker = yes # default is yes } ``` ### Execution Modes Lua userdb supports both single user lookup and iteration. #### Single User Lookup Function signature is `auth_userdb_lookup(request)`. Function must return a tuple, which contains: * `dovecot.auth.USERDB_RESULT_OK` and extra fields table * `dovecot.auth.USERDB_RESULT_*` error and error string The extra fields table must be in key-value format, as it will be imported into auth request. [[removed,auth_lua_string_response_removed]] String can no longer be returned for `USERDB_RESULT_OK`. #### User Iteration Function signature is `auth_userdb_iterate()`. Function returns a table of usernames. Key names are ignored. ::: tip The iteration will hold the whole user database in memory during iteration. ::: ## Examples ```lua:line-numbers function auth_passdb_lookup(req) if req.user == "testuser1" then return dovecot.auth.PASSDB_RESULT_OK, { password = "pass" } end return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN, "no such user" end function auth_userdb_lookup(req) if req.user == "testuser1" then return dovecot.auth.USERDB_RESULT_OK, { uid = "vmail", gid = "vmail" } end return dovecot.auth.USERDB_RESULT_USER_UNKNOWN, "no such user" end function script_init() return 0 end function script_deinit() end function auth_userdb_iterate() return {"testuser1"} end ``` ### Simple Username Password Database Example: opensmtpd authentication. The example uses whitespace separated username and password. As a special caution, the way Lua is used here means you can have multiple user password per line, instead of just one. This can be extended to more complicated separators or multiple fields per user. If you only want to authenticate users, and don't care about user listing, you can use: ```lua:line-numbers function auth_passdb_lookup(req) for line in io.lines("/path/to/file") do for user, pass in string.gmatch(line, "(%w+)%s(.+)") do if (user == req.username) then -- you can add additional information here, like userdb_uid return dovecot.auth.PASSDB_RESULT_OK, { password = pass } end end end return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN end ``` If you also want to be able to list users, so that you could use `doveadm cmd -A`: ```lua:line-numbers local database = "/path/to/file" function db_lookup(username) for line in io.lines(database) do for user, pass in string.gmatch(line, "(%w+)%s(.+)") do if (user == username) then return {result=0, password=pass} end end end return {result=-1} end function auth_passdb_lookup(req) res = db_lookup(req.username) if res.result == 0 then -- you can add additional information here for passdb return dovecot.auth.PASSDB_RESULT_OK, { password = res.password } end return dovecot.auth.PASSDB_RESULT_USER_UNKNOWN end function auth_userdb_lookup(req) res = db_lookup(req.username) if res.result == 0 then -- you can add additional information here for userdb, like uid or home return dovecot.auth.USERDB_RESULT_OK, { uid = "vmail, gid = "vmail" } end return dovecot.auth.USERDB_RESULT_USER_UNKNOWN end function auth_userdb_iterate() users = {} for line in io.lines(database) do for user in string.gmatch(line, "(%w+)%s.+") do table.insert(users, user) end end return users end ``` # Open Authentication v2.0 Database (`oauth2`) This database works with a OAuth2 ([[rfc,6749]])provider. You are recommended to use `oauthbearer` (preferred) or `xoauth2` [[link,authentication_mechanisms]] with this database. The responses from endpoints must be JSON objects. [[changed,auth_oauth2_no_passdb_changed]]: The OAuth2 mechanism no longer uses a passdb for token authentication. Password Grant still needs a oauth2 passdb. ## Settings Oauth2 overrides some of the default HTTP client and SSL settings. You can override these and any other HTTP client or SSL settings by placing them inside the [[setting,oauth2]] named filter. ## Configuration ### Common ::: code-group ```doveconf[dovecot.conf] auth_mechanisms { oauthbearer = yes xoauth2 = yes } oauth2 { # ... } ``` ::: ### Backend #### Examples ##### Google Configuration file example for [Google](https://developers.google.com/identity/protocols/OAuth2): ```doveconf[dovecot.conf] oauth2 { tokeninfo_url = https://www.googleapis.com/oauth2/v3/tokeninfo?access_token= introspection_url = https://www.googleapis.com/oauth2/v2/userinfo #force_introspection = yes username_attribute = email } ``` ##### WSO2 Identity Server Configuration file example for [WSO2 Identity Server](https://wso2.com/identity-and-access-management/): ```doveconf[dovecot.conf] oauth2 { introspection_mode = post introspection_url = https://client_id:client_secret@server.name:port/oauth2/introspect username_attribute = username active_attribute = active active_value = true } ``` ##### Microsoft Identity Platform Configuration file example for [Microsoft Identity Platform](https://learn.microsoft.com/en-us/entra/identity-platform/userinfo): ```doveconf[dovecot.conf] oauth2 { introspection_mode = auth introspection_url = https://graph.microsoft.com/v1.0/me # this can vary on your settings username_attribute = mail ssl_client_ca_file = /etc/ssl/certs/ca-certificates.crt } ``` ### Proxy If you want to forward oauth2 authentication to your backend, you can use various ways. Without proxy authentication: ```doveconf[dovecot.conf] passdb static { fields { nopassword = yes proxy = yes proxy_mech = %{mechanism} # ... } } ``` With proxy authentication, put into `dovecot.conf`: ```doveconf[dovecot.conf] oauth2 { # ... fields { proxy = y proxy_mech = %{mech} } } ``` #### Proxy with Password Grant If you want to configure proxy to get token and pass it to backend: ::: code-group ```doveconf[dovecot.conf] oauth2 { client_id = verySecretClientId client_secret = verySecretSecret tokeninfo_url = http://localhost:8000/oauth2?oauth= introspection_url = http://localhost:8000/introspect introspection_mode = post username_attribute = username fields { pass = %{token} } } passdb oauth2 { mechanisms_filter = plain login oauth2 { # inherit common oauth2 settings from the global scope grant_url = http://localhost:8000/token fields { host = 127.0.0.1 proxy = y proxy_mech = xoauth2 pass = %{oauth2:access_token} } } } ``` ::: #### Local Validation Local validation allows validating tokens without connecting to an oauth2 server. This requires that key issuer supports JWT tokens ([[rfc,7519]]). You can put the validation keys into any [[link,dict]]. The lookup key used is `/shared///`. If there is no `azp` element in token body, then `default` is used. The `alg` field is always uppercased by Dovecot. If there is no `kid` element in token header, `default` is used. Keys are cached into memory when they are fetched; to evict them from cache you need to restart Dovecot. If you want to do key rotation, it is recommended to use a new key id. Example: ```json { "kid":"Zm9vb2Jhcgo", "alg":"ES256", "typ":"JWT" }.{ "sub":"testuser@example.org", "azp":"issuer.net-dovecot" } ``` Would turn into: `/shared/issuer.net-dovecot/ES256/Zm9vb2Jhcgo`. If using fs posix, key would be at `/etc/dovecot/keys/issuer.net-dovecot/ES256/Zm9vb2Jhcgo`. In key id and AZP field, `/` are escaped with `%2f` and `%` are escaped with `%25` with any driver. This is because `/` is a dict key component delimiter. When using dict-fs driver, if the path starts with `.`, it will be escaped using two more dots. So any `.` turns into `...`, and any `..` turns into `....`. For example: ```json { "kid":""./../../../../etc, "alg":"ES256", "typ":"JWT" }.{ "sub":"testuser@example.org", "azp":"attack" } ``` Would turn into: `/etc/dovecot/keys/attack/ES256/...%2f....%2f....%2f....%2f....%2fetc%2fpasswd`. Local validation can be enabled with other oauth2 options, so that if key validation fails for non-JWT keys, then online validation is performed. You can use local validation with password grants too. This will save you introspection roundtrip to oauth2 server. To use local validation, put into `dovecot.conf`: ```doveconf[dovecot.conf] oauth2 { introspection_mode = local oauth2_local_validation { dict fs { fs posix { prefix=/etc/dovecot/keys/ } } } } ``` Currently, Dovecot oauth2 library implements the following features of JWT tokens: * IAT checking * NBF checking * EXP checking * ISS checking * ALG checking * SUB support * AUD support : AUD check checks client_id, not scope. If the token has scope field, this is checked for scope. KTY checking has been removed. * AZP support The following algorithms are supported * HS256, HS384, HS512 * RS256, RS384, RS512 * PS256, PS384, PS512 * ES256, ES384, ES512 There is currently no support for EdDSA algorithms. ES supports any curve supported by OpenSSL for this purpose. ### OpenID Discovery Support for [[rfc,7628]] OpenID Discovery (OIDC) can be achieved with `openid_configuration_url`. Setting this causes Dovecot to report OIDC configuration URL as `openid-configuration` element in error JSON. # Authentication Databases # PAM (`pam`) This is the most common way to authenticate system users nowadays. PAM is not itself a password database, but rather its configuration tells the system how exactly to do the authentication. Usually this means using the `pam_unix.so` module, which authenticates user from the system's shadow password file. Because PAM is not an actual database, only cleartext authentication mechanisms can be used with PAM. PAM cannot be used as a [[link,userdb]] either (although static user templates could be used to provide the same effect). Usually PAM is used with [[link,auth_passwd]] or [[link,auth_staticdb]]. Dovecot should work with Linux PAM, Solaris PAM, OpenPAM (FreeBSD), and ApplePAM (Mac OS X). ## Settings ## Service Name The PAM configuration is usually in the `/etc/pam.d/` directory, but some systems may use a single file, `/etc/pam.conf`. By default Dovecot uses dovecot as the PAM service name, so the configuration is read from `/etc/pam.d/dovecot`. You can change this by setting the wanted service name using [[setting,passdb_pam_service_name]]. You can also set the service to `%{protocol}` in which case Dovecot automatically uses either `imap` or `pop3` as the service, depending on the actual service the user is logging in to. Examples: * Use `/etc/pam.d/imap` and `/etc/pam.d/pop3`: ```doveconf[dovecot.conf] passdb pam { service_name = %{protocol} } ``` * Use `/etc/pam.d/mail`: ```doveconf[dovecot.conf] passdb pam { service_name = mail } ``` ## PAM Sessions By setting [[setting,passdb_pam_service_name,yes]] you can make Dovecot open a PAM session and close it immediately. Some PAM plugins need this, for instance `pam_mkhomedir`. With this parameter, `dovecot.conf` might look something like this: ```doveconf[dovecot.conf] passdb pam { session = yes service_name = dovecot } ``` ## PAM Credentials By setting [[setting,passdb_pam_setcred,yes]] you can make Dovecot create PAM credentials. Some PAM plugins need this. The credentials are never deleted however, so using this might cause problems with other PAM plugins. ## Limiting the Number of PAM Lookups Usually in other software, PAM is used to do only a single lookup in a process, so PAM plugin writers haven't done much testing on what happens when multiple lookups are done. Because of this, many PAM plugins leak memory and possibly have some other problems when doing multiple lookups. If you notice that PAM authentication stops working after some time, you can limit the number of lookups done by the auth worker process before it dies using the [[setting,passdb_pam_max_requests]] setting: ```doveconf[dovecot.conf] passdb pam { max_requests = 100 } ``` The default `max_requests` value is 100. ## Username Changing A PAM module can change the username. ## Making PAM Plugin Failure Messages Visible You can replace the default "Authentication failed" reply with PAM's failure reply by setting [[setting,passdb_pam_failure_show_msg]]: ```doveconf[dovecot.conf] passdb pam { failure_show_msg = yes } ``` This can be useful with e.g. `pam_opie` to find out which one time password you're supposed to give: ``` 1 LOGIN username otp 1 NO otp-md5 324 0x1578 ext, Response: ``` # Restrict IP-Addresses Allowed to Connect via PAM You can restrict the IP-Addresses allowed to connect via PAM: ```doveconf[dovecot.conf] passdb pam { fields { allow_nets = 10.1.100.0/23,2001:db8:a0b:12f0::/64 } } ``` ## Caching Dovecot supports caching password lookups by setting [[setting,auth_cache_size]] to a non-zero value. Examples: ```doveconf[dovecot.conf] # 1MB auth cache size auth_cache_size = 1024 passdb pam { } ``` ## Examples ### Linux Here is an example `/etc/pam.d/dovecot` configuration file which uses standard UNIX authentication: ``` auth required pam_unix.so nullok account required pam_unix.so ``` ### Solaris For Solaris you will have to edit `/etc/pam.conf`. Here is a working Solaris example (using [[setting,service_name,%{service}]] instead of the default `dovecot` service): ``` imap auth requisite pam_authtok_get.so.1 imap auth required pam_unix_auth.so.1 imap account requisite pam_roles.so.1 imap account required pam_unix_account.so.1 imap session required pam_unix_session.so.1 pop3 auth requisite pam_authtok_get.so.1 pop3 auth required pam_unix_auth.so.1 pop3 account requisite pam_roles.so.1 pop3 account required pam_unix_account.so.1 pop3 session required pam_unix_session.so.1 ``` ### Mac OS X On Mac OS X, the `/etc/pam.d/dovecot` file might look like this: ``` auth required pam_opendirectory.so try_first_pass account required pam_nologin.so account required pam_opendirectory.so password required pam_opendirectory.so ``` ...which, as the equivalent of `/etc/pam.d/login` on OS X 10.9. For very old versions of OS X (e.g. 10.4), can be represented (where?) as the following in the on that OS: ```doveconf[dovecot.conf] passdb pam { service_name = login } ``` On older versions of Mac OS X, "passwd" can be used as a userdb to fill in UID, GID, and homedir information after PAM was used as a passdb, even though Directory Services prevents "passdb passwd" from working as a username/password authenticator. This will provide full system user authentication with true homedir mail storage, without resorting to a single virtual mail user or LDAP: ```doveconf[dovecot.conf] userdb passwd { } ``` # Passwd-file (`passwd-file`) This file is compatible with a normal `/etc/passwd` file, and a password file used by [[link,auth_pam,libpam-pwdfile]] plugin. ## Configuration `user:password:uid:gid:(gecos):home:(shell):extra_fields` For a [[link,passdb]] it's enough to have only the user and password fields. For a [[link,userdb]], you need to set also uid, gid, and preferably also home [[link,virtual_users]]). (gecos) and (shell) fields are unused by Dovecot. The password field can be in four formats (see [[link,password_schemes]]): * `password`: Assume [[setting,passdb_default_password_scheme]] (CRYPT) password scheme. See [[link,password_schemes]]. * `{SCHEME}password`: The password is in the given scheme. * `password[13]`: libpam-passwd file compatible format for CRYPT scheme. * `password[34]`: libpam-passwd file compatible format for MD5 scheme. `extra_fields` is a space-separated list of `key=value` pairs which can be used to set various [[link,passdb_extra_fields]] and [[link,userdb_extra_fields]]. Keys which begin with a `userdb_ prefix` are used for userdb, others are used for passdb. For example, if you wish to override [[setting,mail_path]] for one use, use `userdb_mail_path=~/mail`. [[variable]] expansion is done for `extra_fields`. Empty lines and lines beginning with `#` character are ignored. ### Settings Also global settings that are commonly overridden inside the passdb filter: * [[setting,passdb_default_password_scheme]] specifies the default password scheme to be used in the passwd-files. * [[setting,auth_username_format]] changes the username that is looked up from the passwd-file. For example `auth_username_format = %{protocol}` can be used to lookup the current protocol instead of the username. ### Multiple passwd-files You can use all [[variable]] in the passwd-file filenames, for example: ```doveconf[dovecot.conf] passdb passwd-file { # Each domain has a separate passwd-file: passwd_file_path = /etc/auth/%{user | domain}/passwd } ``` [[added,passwd_file_iteration]] To iterate databases that use [[variable]] expansion in the path, you need to provide enough information when using e.g. [[doveadm,user]] to iterate. For example [[doveadm,user,*@domain.com]] would match with ``%{user | domain}`` expansion in the above example, and [[doveadm,user,*]] would iterate `/etc/auth/passwd` if available. This iteration works with all doveadm mail commands similarly. ### Variables [[setting,passdb_fields]] and [[setting,userdb_fields]] can use `%{passwd_file:}` variables to access the current passdb or userdb lookup's fields. The available fields are: * `uid` * `gid` * `home` * Any specified extra fields. The `userdb_` prefixed fields are available also in passdb lookups with the `userdb_` prefix. In userdb lookups these same fields are available without the `userdb_` prefix. ### Examples ```doveconf[dovecot.conf] passdb passwd-file { default_password_scheme = plain-md5 auth_username_format = %{user | username} passwd_file_path = /etc/imap.passwd } userdb passwd-file { auth_username_format = %{user | username} passwd_file_path = /etc/imap.passwd fields { uid:default = vmail gid:default = vmail home:default = /home/vmail/%{user} } } ``` * The `fields` is explained in [[setting,userdb_fields]]. They can be used to provide userdb extra fields based on templates. If you leave any of the standard userdb fields (uid, gid, home) empty in the passwd file, these defaults will be used. If you leave out the `:default` suffix, they override the passwd file fields. This file can be used as a passdb: ``` user:{plain}password user2:{plain}password2 ``` A passdb with extra fields: ``` user:{plain}password::::::allow_nets=192.168.0.0/24 ``` This file can be used as both a passwd and a userdb: ``` user:{plain}pass:1000:1000::/home/user::userdb_mail_path=~/Maildir allow_nets=192.168.0.0/24 user2:{plain}pass2:1001:1001::/home/user2 ``` ## FreeBSD /etc/master.passwd as passdb and userdb On FreeBSD, `/etc/passwd` doesn't work as a password database because the password field is replaced by a `*`. `/etc/master.passwd` can be converted into a format usable by passwd-file. As [[link,auth_pam]] can access the system-wide credentials on FreeBSD, what follows is generally needed only if the mail accounts are different from the system accounts. If only using the result for `name:password:uid:gid` and not using [[link,passdb_extra_fields]], you may be able to use the extract directly. However, the Linux-style passwd file has fewer fields than that used by FreeBSD and it will need to be edited if any fields past the first four are needed. In particular, it will fail if used directly as a `userdb` as the field used for `home` is not in the same place as expected by the Dovecot parser. The `:class:change:expire` stanza in each line should be removed to be consistent with the Linux-style format. While that stanza often is `::0:0` use of `cut` is likely much safer than sed or other blind substitution. In `/etc/master.passwd`, a password of `* ` indicates that password authentication is disabled for that user and the token `*LOCKED*` prevents all login authentication, so you might as well exclude those: ```sh fgrep -v '*' /etc/master.passwd | cut -d : -f 1-4,8-10 > /path/to/file-with-encrypted-passwords chmod 640 /path/to/file-with-encrypted-passwords chown root:dovecot /path/to/file-with-encrypted-passwords ``` The following will work in many situations, after disabling the inclusion of other `userdb` and `passdb` sections: ```doveconf[dovecot.conf] passdb passwd-file { auth_username_format = %{user | username} passwd_file_path = /path/to/file-with-encrypted-passwords } userdb passwd-file { auth_username_format = %{user | username} passwd_file_path = /path/to/file-with-encrypted-passwords } ``` # Passwd (`passwd`) User is looked up using `getpwnam()` call, which usually looks into `/etc/passwd` file, but depending on the NSS configuration it may also look up the user from, e.g., LDAP database. Most commonly used as a [[link,userdb]]. The lookup is by default done in the auth worker processes. If you have only a small local passwd file, you can avoid having extra auth worker processes by disabling it: ```doveconf[dovecot.conf] userdb passwd { use_worker = yes } ``` ## Field Overriding and Extra Fields It's possible to override fields from passwd and add [[link,userdb_extra_fields]]. For example: ```doveconf[dovecot.conf] userdb passwd { fields { home = /var/mail/%{user | username} mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir } } ``` This uses the UID and GID fields from passwd, but home directory is overridden. Also the default [[link,mail_location]] setting is overridden. ::: info [[setting,userdb_fields_import_all]] defaults to `yes`. If it is set to `no` the fields to be imported need to be explicitly defined. ```doveconf[dovecot.conf] userdb passwd { fields_import_all = no fields { uid = %{passwd:uid} gid = %{passwd:gid} home = /var/mail/%{user | username} mail_driver = maildir mail_path = /var/mail/%{user | username}/Maildir } } ``` ::: ## Passwd as a passdb Many systems use shadow passwords nowadays so passwd doesn't usually work as a password database. BSDs are an exception to this, they still set the password field even with shadow passwords. With FreeBSD, passwd doesn't work as a password database because the password field is replaced by a `*`. But you can use [[link,auth_passwd_file]] instead. # Prefetch User Database (`prefetch`) Prefetch [[link,userdb]] can be used to combine passdb and userdb lookups into a single lookup. It's usually used with [[link,auth_sql]] and [[link,auth_ldap]]. Prefetch works by requiring that the passdb returns the userdb information in [[link,passdb_extra_fields]] with `userdb_` prefixes. For example if a userdb typically returns `uid`, `gid`, and `home` fields, the passdb would have to return `userdb_uid`, `userdb_gid` and `userdb_home` fields. If you're using [[link,lda]] or [[link,lmtp]] you still need a valid userdb which can be used to locate the users. You can do this by adding a normal SQL/LDAP userdb **after the userdb prefetch**. The order of definitions is significant. See below for examples. ## LDAP [[setting,passdb_ldap_bind,yes]] with [[setting,passdb_ldap_bind_userdn]]-template is incompatible with prefetch, because no passdb lookup is done then. If you want zero LDAP lookups, you might want to use [[link,auth_staticdb]] instead of prefetch. ### Example ::: code-group ```doveconf[dovecot.conf] passdb ldap { ... fields { user = %{ldap:uid} password = %{ldap:userPassword} userdb_home = %{ldap:homeDirectory} userdb_uid = %{ldap:uidNumber} userdb_gid = %{ldap:gidNumber} } } userdb prefetch { driver = prefetch } # The userdb below is used only by LDA. userdb ldap { ... fields { home = %{ldap:homeDirectory} uid = %{ldap:uidNumber} gid = %{ldap:gidNumber} } } ``` ::: ## SQL ### Example ```doveconf[dovecot.conf] sql_driver = mysql mysql localhost { } passdb sql { query = SELECT userid AS user, password, home AS userdb_home, uid AS userdb_uid, gid AS userdb_gid \ FROM users \ WHERE userid = '%{user}' } } userdb prefetch { } # The userdb below is used only by lda. userdb sql { query = SELECT home, uid, gid FROM users WHERE userid = '%{user}' } ``` # SQL Database (`sql`) SQL can be used for both [[link,passdb]] and [[link,userdb]] lookups. If all the SQL settings for the [[link,passdb]] and [[link,userdb]] are equal, only one SQL connection is used for both [[link,passdb]] and [[link,userdb]] lookups. ## Dovecot Configuration ```doveconf[dovecot.conf] # sql driver-specific settings passdb sql { sql_driver = # ... query = # ... } ``` ## passdb [[setting,passdb_sql_query]] setting contains the SQL query to look up the password. It must return a field named `password`. If you have it by any other name in the database, you can use the SQL's `AS` keyword (`SELECT pw AS password ..`). You can use all the normal [[variable]] such as `%{user}` in the SQL query. If all the passwords are in same format, you can use [[setting,passdb_default_password_scheme]] to specify it. Otherwise each password needs to be prefixed with `{password-scheme}`, for example `{plain}cleartext-password`. See [[link,password_schemes]] for a list of supported password schemes. By default MySQL does case-insensitive string comparisons, so you may have a problem if your users are logging with different as `user`, `User` and `uSer`. To fix this, you can make the SQL database return a [[link,userdb_extra_fields]] which makes Dovecot modify the username to the returned value. ::: info If you're using separate user and domain fields, a common problem is that you're returning only the `user` field from the database. **This drops out the domain from the username**. So make sure you're returning a concatenated `user@domain` string or username/domain fields separately. See the examples below. ::: The query can also return other [[link,passdb_extra_fields]] which have special meaning. You can't use multiple statements in one query, but you could use a stored procedure. If you want something like a last login update, use [[link,post_login_scripting]] instead. ### Password Verification by SQL Server If the passwords are in some special format in the SQL server that Dovecot doesn't recognize, it's still possible to use them. Change the SQL query to return NULL as the password and return the row only if the password matches. You'll also need to return a non-NULL `nopassword` field. The password is in `%{password}` variable. For example: ```doveconf[dovecot.conf] passdb sql { query = SELECT NULL AS password, 'Y' as nopassword, userid AS user \ FROM users \ WHERE userid = '%{user}' AND mysql_pass = password('%{password}') } ``` This of course makes the verbose logging a bit wrong, since password mismatches are also logged as `unknown user`. ## userdb Usually your SQL database contains also the userdb information. This means user's UID, GID, and home directory. If you're using only static UID and GID, and your home directory can be specified with a template, you could use [[link,auth_staticdb]] instead. It is also a bit faster since it avoids doing the userdb SQL query. [[setting,userdb_sql_query]] setting contains the SQL query to look up the userdb information. The commonly returned userdb fields are uid, gid, home, and mail. See [[link,userdb_extra_fields]] for more information about these and other fields that can be returned. If you're using a single UID and GID for all users, you can set them in dovecot.conf with: ```doveconf[dovecot.conf] mail_uid = vmail mail_gid = vmail ``` ## User Iteration Some commands, such as `doveadm -A` need to get a list of users. With SQL userdb this is done with the [[setting,userdb_sql_iterate_query]] setting. You can either return: * `user` field containing either user or user@domain style usernames, or * `username` and `domain` fields Any other fields are ignored. ## Prefetching If you want to avoid doing two SQL queries when logging in with IMAP/POP3, you can make the [[setting,passdb_sql_query]] return all the necessary userdb fields and use [[link,auth_prefetch]] to use those fields. If you're using Dovecot's deliver you'll still need to have the [[setting,userdb_sql_query]] working. ## Worker processes MySQL and SQLite lookups are always done using `auth-worker` processes. [[changed,auth_sql_workers_changed]] PostgreSQL and Cassandra lookups are done by default in the main `auth` process. They can be made to use `auth-worker` processes by setting [[setting,passdb_use_worker,yes]] and [[setting,userdb_use_worker,yes]]. ## High Availability You can add multiple [[link,sql_mysql]] or [[link,sql_postgresql]] settings to specify multiple hosts for MySQL and PostgreSQL. Dovecot will do round robin load balancing between them. If one of them goes down, the others will handle the traffic. ## Examples ::: info `user` can have a special meaning in some SQL databases, so we're using `userid` instead. ::: SQL table creation command: ```sql CREATE TABLE users ( userid VARCHAR(128) NOT NULL, domain VARCHAR(128) NOT NULL, password VARCHAR(64) NOT NULL, home VARCHAR(255) NOT NULL, uid INTEGER NOT NULL, gid INTEGER NOT NULL ); ``` ### MySQL/MariaDB Add to your `dovecot.conf` file: ```doveconf[dovecot.conf] sql_driver = mysql # The mysqld.sock socket may be in different locations in different systems. mysql /var/run/mysqld/mysqld.sock { user = admin password = pass dbname = mails #ssl = yes #ssl_client_ca_dir = /etc/ssl/certs } # Alternatively you can connect to localhost as well: #mysql localhost { #} passdb sql { query = SELECT userid AS username, domain, password \ FROM users \ WHERE userid = '%{user | username}' AND domain = '%{user | domain}' } userdb sql { query = SELECT home, uid, gid \ FROM users \ WHERE userid = '%{user | username}' AND domain = '%{user | domain}' # For using doveadm -A: iterate_query = SELECT userid AS username, domain FROM users } ``` ### PostgreSQL Add to your `dovecot.conf` file: ```doveconf[dovecot.conf] sql_driver = pgsql pgsql localhost { parameters { user = admin # You can also set up non-password authentication by modifying PostgreSQL's # pg_hba.conf password = pass dbname = mails } } passdb sql { query = SELECT userid AS username, domain, password \ FROM users \ WHERE userid = '%{user | username}' AND domain = '%{user | domain}' } userdb sql { query = SELECT home, uid, gid \ FROM users \ WHERE userid = '%{user | username}' AND domain = '%{user | domain}' # For using doveadm -A: iterate_query = SELECT userid AS username, domain FROM users } ``` ### SQLite Add to your `dovecot.conf` file: ```doveconf[dovecot.conf] sql_driver = sqlite sqlite_path = /path/to/sqlite.db passdb sql { query = SELECT userid AS username, domain, password \ FROM users \ WHERE userid = '%{user | username}' AND domain = '%{user | domain}' } userdb sql { query = SELECT home, uid, gid \ FROM users \ WHERE userid = '%{user | username}' AND domain = '%{user | domain}' # For using doveadm -A: iterate_query = SELECT userid AS username, domain FROM users } ``` # Static Password Database (`static`) ## passdb Static password database is typically used only for testing, proxying setups, and perhaps some other special kind of setups. ::: danger **Static passdb allows users to log in with any username.** ::: For password you can either set: * [[setting,passdb_static_password]] or * [[setting,passdb_fields,nopassword=yes]]. You can return any other [[link,passdb_extra_fields]]. You can use [[variable]] everywhere. ### Example ::: code-group ```[without password] passdb static { fields { nopassword = yes proxy = yes host = 127.0.0.1 } } ``` ```[with password] passdb static { password = secret fields { proxy = yes host = 127.0.0.1 } } ``` ::: ## userdb Static user database can be used when you want to use only single UID and GID values for all users, and their home directories can be specified with a simple template. The syntax is: ```doveconf[dovecot.conf] userdb static { fields { uid = gid = home = } } ``` The home is optional. You can also return other [[link,userdb_extra_fields]]. You can use [[variable]] everywhere. For the above 3 fields a static userdb isn't actually necessary at all. Instead, you can just leave out the userdb configuration and set: * [[setting,mail_uid]] * [[setting,mail_gid]] * [[setting,mail_home]] ### LDA and passdb Lookup for User Verification Unless your MTA already verifies that the user exists before calling dovecot-lda, you'll most likely want dovecot-lda itself to verify the user's existence. Since dovecot-lda looks up the user only from the userdb, it of course doesn't work with static userdb because there is no list of users. Normally static userdb handles this by doing a passdb lookup instead. This works with most passdbs, with [[link,auth_pam]] being the most notable exception. If you want to avoid this user verification, you can add [[setting,userdb_static_allow_all_users,yes]] to the settings of the userdb in which case the passdb lookup is skipped. ### Example ```doveconf[dovecot.conf] userdb static { fields { uid = 500 gid = 500 home = /home/%{user} } } ``` # Master Users/Passwords It is possible to configure "master" users who are able to log in as other users. It's also possible to directly log in as any user using a master password. ## Master Users There are two ways for master users to log in as other users: 1. Give the login username in the [[link,authentication_mechanisms]] authorization ID field. 2. Specify both the master username and the login username in the same username field. See [[setting,auth_master_user_separator]] for the format of the string. Master users are configured by adding a new [[link,passdb]] with `master=yes` setting. The users in the master passdb cannot log in as themselves, only as other people. That means they don't need to exist in the [[link,userdb]], because the userdb lookup is done only for the user they're logging in as. You should also add the `result_success=continue` setting to the master passdb if possible. It means that Dovecot verifies that the login user really exists before allowing the master user to log in. Without the setting, if a nonexistent login username is given, depending on the configuration, it could either return an internal login error (the userdb lookup failed) or create a whole new user (with, e.g., [[link,auth_staticdb]]). `result_success=continue` doesn't work with PAM or LDAP without [[setting,passdb_ldap_bind,yes]], because both of them require knowing the user's password. If you want master users to be able to log in as themselves, you'll need to either add the user to the normal passdb or add the passdb to dovecot.conf twice, with and without `master=yes`. ::: info If the passdbs point to different locations, the user can have a different password when logging in as other users than when logging in as himself. This is a good idea since it can avoid accidentally logging in as someone else. ::: Usually it's better to have **only** a few special master users that are used only to log in as other people. One example could be a special "spam" master user that trains the users' spam filters by reading the messages from the user's spam mailbox. ### ACLs If [[plugin,acl]] plugin is enabled, the master user is still subject to ACLs just like any other user, which means that by default the master user has no access to any mailboxes of the user. The options for handling this are: 1. Adding a global [[plugin,acl,ACL]] for the master user. You can create a `default ACL`, that applies to all mailboxes. See example below. 2. Set [[setting,acl_user,%{user}]]. This preserves the master_user for other purposes (e.g. `%{master_user}` variable). 3. Change userdb to return `userdb_fields { master_user=%{user} }`. This fully hides that master user login is being used. Example configuration: ```doveconf[dovecot.conf] auth_master_user_separator = * passdb passwd-file { passwd_file_path = /etc/dovecot/passwd.masterusers master = yes result_success = continue } userdb passwd { } ``` To grant the master user access to all Mailboxes, the `dovecot-acl` file can contain: ``` * user=masteruser lr ``` Where the `passwd.masterusers` file would contain the master usernames and passwords: ``` admin:{SHA1}nU4eI71bcnBGqeO0t9tXvY1u5oQ= admin2:{SHA1}i+UhJqb95FCnFio2UdWJu1HpV50= ``` One way to create this master file is to use the htaccess program as follows: ```sh htpasswd -b -c -s passwd.masterusers user password ``` ### SQL Example The master passdb doesn't have to be passwd-file, it could be an SQL query as well: ```doveconf[dovecot.conf] sql_driver = mysql mysql localhost { } auth_master_user_separator = * passdb db1 { driver = sql query = SELECT password FROM users WHERE userid = '%{user}' and master_user = true master = yes result_success = continue } passdb db2 { driver = sql query = # ... } userdb sql { query = # ... } ``` ### Testing ``` # nc localhost 143 * OK Dovecot ready. 1 login loginuser*masteruser masterpass 1 OK Logged in. ``` If you had any problems, set [[setting,log_debug,category=auth]] and look at the logs. ## Master Passwords You can configure a passdb which first performs authentication using the master password. Then it continues to the primary passdb to verify that the user exists and get other extra fields. ```doveconf[dovecot.conf] # master password passdb passdb static { password = master-password result_success = continue } # primary passdb passdb pam { } ``` ### Advanced SQL Examples For these examples, we will create 3 kinds of master users: * Users who can read all email for all domains * Users who can read all email for their domain only * Users who can read email of domains listed in a separate ownership table. We will use MySQL and create 2 tables with the following structure. ```sql CREATE TABLE `users` ( `uid` int(4) NOT NULL AUTO_INCREMENT, `user_name` varchar(80) NOT NULL, `domain_name` varchar(80) NOT NULL, `password` varchar(60) DEFAULT NULL, `last_login` datetime DEFAULT NULL, `masteradmin` tinyint(1) NOT NULL DEFAULT '0', `owns_domain` tinyint(1) NOT NULL DEFAULT '0', UNIQUE KEY `emaillookup` (`domain_name`,`user_name`), UNIQUE KEY `uid` (`uid`) ) ENGINE=InnoDB AUTO_INCREMENT=995 DEFAULT CHARSET=utf8 CREATE TABLE `ownership` ( `login_id` varchar(128) NOT NULL, `owned_object` varchar(128) NOT NULL, UNIQUE KEY `login_id_full` (`login_id`,`owned_object`), KEY `login_id` (`login_id`), KEY `owned_object` (`owned_object`), KEY `login_id_index` (`login_id`), KEY `owned_object_index` (`owned_object`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 ``` The `dovecot.conf` file for all 3 master user configurations will be as follows: ```doveconf[dovecot.conf] passdb db1 { driver = sql args = /etc/dovecot/ownership-sql.conf master = yes result_success = continue } passdb db2 { driver = sql args = /etc/dovecot/domain-owner-sql.conf master = yes result_success = continue } passdb db3 { driver = sql args = /etc/dovecot/masteradmin-sql.conf master = yes result_success = continue } passdb db4 { driver = sql args = /etc/dovecot/sql.conf } ``` Before we get into the master user tricks, we start with normal email authentication. The query for that is as follows: ```doveconf[dovecot.conf] passdb sql { query = SELECT user_name, domain_name, password \ FROM users \ WHERE user_name = '%{user | username}' AND domain_name = '%{user | domain}' } ``` In this first example, suppose you want to allow a few people to be master users over all domains. These users will have the `masteradmin` field set to `1`. The query would be: ```doveconf[dovecot.conf] passdb sql { query = SELECT user_name, domain_name, password \ FROM users \ WHERE user_name = '%{user | username}' AND domain_name = '%{user | domain}' AND masteradmin='1' } ``` In the second example, suppose you are hosting multiple domains and you want to allow a few users to become master users of their domain only. Your query would be as follows: ```doveconf[dovecot.conf] passdb sql { query = SELECT user_name, domain_name, password \ FROM users \ WHERE user_name = '%{user | username}' AND domain_name = '%{user | domain}' AND owns_domain='1' AND '%{user | domain}'='%{login_domain}' } ``` This will allow you to log in using `joe@dovecot.org*master@dovecot.org` to read Joe's email if master@dovecot.org is flagged as the `domain_owner`. In the third example, we have a table of owners. There are a list of pairs between owner email addresses and domains that are owned. That way if a person controls a lot of domains then they can view all the users in all the domains they control. The query would be as follows: ```doveconf[dovecot.conf] passdb sql { query = SELECT user_name, domain_name, password \ FROM users, ownership \ WHERE user_name = '%{user | username}' AND domain_name = '%{user | domain}' AND login_id='%{user}' AND owned_object='%{login_domain}' } ``` If you really want to get tricky and efficient you can combine all 3 queries into one giant query that does everything. ```doveconf[dovecot.conf] passdb sql { query = SELECT user_name, domain_name, password \ FROM users, ownership \ WHERE user_name = '%{user | username}' AND domain_name = '%{user | domain}' \ AND ( (masteradmin='1') OR (owns_domain='1' AND '%{user | domain}'='%{login_domain}') \ OR (login_id='%{user}' and owned_object='%{login_domain}') ) \ GROUP BY uid } ``` # Digest-MD5 Digest-MD5 has two things that make it special and which can cause problems: - Instead of using user@domain usernames, it supports **realms**. - User name and realm are part of the MD5 hash that's used for authentication. For these and other reasons Digest-MD5 has been obsoleted ([[rfc,6331]]) by SCRAM ([[rfc,5802]]). ## Realms Realms are an integral part of Digest-MD5. You will need to specify realms you want to advertise to the client in the config file: [[setting,auth_realms,example.com another.example.com foo]]. The realms don't have to be domains. All listed realms are presented to the client and it can select to use one of them. Some clients always use the first realm. Some clients use your domain name, whenever given more than one realm to choose from. Even if this was NOT one of the choices you provided (KMail, others?). In both cases the user never sees the advertised realms. ::: warning Any settings that modify the username before the passdb lookup (e.g. [[setting,auth_default_domain]]) will not work with Digest-MD5 password scheme, because the password hash was calculated using the unmodified username. Any username modification will result in hash mismatch. ::: ## DIGEST-MD5 Scheme Password must be stored in either cleartext or with DIGEST-MD5 scheme. See [[link,password_schemes]]. The Digest is the MD5 sum of the string "user:realm:password". For example, if you want to log in as `user` with password `pass` and the realm should be `example.com` (usually not provided by the user, see above), create the digest with: ```sh echo -n "user:example.com:pass" | md5sum c19c4c6e32f9d8026b26ba77c21fb8eb - ``` And save it as: `user@example.com:c19c4c6e32f9d8026b26ba77c21fb8eb`. Note that if you're using DIGEST-MD5 scheme to store the passwords, you can't change the users' names or realms in any way or the authentication will fail because the MD5 sums don't match. Also not that this is different from what Apache does with HTTP AUTH Digest. There it would be `user:example.com:c19c4c6e32f9d8026b26ba77c21fb8eb` and is created with `htdigest`. ## Testing You can use `imtest` from [Cyrus SASL](https://www.cyrusimap.org/sasl/) library to test an IMAP connection: ``` # With realm: imtest -a user -r example.com # Without realm: imtest -a user@example.com ``` # GSSAPI GSSAPI (Generic Security Services Application Program Interface) is an authentication mechanism that provides mutual authentication using opaque messages (such as tokens). GSSAPI is usually used with Kerberos, and is a good choice when dealing with centralized authentications, like Active Directory or FreeIPA. These instructions cover using Kerberos, and assume that you have a fully functional Kerberos environment. Most importantly, you need to ensure your DNS lookups and reverse DNS lookups work and return correct names. ## Preparations First thing, you need to create Service Principal for Dovecot. This is done with `kadmin` tool. ```sh kadmin -q 'addprinc -randkey imap/fully.qualified.host@REALM' kadmin -q 'addprinc -randkey IMAP/fully.qualified.host@REALM' ``` To create a keytab, use: ```sh kadmin -q 'ktadd -k /root/keytab imap/fully.qualified.host@REALM' kadmin -q 'ktadd -k /root/keytab IMAP/fully.qualified.host@REALM' ``` and put the keytab file into `/etc/dovecot`, set mode `0440` and ownership to `root:dovecot`. On Active Directory, you need to create a Service User with password that never expires and cannot be changed, and then use `setspn.exe` to create the service principals for this user. ```sh setspn -A IMAP/hostname service_user_name setspn -A imap/hostname service_user_name ``` Then you need to use `ktpass` utility to export the keytab. ```sh ktpass -princ imap/hostname -mapuser service_user_name \ -crypto ALL -ptype KRB5_NT_PRINCIPAL -pass service_user_password \ -target dc.test.com -out c:\share\keytab ktpass -princ IMAP/hostname -mapuser service_user_name -crypto ALL \ -ptype KRB5_NT_PRINCIPAL -pass service_user_password \ -target dc.test.com -out c:\share\keytab ``` Use `klist` on your Dovecot server to verify the keytab contains the expected results: ```sh klist -k /etc/dovecot/keytab ``` ``` Keytab name: FILE:/etc/krb5.keytab KVNO Principal ---- -------------------------------------------------------------------------- 2 imap/hostname@REALM ``` ## Configuring Dovecot Once you have a keytab, configure GSSAPI on Dovecot. ```doveconf[dovecot.conf] auth_mechanisms { gssapi = yes } auth_gssapi_hostname = hostname-from-spn # or "$ALL" auth_krb5_keytab = /etc/dovecot/keytab ``` This should enable GSSAPI support for Dovecot. GSSAPI requires at least one passdb configured. Note that authentication will normally succeed, even if user is not found in any passdb. Please configure a userdb if you do not want this. ### Specifying Accepted Credential If passdb lookup succeeds, it can optionally return `k5principals` extra field, which contains comma separated list of identities to accepted for the user. This enables cross-realm and on-behalf authentication. See [[link,passdb_extra_fields]]. ### Testing You need an GSSAPI capable client, such as Thunderbird, running on a fully working Kerberos workstation. You can choose GSSAPI as your authentication mechanism and you should be able to log in. If necessary, you can use [[setting,auth_username_format]] to normalize usernames. # Kerberos Authentication Dovecot supports Kerberos 5 using GSSAPI. The Kerberos authentication mechanism doesn't require having a [[link,passdb]], but you do need a [[link,userdb]] so Dovecot can lookup user-specific information, such as where their mailboxes are stored. With centralized systems, such as Microsoft Active Directory, LDAP is a good choice. ::: info If you only wish to authenticate clients using their Kerberos *passphrase* (as opposed to ticket authentication), you will probably want to use [[link,auth_pam]] with `pam_krb5.so` instead. ::: ## Pre-requisites This document assumes that you already have a Kerberos Realm up and functioning correctly at your site, and that each host in your realm also has a host *keytab* installed in the appropriate location. For Dovecot, you will need to install the appropriate *service* keys on your server. By default, Dovecot will look for these in the host's keytab file, typically `/etc/krb5.keytab`, but you can specify an alternate path using [[setting,auth_krb5_keytab]]. Keytab file should be readable by user "dovecot" (or whatever user the auth process is running as). If you wish to provide an IMAP service, you will need to install a service ticket of the form `imap/hostname@REALM`. For POP3, you will need a service ticket of the form `pop/hostname@REALM`. When using Dovecot's [[link,sasl]] with [[link,mta]], you will need to install service ticket of the form `smtp/hostname@REALM`. ## Setting up samba Create symlink for krb5.conf, if you do not have krb5.conf ready: ```sh ln -sf /usr/local/samba/private/krb5.conf /etc/krb5.conf ``` Create Dovecot user to your samba instance (choose random password): ```sh samba-tool user create dovecot ``` ``` New Password: Retype Password: User 'dovecot' created successfully ``` Add Service Principal Names (SPNs) and create keytab: ```sh samba-tool spn add imap/host.domain.com dovecot samba-tool domain exportkeytab --principal imap/host.domain.com /etc/dovecot/dovecot.keytab ``` Dovecot needs to be able to read the keytab: ```sh chgrp dovecot /etc/dovecot/dovecot.keytab chmod g+r /etc/dovecot/dovecot.keytab ``` Make sure your keytab has entry for `imap/host.domain.name@REALM`: ```sh klist -Kek /etc/dovecot/dovecot.keytab ``` ``` Keytab name: FILE:/etc/dovecot/dovecot.keytab KVNO Principal ---- -------------------------------------------------------------------------- 1 imap/host.domain.name@REALM (des-cbc-crc) 1 imap/host.domain.name@REALM (des-cbc-md5) 1 imap/host.domain.name@REALM (arcfour-hmac) ``` ## Example Configurations If you only want to use Kerberos ticket-based authentication: ```doveconf[dovecot.conf] auth_gssapi_hostname = "$ALL" auth_mechanisms = gssapi auth_krb5_keytab = /etc/dovecot/dovecot.keytab userdb static { fields { uid = vmail gid = vmail home = /var/vmail/%{user} } } ``` (In this virtual-hosting example, all mail is stored in `/var/vmail/$username` with uid and gid set to 'vmail') If you also want to support plaintext authentication in addition to ticket-based authentication, you will need something like: ```doveconf[dovecot.conf] auth_mechanisms = plain login gssapi auth_gssapi_hostname = "$ALL" auth_krb5_keytab = /etc/dovecot/dovecot.keytab passdb pam { } userdb passwd { } ``` ::: info In this example, you will also need to configure PAM to use whichever authentication backends are appropriate for your site. ::: ## Enable Plaintext Authentication to use Kerberos This is needed when some of your clients don't support GSSAPI and you still want them to authenticate against Kerberos. Install pam_krb5 module for PAM, and create `/etc/pam.d/dovecot`: ``` auth sufficient pam_krb5.so account sufficient pam_krb5.so ``` Then enable PAM passdb: ```doveconf[dovecot.conf] passdb pam { } ``` Check `/var/log/auth.log` if you have any problems logging in. The problem could be that PAM is still trying to use pam_unix.so rather than pam_krb5.so. Make sure pam_krb5.so is the first module for account or just change pam_unix.so to sufficient. ## Cross-Realm Authentication This seems to have all kinds of trouble. Search Dovecot mailing list for previous threads about it. Some points about it: - `krb5_kuserok()` is used to check if access is allowed. It may try to do the check by reading `~user/.k5login` (good!) or `~dovecot/.k5login` (bad!) - Solaris uses `gss_userok()` instead of `krb5_kuserok()`. See "k5principals" [[link,passdb_extra_fields]] which is a comma separated list of usernames that are allowed to log in. If it's set, it bypasses the `krb5_kuserok()` check. ::: info For this to work, you need a password database which supports **credential lookups**. This excludes LDAP databases using authentication binds ([[setting,passdb_ldap_bind,yes]]). However, a second LDAP passdb entry without [[setting,passdb_ldap_bind,yes]] may be added for the sole purpose of Kerberos principals mapping. This passdb doesn't need to return a password attribute (and usually shouldn't). Authentication-bind LDAP databases are able to provide `k5principals` lookups if configured with `pass_filter`. ::: ## Client Support Mail clients that support Kerberos GSSAPI authentication include: - Evolution - Mozilla Thunderbird - SeaMonkey - Mutt - UW Pine - Apple Mail ## Testing This test demonstrates that the server can acquire its private credentials. You need to configure your server accordingly, and then you can use mutt client to test this. First telnet directly to the server: ```sh telnet localhost 143 ``` ``` * OK Dovecot ready. ``` or, if you are using IMAPS then use openssl instead of telnet to connect: ```sh openssl s_client -connect localhost:993 ``` ``` CONNECTED(00000003) ... * OK Dovecot ready. ``` Check that GSSAPI appears in the authentication capabilities: ``` a capability * CAPABILITY ... AUTH=GSSAPI ``` Attempt the first round of GSS communication. The '+' indicates that the server is ready: ``` a authenticate GSSAPI + ``` Abort the telnet session by typing control-] and then 'close': ``` ^] telnet> close ``` The test: - Setup mutt in /etc/Muttrc to use kerberos using gssapi and imap configuration - This is done with `set imap_authenticators="gssapi"` - run `kinit` (type in password for kerb) - run command `mutt` - If you get error "No Authentication Method" - run command `klist` (list all kerberos keys) should show imap/HOSTNAME - DNS has to function correctly so that kerberos works. # Authentication (SASL) Mechanisms ## Cleartext Authentication The simplest authentication mechanism is PLAIN. The client simply sends the password unencrypted to Dovecot. All clients support the PLAIN mechanism, but obviously there's the problem that anyone listening on the network can steal the password. For that reason (and some others) other mechanisms were implemented. Today however many people use [[link,ssl]], and there's no problem with sending unencrypted password inside SSL secured connections. So if you're using SSL, you probably don't need to bother worrying about anything else than the PLAIN mechanism. Another cleartext mechanism is LOGIN. It's typically used only by SMTP servers to let Outlook clients perform SMTP authentication. Note that LOGIN mechanism is not the same as IMAP's LOGIN command. The LOGIN command is internally handled using PLAIN mechanism. ## Non-Cleartext Authentication Non-cleartext mechanisms have been designed to be safe to use even without [[link,ssl]] encryption. Because of how they have been designed, they require access to the cleartext password or their own special hashed version of it. This means that it's impossible to use non-cleartext mechanisms with password hashes. If you want to use more than one non-cleartext mechanism, the passwords must be stored as cleartext so that Dovecot is able to generate the required special hashes for all the different mechanisms. If you want to use only one non-cleartext mechanism, you can store the passwords using the mechanism's own [[link,password_schemes]]. With success/failure password databases (see [[link,passdb]], e.g. [[link,auth_pam]]), it's not possible to use non-cleartext mechanisms at all, because they only support verifying a known cleartext password. ### Dovecot Support | Mechanism | Summary | | --------- | ------- | | CRAM-MD5 | Protects the password in transit against eavesdroppers. Somewhat good support in clients.| | [[link,auth_digest_md5]] | Somewhat stronger cryptographically than CRAM-MD5, but clients rarely support it. | | SCRAM-SHA-1 | Salted Challenge Response Authentication Mechanism (SCRAM) SAS and GSS-API Mechanisms. Intended as DIGEST-MD5 replacement. [[rfc,5802]] | | SCRAM-SHA-1-PLUS| SCRAM-SHA-1 with channel binding support [[rfc,5802]]. | | SCRAM-SHA-256 | Stronger replacement for SCRAM-SHA-1 [[rfc,7677]]. | | SCRAM-SHA-256-PLUS| SCRAM-SHA-256 with channel binding support [[rfc,7677]]. | | APOP | This is a POP3-specific authentication. Similar to CRAM-MD5, but requires storing password in cleartext. | | [[link,auth_gssapi,GSS-SPNEGO]] | A wrapper mechanism defined by [[rfc,4178]]. Can be accessed via GSSAPI. | | [[link,auth_gssapi]] | Kerberos v5 support. | | ANONYMOUS | Support for logging in anonymously. This may be useful if you're intending to provide publicly accessible IMAP archive. | | OTP | [[removed,otp_auth_mechanism_removed]] One time password mechanisms. | | EXTERNAL | EXTERNAL SASL mechanism. | | [[link,auth_oauth2,OAUTHBEARER]] | OAuth2 bearer authentication [[rfc,7628]]. | | [[link,auth_oauth2,XOAUTH2]] | [Google flavor OAUTHBEARER](https://developers.google.com/gmail/imap/xoauth2-protocol) | ## Configuration By default only PLAIN mechanism is enabled. To use more, see [[setting,auth_mechanisms]]. # Winbind Mechanisms Dovecot supports NTLM and GSS-SPNEGO authentication mechanisms using [Samba](https://www.samba.org)'s winbind daemon. It is useful when you need to authenticate users against a Windows domain (either AD or NT). By default NTLM mechanism is handled internally. You can use winbind instead by setting [[setting,auth_use_winbind,yes]]. The usernames, returned by winbind, can contain some domain part (either "DOMAIN\user" or "user@example.com"). Such usernames are always transformed to the form of "user@domain". To strip domain part (to obtain corresponding local username, for example), set [[setting,auth_username_format,%{user | username}]]. Dovecot needs path to Samba's `ntlm_auth` binary to perform the authentication. You can change the path with [[setting,auth_winbind_helper_path,/usr/bin/ntlm_auth]]. Dovecot currently does blocking lookups, so if `ntlm_auth` is slow on responding (e.g. network problems), Dovecot blocks all other authentication requests until it's finished. # Multiple Authentication Databases Dovecot supports defining multiple authentication databases, so that if the password doesn't match in the first database, it checks the next one. This can be useful if you want to easily support having both local system users in `/etc/passwd` and virtual users. Currently the fallback works only with the PLAIN authentication mechanism. Often you also want a different mail location for system and virtual users. The best way to do this would be to always have mails stored below the home directory. * System users' mails: /home/user/Maildir * Virtual users' mails: /var/vmail/domain/user/Maildir This can be done by simply having both system and virtual userdbs return home directory properly (i.e. virtual users' `home=/var/vmail/%{user | domain}/%{user | username}`) and then set [[setting,mail_path,~/Maildir]]. If it's not possible to have a home directory for virtual users (avoid that if possible), you can do this by pointing multiple authentication databases to system users' mail location and have the virtual userdb override it by returning mail [[link,passdb_extra_fields]]. ## Example with Home Dirs * System users' mails: /home/user/Maildir * Virtual users' mails: /var/vmail/domain/user/Maildir ::: code-group ```doveconf[dovecot.conf] # Mail location for both system and virtual users: mail_driver = maildir mail_path = ~/Maildir sql_driver = mysql mysql localhost { } # try to authenticate using SQL database first passdb sql { query = SELECT userid AS user, password FROM users WHERE userid = '%{user}' } # fallback to PAM passdb pam { } # look up users from SQL first (even if authentication was done using PAM!) userdb sql { query = SELECT uid, gid, '/var/vmail/%{user | domain}/%{user | username}' AS home FROM users WHERE userid = '%{user}' } # if not found, fallback to /etc/passwd userdb passwd { } ``` # Authentication Dovecot authentication is split into four parts: 1. [[link,authentication_mechanisms,Authentication Mechanisms]] 2. [[link,password_schemes,Password Schemes]] 3. [[link,passdb,Password Databases (passdb)]] * [[link,passdb_extra_fields,passdb Extra Fields]] 4. [[link,userdb,User Databases (userdb)]] * [[link,userdb,User Databases (userdb)]] For authentication policy topics, see also: * [[link,auth_penalty]] * [[link,auth_policy]] ## Cleartext Mechanisms A cleartext mechanism is an authentication mechanism that contains users' passwords or credentials in non-encrypted and non-hashed format. For example, PLAIN, LOGIN or XOAUTH2 mechanisms contain credentials which an attacker can use to authenticate if they are captured. To protect against this, connection encryption with TLS (or some other mechanism) is required by default. See [[setting,auth_allow_cleartext]] for removing this requirement. ## Authentication Mechanisms vs. Password Schemes Authentication mechanisms and password schemes are often confused, because they have somewhat similar values. For example there is a PLAIN auth mechanism and PLAIN password scheme. But they mean completely different things. - **Authentication mechanism is a client/server protocol**. It's about how the client and server talk to each others in order to perform the authentication. Most people use only PLAIN authentication, which basically means that the user and password are sent without any kind of encryption to the server. SSL/TLS can then be used to provide the encryption to make PLAIN authentication secure. **Password scheme is about how the password is hashed in your password database**. If you use a PLAIN scheme, your passwords are stored in cleartext without any hashing in the password database. A popular password scheme MD5-CRYPT (also commonly used in `/etc/shadow`) where passwords looks like `$1$oDMXOrCA$plmv4yuMdGhL9xekM.q.I/`. - Cleartext authentication mechanisms work with ALL password schemes. - Non-cleartext authentication mechanisms require either PLAIN password scheme or a mechanism-specific password scheme. ## Debugging Set [[setting,log_debug,category=auth]] which makes Dovecot log a debug line for just about anything related to authentication. If you're having problems with passwords, you can also set [[setting,auth_debug_passwords,yes]] which will log them in cleartext. After that you'll see in the logs exactly what dovecot-auth is doing, and that should help you to fix the problem. For easily testing authentication, use [[doveadm,auth test,user@domain password]]. For looking up userdb information for a user, use [[doveadm,user,user@domain]]. For simulating a full login with both passdb and userdb lookup, use [[doveadm,auth login,user@domain password]]. ### PLAIN SASL Mechanism With IMAP and POP3, it's easy to log in manually using the IMAP's LOGIN command or POP3's USER and PASS commands (see [[link,testing]] for details), but with SMTP AUTH you'll need to use PLAIN authentication mechanism, which requires you to build a base64-encoded string in the correct format. The PLAIN authentication is also used internally by both IMAP and POP3 to authenticate to dovecot-auth, so you see it in the debug logs. The PLAIN mechanism's authentication format is: ` NUL NUL `. Authorization ID is the username who you want to log in as, and authentication ID is the username whose password you're giving. If you're not planning on doing a [[link,auth_master_users,master user login]], you can either set both of these fields to the same username, or leave the authorization ID empty. #### Encoding with mmencode printf(1) and mmencode(1) should be available on most Unix or GNU/Linux systems. (If not, check with your distribution. GNU coreutils includes printf(1), and metamail includes mmencode(1). In Debian, mmencode is called mimencode(1).) ```sh printf 'username\0username\0password' | mmencode ``` ``` dXNlcm5hbWUAdXNlcm5hbWUAcGFzc3dvcmQ= ``` This string is what a client would use to attempt PLAIN authentication as user `username` with password `password`. With [[setting,auth_debug_passwords,yes]], it would appear in your logs. #### Decoding with mmencode You can use `mmencode -u` to interpret the encoded string pasted into stdin: ```sh mmencode -u ``` ``` bXl1c2VybmFtZUBkb21haW4udGxkAG15dXNlcm5hbWVAZG9tYWluLnRsZABteXBhc3N3b3Jk myusername@domain.tldmyusername@domain.tldmypassword # ``` You should see the correct user address (twice) and password. The null bytes won't display. #### Encoding with Perl Unfortunately, mmencode on FreeBSD chokes on `\0`. As an alternate, if you have MIME::Base64 on your system, you can use a perl statement to do the same thing: ```sh perl -MMIME::Base64 -e 'print encode_base64("myusername\@domain.tld\0myusername\@domain.tld\0mypassword");' ``` As `mmencode -u` doesn't encounter any `\0` you can still do: ```sh perl -MMIME::Base64 -e 'print encode_base64("myusername\@domain.tld\0myusername\@domain.tld\0mypassword");' | mmencode -u ``` to check that you have encoded correctly. #### Encoding with Python With python you can do: ```sh python -c "import base64; print(base64.encodestring('myusername@domain.tld\0myusername@domain.tld\0mypassword'));" ``` # Password Databases (`passdb`) Dovecot uses `passdb` and [[link,userdb]] as part of the authentication process. `passdb` authenticates the user. It also provides any other pre-login information needed for users, such as: * Which server user is proxied to. * If user should be allowed to log in at all (temporarily or permanently). | Passdb Lookups | Dovecot Proxy | Dovecot Backend | | -------------- | ------------- | --------------- | | IMAP & POP3 logins | YES | YES | | LMTP mail delivery | YES | YES | | doveadm commands | YES | YES | See also [[link,userdb]]. ## Authentication Databases See [[link,auth_databases]]. ## Passwords The password can be in any format that Dovecot supports, but you need to tell the format to Dovecot because it won't try to guess it. The SQL and LDAP configuration files have the `default_pass_scheme` setting for this. If you have passwords in multiple formats, or the `passdb` doesn't have such a setting, you'll need to prefix each password with `{}`: `{PLAIN}cleartext-password` or `{PLAIN-MD5}1a1dc91c907325c69271ddf0c944bc72`. Dovecot authenticates users against password databases. It can also be used to configure things like [[link,authentication_proxies]]. ## Multiple Passdbs You can use multiple databases, so if the password doesn't match in the first database, Dovecot checks the next one. This can be useful if you want to easily support having both virtual users and also local system users (see [[link,auth_multiple_dbs]]). You can control the behavior of what happens after a passdb lookup is successful or unsuccessful with settings: * [[setting,passdb_result_success]] * [[setting,passdb_result_failure]] * [[setting,passdb_result_internalfail]] When using passdbs inside a `protocol ... { ... }` filter, the protocol-specific passdbs are executed first, and only then followed by the globally defined passdbs. Currently it's not possible to configure passdbs inside other filters. ## Success/Failure Database These **databases** simply verify if the given password is correct for the user. Dovecot doesn't get the correct password from the database, it only gets a `success` or a `failure` reply. This means that these databases can't be used with non-cleartext [[link,authentication_mechanisms]]. Databases that belong to this category are: | Database | Description | | -------- | ----------- | | [[link,auth_pam,PAM]] | Pluggable Authentication Modules. | | [[link,auth_imap,IMAP]] | Authenticate against remote IMAP server. | | [[link,auth_oauth2,OAuth2]] | Authenticate against OAuth2 provider. | | [[link,auth_bsd,BSDAuth]] | BSD authentication (deprecated, unsupported). | ## Lookup Database Dovecot does a lookup based on the username and possibly other information (e.g. IP address) and verifies the password validity itself. Databases that support looking up only passwords, but no user or extra fields: | Database | Description | | -------- | ----------- | | [[link,auth_passwd,Passwd]] | System users (NSS, `/etc/passwd`, or similar). | ::: info Dovecot supports reading all [[link,password_schemes]] from passwd databases (if prefix is specified), but that is of course incompatible with all other tools using/modifying the passwords. ::: Databases that support looking up everything: | Database | Description | | -------- | ----------- | | [[link,auth_passwd_file,Passwd-file]] | `/etc/passwd`-like file. | | [[link,auth_ldap,LDAP]] | Lightweight Directory Access Protocol. | | [[link,auth_sql,SQL]] | SQL database (PostgreSQL, MySQL, SQLite, Cassandra). | | [[link,auth_staticdb,Static]] | Static `passdb` for simple configurations. | | [[link,auth_lua,Lua]] | Lua script for authentication. | ### Fields Fields that the lookup can return: #### `password` User's password. See [[link,password_schemes]]. #### `password_noscheme` Like `password`, but if a password begins with `{`, assume it belongs to the password itself instead of treating it as a [[link,password_schemes]] prefix. This is usually needed only if you use cleartext passwords. #### `user` Returning a user field can be used to change the username. Typically used only for case changes (e.g. `UseR` -> `user`). See [[link,passdb_user_extra_fields]]. #### `username` Like `user`, but doesn't drop existing domain name (e.g. `username=foo` for `user@domain` gives `foo@domain`). #### `domain` Updates the domain part of the username. #### User Extra Fields Other special [[link,passdb_extra_fields]]. ## Settings ## Result Values The following values control the behavior of a passdb lookup result: ### `return-ok` Return success, don't continue to the next `passdb`. ### `return-fail` Return failure, don't continue to the next `passdb`. ### `return` Return earlier `passdb`'s success or failure, don't continue to the next `passdb`. If this was the first `passdb`, return failure. ### `continue-ok` Set the current authentication state to "success", and continue to the next `passdb`. The following `passdb`s will skip password verification. ::: info When using this value on a master `passdb { master = yes }`, execution will jump to the first non-master `passdb` instead of continuing with the next master `passdb`. ::: ### `continue-fail` Set the current authentication state to "failure", and continue to the next `passdb`. The following `passdb`s will still verify the password. ::: info When using this value on a master `passdb { master = yes }`, execution will jump to the first non-master `passdb` instead of continuing with the next master `passdb`. ::: ### `continue` Continue to the next `passdb` without changing the authentication state. The initial state is "failure found". If this was set in [[setting,passdb_result_success]], the following `passdb`s will skip password verification. ::: info When using this value on a master `passdb` (`master = yes`), execution will jump to the first non-master `passdb` instead of continuing with the next master `passdb`. ::: ## Extra Fields The primary purpose of a password database lookup is to return the password for a given user. It may however also return other fields which are treated specially. How to return these extra fields depends on the password database you use. Some `passdb`s don't support returning them at all, such as [[link,auth_pam]]. Boolean fields are true always if the field exists. So `nodelay`, `nodelay=yes`, `nodelay=no` and `nodelay=0` all mean that the "nodelay" field is true. With SQL the field is considered to be nonexistent if its value is NULL. ::: info [[changed,extra_fields_empty]] Extra fields can now also be set to empty string, while previously they were changed to `yes`. Extra fields without value (without `=`) will default to `yes`. ::: ### `userdb_` The password database may also return fields prefixed with `userdb_`. These fields are only saved and used later as if they came from the [[link,userdb_extra_fields]]. Typically this is used only when using [[link,auth_prefetch]]. ### Suffixes The following suffixes added to a field name are handled specially: #### `:default` Set this field only if it hasn't been set before. ::: info [[changed,extra_fields_default]] This was called `:protected` in earlier versions. ::: #### `:remove` Remove this field entirely. ### Fields #### `user` Change the username (eg. lowercase it). This is mostly useful in case-insensitive username lookups to get the username returned back using the same casing always. Otherwise depending on your configuration it may cause problems, such as `/var/mail/user` and `/var/mail/User` mailboxes created for the same user. ##### SQL Example An example [[setting,passdb_sql_query]] would be: ```doveconf[dovecot.conf] passdb sql { query = SELECT concat(user, '@', domain) AS user, password \ FROM users \ WHERE user = '%{user | username}' and domain = '%{user | domain}' } ``` You can also update "username" and "domain" fields separately: ```doveconf[dovecot.conf] passdb sql { query = SELECT user AS username, domain, password \ FROM users \ WHERE user = '%{user | username}' and domain = '%{user | domain}' } ``` #### `login_user` Master `passdb` can use this to change the username. #### `allow_nets` Allow user to log in from only specified IPs (checks against remote client IP). This field is a comma separated list of IP addresses and/or networks where the user is allowed to log in from. If the user tries to log in from elsewhere, the authentication will fail the same way as if a wrong password was given. Example: `allow_nets=127.0.0.0/8,192.168.0.0/16,1.2.3.4,4.5.6.7`. IPv6 addresses are also allowed. IPv6 mapped IPv4 addresses (eg. `::ffff:1.2.3.4`) are converted to standard IPv4 addresses before matching. Example: `allow_nets=::1,2001:abcd:abcd::0:0/80,1.2.3.4`. Using `local` matches any auth connection that doesn't have an IP address. This usually means internal auth lookups from, e.g., doveadm. Example: `allow_nets=127.0.0.0/8,local`. ##### Example [[link,auth_passwd_file]] example: ``` user:{plain}password::::::allow_nets=192.168.0.0/24 ``` ##### 'local' Keyword The keyword `local` is accepted for Non-IP connections like Unix socket. For example, with a Postfix/LMTP delivery setup, you must include `local` for Postfix to verify the email account: ```doveconf[dovecot.conf] passdb static { password = test fields { allow_nets = local,127.0.0.1/32 } } ``` Otherwise, you will see this error in the log: "[/var/run/dovecot/lmtp] said: 550 5.1.1 User doesn't exist: test2@example.com (in reply to RCPT TO command))". #### `allow_real_nets` Allow user's network connection to log in from only specified IPs (checks against real remote IP, e.g. a Dovecot proxy). See [`allow_nets`](#allow-nets) for additional documentation. #### `proxy` Proxy the connection to another IMAP/POP3 server. See [[link,authentication_proxies]]. #### `proxy_maybe` Proxy the connection to another IMAP/POP3 server. See [[link,authentication_proxies]]. #### `host` Send login referral to client (if `proxy=y` field isn't set). See [[link,auth_referral]]. #### `nologin` User isn't actually allowed to log in even if the password matches, with optionally a different reason given as the authentication failure message. Commonly used with [[link,authentication_proxies]] and [[link,auth_referral]], but may also be used standalone. One way to use this would be: * `nologin=` * `reason=System is being upgraded, please try again later`. Unfortunately many clients don't show the reason to the user at all and just assume that the password was given wrong, so it might not be a good idea to use this unless the system will be down for days and you don't have a better way to notify the users. ::: warning The `nologin` field is mainly intended for user logins (IMAP, POP3, ManageSieve). It is ignored with `doveadm`, because the intention is that admin could still be able to access a disabled user via `doveadm`. [[changed,lmtp_nologin_added]] The `nologin` field prevents LMTP access now as long as [[setting,lmtp_proxy,yes]]. However, the `reason` field is ignored. ::: ::: info If you want to entirely block the user from logging in (i.e. account is suspended), with no IMAP referral information provided, you must ensure that neither `proxy` nor `host` are defined as one of the `passdb` extra fields. The order of preference is: `proxy`, `host`, then `nologin`. ::: #### `nodelay` Don't delay reply to client in case of an authentication failure. However, this doesn't affect internal failure delays ([[setting,auth_internal_failure_delay]]). If the authentication fails, Dovecot typically waits 0-2 seconds ([[setting,auth_failure_delay]]) before sending back the "authentication failed" reply. If this field is set, no such delay is done. Additionally, [[link,auth_penalty]] won't be increased. Commonly used with [[link,authentication_proxies]] and [[link,auth_referral]], but may also be used standalone. ::: info If [[link,auth_pam]] is used as the `passdb`, it adds an extra delay which can't be removed by this setting. ::: #### `nopassword` If you want to allow all passwords, use an empty password and this field. #### `fail` If set, explicitly fails the `passdb` lookup. #### `k5principals` If using [[setting,auth_mechanisms,gssapi]], may contain Kerberos v5 principals allowed to map to the current user, bypassing the internal call to `krb5_kuserok()`. The database must support credentials lookup. #### `delay_until=[+]` Delay login until this time. The timestamp must be less than 5 minutes into future or the login will fail with internal error. The extra random seconds can be used to avoid a load spike of everybody getting logged in at exactly the same time. #### `noauthenticate` Do not perform any authentication, just store extra fields if user is found. ##### `check_client_fp` Match client certificate or public key fingerprint. This is intended to replace CA certificates with verifying client certificates using fingerprints, or to enforce that particular public key or certificate is being used. To enable this feature, you need to configure: * [[setting,auth_ssl_require_client_cert,yes]] * [[setting,ssl_peer_certificate_fingerprint_hash,sha256]], or some other valid hash * [[setting,ssl_server_request_client_cert,any-cert]] if you don't want to validate cert against certificate authority ::warning If CA certificates are not used, a passdb must provide a valid check_client_fp (or variant) to validate the client certificate. If none is provided, the authentication will fail. When feature is enabled, and certificate has not been validated by certificate authority (or is self-signed), at least one passdb must successfully match the fingerprint, otherwise the whole authentication will fail with "Client didn't present valid SSL certificate". If your certificate is authenticated by certificate authority, using any of the fingerprint matching keywords will fail that passdb if the fingerprint does not match, but next password database can still authenticate the user. Note though that none of the passdbs are required to successfully match the fingerprint in this case. ##### `check_client_cert_fp` Match client certificate fingerprint. See [[setting,ssl_peer_certificate_fingerprint_hash]]. Certificate fingerprint is calculated by taking hash value of DER encoded X509 client certificate. See [[link,passdb_check_client_fp]] ##### `check_client_pubkey_fp ` Match client public key fingerprint (but not certificate). See [[setting,ssl_peer_certificate_fingerprint_hash]]. Public key fingerprint is calculated by taking hash value of DER encoded certificate public key. See [[link,passdb_check_client_fp]] #### `forward_` In a proxy, pass the variable to the next hop (backend) as `forward_`. See [[link,auth_forward_fields]]. #### `event_` Import `name=value` to login events. ### Examples #### SQL ```doveconf[dovecot.conf] passdb sql { query = SELECT userid AS user, password, 'Y' as proxy, host \ FROM users WHERE userid = '%{user}' } } ``` #### LDAP ::: code-group ```doveconf[dovecot.conf] passdb ldap { ... fields { user = %{ldap:user} password = %{ldap:userPassword} proxy = %{ldap:proxyEnabled} host = %{ldap:hostName} } } ``` ::: ::: warning About the `proxy`, `proxy_maybe` and any other boolean type fields: these represent an existence test. Currently this translates to `will proxy (or proxy_maybe) if this attribute exists`. This allows the proxy behaviour to be selectable per user. To have it `always` on, use a template, e.g.: ::: code-group ```doveconf[dovecot.conf] fields { user = %{ldap:user} password = %{ldap:userPassword} host = %{ldap:hostName} proxy = y } ``` ::: ### passwd-file ``` user:{plain}pass::::::proxy=y host=127.0.0.1 ``` # Authentication Policy Dovecot supports interfacing with an external authentication policy server. This server can be used to decide whether the connecting user is permitted, tarpitted or outright rejected. While dovecot can do tarpitting and refusal on its own, this feature adds support for making cluster-wide decisions to make it easier to deter and defeat brute force attacks. ## Configuration The auth-policy server is a core feature and does not require plugin(s) to work. To activate this feature, you need to configure it. Auth policy overrides some of the default HTTP client settings: * [[setting,http_client_request_absolute_timeout,2s]] * [[setting,http_client_max_idle_time,10s]] * [[setting,http_client_max_parallel_connections,100]] * [[setting,http_client_user_agent,dovecot/auth-policy-client]] You can override these and any other HTTP client or SSL settings by placing them inside [[setting,auth_policy]] [[link,settings_syntax_named_filters]]. ### Required Minimum Configuration ```doveconf[dovecot.conf] auth_policy_server_url = http://example.com:4001/ auth_policy_hash_nonce = localized_random_string # OPTIONAL settings #auth_policy_server_api_header = Authorization: Basic #auth_policy_hash_mech = sha256 #auth_policy_request_attributes { # login = %{requested_username} # pwhash = %{hashed_password} # remote = %{rip} # device_id = %{client_id} # protocol = %{protocol} #} #auth_policy_reject_on_fail = no #auth_policy_hash_truncate = 12 #auth_policy_check_before_auth = yes #auth_policy_check_after_auth = yes #auth_policy_report_after_auth = yes ``` ## Password Hash Algorithm To generate the hash, you concatenate nonce, login name, nil byte, and password and run it through the hash algorithm once. The hash is truncated when truncation is set to non-zero. The hash is truncated by first choosing bits from MSB to byte boundary (rounding up), then right-shifting the remaining bits. ``` hash = H(nonce||user||'\x00'||password) bytes = round8(bits*8) hash = HEX(hash[0:bytes] >> (bytes-bits*8)) ``` ## Request Attributes Auth policy server requests are JSON requests. The JSON format can be specified with [[setting,auth_policy_request_attributes]]. The syntax is key=value pairs, and key can contain one or more `/` to designate that a JSON object should be made. Examples: ::: code-group ```[Configuration] login=%{orig_username} pwhash=%{hashed_password} remote=%{real_rip} attrs/ja3=%{ssl_ja3_hash} attrs/extra=value ``` ```json[JSON Result] { "login": "john.doe", "pwhash": "1234", "remote": "127.0.0.1", "attrs": { "extra":"value", "ja3":"md5 hash" } } ``` ::: ::: code-group ```doveconf[dovecot.conf] login=%{orig_username} pwhash=%{hashed_password} remote=%{real_rip} attrs/cos=%{userdb:cos} ``` ```json[JSON Result] { "login": "john.doe", "pwhash": "1234", "remote": "127.0.0.1", "attrs": { "cos": "premium" } } ``` ::: ### IMAP ID You can include IMAP ID command result in auth policy requests, by using `%{client_id}`, which will expand to IMAP ID command arglist. You must set [[setting,imap_id_retain,yes]] for this to work. ## List of Fields All fields supported by [[variable,auth]] can be used. In addition, you can use following fields: ### `hashed_password` User's password hashed with [password hash algorithm](#password-hash-algorithm). ### `requested_username` Username for regular logins. For master user logins, this is the requested login username (not the master username). ### `fail_type` [[added,auth_policy_fail_type]] The reason request failed. Results: | Result | Description | | ------ | ----------- | | `internal` | Dovecot internal processing error. | | `credentials` | The user's credentials were wrong. | | `account` | Account is not known. | | `expired` | User's password is expired. | | `disabled` | Account was disabled. | | `policy` | Login was rejected by policy server. | ### `tls` TLS protection level. Always available. ### `policy_reject` [[deprecated,auth_policy_reject]] Obsolete field indicating whether the request was rejected by policy server. ### `success` Overall indicator whether the request succeeded or not. ## Expected Response ```json { "status": -1, "msg": "go away" } ``` `status` values are explained below. ## Mode of Operation ### Auth Policy check: Authentication 'Before' userdb/passdb First query is done **before** password and user databases are consulted. This means that any userdb/passdb attributes are left empty. The command used here is `allow` and will appear on the URL as `command=allow`. `status` result values: - `-1`: Reject - `0`: Accept - `(Any other positive value)`: Tarpit for this number of seconds. ### Auth Policy Check: Authentication 'After' Successful userdb/passdb Lookup Second lookup is done **after** authentication succeeds. The command used here is `allow` and will appear on the URL as `command=allow`. `status` result values: - `-1`: Authentication fail - `>= 0`: Authentication succeed ### Auth Policy Check: Reporting After Authentication Succeeds A report request is sent at end of authentication. The command used here is `report` and will appear on the URL as `command=report`. The `status` result value is ignored. The JSON request is sent with two additional attributes: #### `success` Boolean true/false depending on whether the overall authentication succeeded #### `policy_reject` Boolean true/false whether the failure was due to policy server ## Compatible Auth Policy Servers - [OX Abuse Shield](https://oxpedia.org/wiki/index.php?title=AppSuite:OX_Abuse_Shield) # Password Schemes Password scheme means the format in which the password is stored in [[link,passdb]]. The main reason for choosing a scheme other than `PLAIN` is to prevent someone with access to the password database from stealing users' passwords and using them to access other services. ::: warning [[deprecated,weak_password_schemes]] Some password schemes are disabled by default due to being considered weak. This includes MD based (except DIGEST-MD5 and CRAM-MD5), LANMAN, NTLM and a few others. Please read the documentation carefully. You can enable these with [[setting,auth_allow_weak_schemes,yes]]. ::: ## What Scheme to Use? You should choose the strongest crypt scheme that's supported by your system. A few articles about why choosing a good password scheme is important: * [How To Safely Store A Password](https://codahale.com/how-to-safely-store-a-password/) * [Speed Hashing](https://blog.codinghorror.com/speed-hashing/) It's not possible to easily switch from one password scheme to another. The only practical way to do this is to wait until user logs in and change the password during the login. ::: info Dovecot's schemes are implemented by the libc's `crypt()` function. Using them is especially useful when sharing the same passwords with other software, because most of them support using `crypt()` to verify the password. However, not all libcs (especially older ones) implement all of the schemes. See below for other password schemes that are implemented by Dovecot internally (instead of libc). ::: From strongest to weakest: ### ARGON2I/ARGON2ID [[added,argon_2i_schemes]] [Argon2](https://en.wikipedia.org/wiki/Argon2) is the winner of a password hashing competition held at July 2015. The password will start with `$argon2i$` or `$argon2id$.` You can use `-r` to tune computational complexity, minimum is 3. ARGON2ID is only available if your libsodium is recent enough. ARGON2 can require quite a hefty amount of virtual memory, so we recommend that you set service `auth { vsz_limit = 2G }` at least, or more. ### ARGON2 [[added,argon2_password_scheme_added]] This scheme is also accepted and processed according to the actual algorithm as described in the hash, e.g, `{ARGON2}$argon2id$...` is recognized and processed properly as ARGON2I/ARGON2ID (as long as libsodium is recent enough to support it). ### CRYPT This is an umbrella term for all password schemes libc's `crypt()` can verify. On a current Linux system (2025) these are the following roughly in the order from strongest to weakest: | Scheme | Prefix | Maximum passphrase length | |---------------|----------|----------------------------------| | yescrypt | `$y$` | unlimited | | gost-yescrypt | `$gy$` | unlimited | | sm3-yescrypt | `$sm3y$` | unlimited | | scrypt | `$7$` | unlimited | | bcrypt | `$2b$` | 72 characters | | sha512crypt | `$6$` | unlimited | | sha256crypt | `$5$` | unlimited | | sm3crypt | `$sm3$` | unlimited | | sha1crypt | `$sha1` | unlimited | | SunMD5 | `$md5` | unlimited | | md5crypt | `$1$` | unlimited | | bsdicrypt | `_` | (ignores 8th bit) | | descrypt | | 8 characters (ignores 8th bit) | | bigcrypt | | 128 characters (ignores 8th bit) | | NT | `$3$` | unlimited | ::: warning On older Linux distros `crypt()` might not include all of the schemes in the list above. You can verify which ones are supported on your system by reading `man 5 crypt` ::: ### BLF-CRYPT This is the Blowfish crypt (bcrypt) scheme. It is generally considered to be very secure. The encrypted password will start with `$2y$` (other generators can generate passwords that have other letters after $2, those should work too.) bcrypt is bundled with Dovecot, so it does not require an external library. You can tune the computational cost using -r parameter for doveadm. ### SHA512-CRYPT A strong scheme. The encrypted password will start with `$6$`. ### SHA256-CRYPT A strong scheme. The encrypted password will start with `$5$`. ### MD5-CRYPT A weak but common scheme often used in `/etc/shadow`. The encrypted password will start with `$1$`. ## Generating Encrypted Passwords You can generate passwords for a particular scheme easily with [[doveadm,pw]] utility. If you do not have Dovecot configured, you can use `doveadm -O pw` to avoid complaints about config file. The scheme defaults to `CRYPT` (with the `$2y$` bcrypt format), but you can use `-s` to override it: [[doveadm,pw,-s SHA512-CRYPT]]. To provide password, for scripting purposes, you can use either [[doveadm,pw,-p password]] or: ```sh printf 'password\npassword\n' | doveadm pw ``` ## Default password Schemes Password databases get the default password scheme using the [[setting,passdb_default_password_scheme]] setting. However, there are exceptions: | Database | Default | | -------- | ------- | | [[link,auth_passwd]] | `CRYPT` is used by default and can't be changed currently. | | [[link,auth_pam]]
[[link,auth_bsd]] | Dovecot never even sees the password with these databases, so Dovecot has nothing to do with what password scheme is used. | The password scheme can be overridden for each password by prefixing it with `{SCHEME}`, for example: `{PLAIN}pass`. ## Non-cleartext Authentication Mechanisms See [[link,authentication_mechanisms]] for an explanation of auth mechanisms. Most installations use only cleartext mechanisms, so you can skip this section unless you know you want to use them. The problem with non-cleartext auth mechanisms is that the password must be stored either in cleartext, or using a mechanism-specific scheme that's incompatible with all other non-cleartext mechanisms. In addition, the mechanism-specific schemes often offer very little protection. This isn't a limitation of Dovecot, it's a requirement for the algorithms to even work. For example if you're going to use CRAM-MD5 authentication, the password needs to be stored in either PLAIN or CRAM-MD5 scheme. If you want to allow both CRAM-MD5 and DIGEST-MD5, the password must be stored in cleartext. In future it's possible that Dovecot could support multiple passwords in different schemes for a single user. | Mechanism | Comment | | --------- | ------- | | CRAM-MD5 | Used with CRAM-MD5 mechanism. | | [[link,auth_digest_md5]] | Used with DIGEST-MD5 mechanism. The username is included in the hash, so it's not possible to use the hash for different usernames. | | SCRAM-SHA-1 | Used with SCRAM-SHA-1 and SCRAM-SHA-1-PLUS mechanisms.
[[added,auth_mechanism_scram_sha_added]] | | SCRAM-SHA-256 | Stronger replacement for SCRAM-SHA-1.
[[added,auth_mechanism_scram_sha_added]] | ## Other Supported Password Schemes Strong schemes and mechanism-specific schemes are listed above. For some schemes (e.g. PLAIN-MD5, SHA) Dovecot is able to detect if the password hash is base64 or hex encoded, so both can be used. ### PLAIN Password is in cleartext. ### CRYPT Password is encrypted. Dovecot uses libc's `crypt()` function, which means that it is able to recognize all password schemes available on your system (e.g. the ones used in `/etc/passwd`). See [CRYPT](#crypt) above for a list. #### BLF-CRYPT Bcrypt based hash. (`$2y$`) #### DES-CRYPT Traditional DES based hash. The DES-crypt scheme only uses the first 8 characters of the password, the rest is ignored. Other schemes may have other password length limitations (if they limit the password length at all). ::: warning [[changed,crypt_des_md5_schemes]] Disabled by default. ::: #### MD5-CRYPT MD5-based hash (`$1$`) ::: warning [[changed,crypt_des_md5_schemes]] Disabled by default. ::: #### SHA256-CRYPT SHA-256 based hash (`$5$`) #### SHA512-CRYPT SHA-512 based hash (`$6$`) ### OTP ::: warning [[removed,otp_password_scheme_removed]] The `OTP` password scheme has been removed together with the `OTP` [[link,authentication_mechanisms]]. ::: [[rfc,2289]] based One-Time Password system. ### MD5 Based Schemes ::: warning [[changed,crypt_des_md5_schemes]] Disabled by default. ::: #### PLAIN-MD4 MD4 sum of the password stored in hex. #### MD5 Alias for MD5-CRYPT. #### PLAIN-MD5 MD5 sum of the password stored in hex. #### LDAP-MD5 MD5 sum of the password stored in base64. #### SMD5 Salted MD5 sum of the password stored in base64. #### HMAC-MD5 Alias CRAM-MD5. ### SHA Based Schemes ::: info See below for libc's SHA\* support. ::: #### SHA Alias for SHA1. #### SHA1 SHA1 sum of the password stored in base64. #### SSHA Salted SHA1 sum of the password stored in base64. #### SHA256 SHA256 sum of the password stored in base64. #### SSHA256 Salted SHA256 sum of the password stored in base64. #### SHA512 SHA512 sum of the password stored in base64. #### SSHA512 Salted SHA512 sum of the password stored in base64. ### Other Schemes #### ARGON2I ARGON2i password scheme, needs libsodium. #### ARGON2ID ARGON2id password scheme, needs libsodium. #### PBKDF2 [[added,pbkdf2_hashing]] PKCS5 Password hashing algorithm. Note that there is no standard encoding for this format, so this scheme may not be interoperable with other software. Dovecot implements it as `$1$salt$rounds$hash`. #### ARGON2 ARGON2 password scheme, needs libsodium ## Encoding The base64 vs. hex encoding simply the default encoding that is used. You can override it for any scheme by adding a ".hex", ".b64" or ".base64" suffix. For example: * `{SSHA.b64}986H5cS9JcDYQeJd6wKaITMho4M9CrXM` contains the password encoded to base64 (just like {SSHA}) * `{SSHA.HEX}3f5ca6203f8cdaa44d9160575c1ee1d77abcf59ca5f852d1` contains the password encoded to hex This can be especially useful with cleartext passwords to encode characters that would otherwise be illegal. For example, in [[link,auth_passwd_file]] you couldn't use a ":" character in the password without encoding it to base64 or hex. For example: `{PLAIN}{\}:!"` is the same as `{PLAIN.b64}e1x9OiEiCg==`. You can also specify the encoding with doveadm pw. For example: [[doveadm,pw,-s plain.b64]]. ## Salting For the SHA512-CRYPT, SHA256-CRYPT, and MD5-CRYPT schemes, the salt is stored before the hash, e.g.: `$6$salt$hash`. For the BLF-CRYPT scheme, bcrypt stores the salt as part of the hash. For most of the other salted password schemes (SMD5, SSHA*) the salt is stored after the password hash and its length can vary. When hashing the password, append the salt after the cleartext password, e.g.: SSHA256(pass, salt) = SHA256(pass + salt) + salt. For example with SSHA256 you know that the hash itself is 32 bytes (256 bits/8 bits per byte). Everything after that 32 bytes is the salt. For example if you have a password: ``` {SSHA256}SoR/78T5q0UPFng8UCXWQxOUKhzrJZlwfNtllAupAeUT+kQv ``` After base64 decoding it you'll see that its length is 36 bytes, so the first 32 bytes are the hash and the following 4 bytes are the salt: * length: `echo SoR/78T5q0UPFng8UCXWQxOUKhzrJZlwfNtllAupAeUT+kQv|base64 -d|wc -c`-> 36 * hash: `echo SoR/78T5q0UPFng8UCXWQxOUKhzrJZlwfNtllAupAeUT+kQv|base64 -d|dd bs=1 count=32|hexdump -C`-> 4a 84 7f ef c4 f9 ab 45 0f 16 78 3c 50 25 d6 43 13 94 2a 1c eb 25 99 70 7c db 65 94 0b a9 01 e5 * salt: `echo SoR/78T5q0UPFng8UCXWQxOUKhzrJZlwfNtllAupAeUT+kQv|base64 -d|dd bs=1 skip=32|hexdump -C`-> 13 fa 44 2f ### Common Hash Sizes * MD5: 16 bytes * SHA: 20 bytes * SHA256: 32 bytes * SHA512: 64 bytes # User Databases (`userdb`) Dovecot uses [[link,passdb]] and `userdb` as part of the authentication process. [[link,passdb]] authenticated the user. `userdb` lookup then retrieves post-login information specific to the authenticated user. This may include: * Mailbox location information * Quota limit * Overriding settings for the user (almost any setting can be overridden) | Userdb Lookups | Dovecot Proxy | Dovecot Backend | | -------------- | ------------- | --------------- | | IMAP & POP3 logins | No | YES | | LMTP mail delivery | No | YES | | doveadm commands | No | YES | The `userdb` and [[link,passdb]] may be the same or they may be different depending on your needs. You can also have [[link,auth_multiple_dbs]]. ## Authentication Databases See [[link,auth_databases]]. ## Multiple Userdbs You can use multiple databases, so if the user isn't found from the first database, Dovecot checks the next one. You can control the behavior of what happens after a userdb lookup is successful or unsuccessful with settings: * [[setting,userdb_result_success]] * [[setting,userdb_result_failure]] * [[setting,userdb_result_internalfail]] When using userdbs inside a `protocol ... { ... }` filter, the protocol-specific userdbs are executed first, and only then followed by the globally defined userdbs. Currently it's not possible to configure userdbs inside other filters. ## Fields The user database lookup can return these fields: ### `uid` User's UID (UNIX user ID), overrides the global [[setting,mail_uid]] setting. ### `gid` User's GID (UNIX group ID), overrides the global [[setting,mail_gid]] setting. ### `home` User's home directory, overrides the global [[setting,mail_home]] setting. Although not required, it's highly recommended even for virtual users. ### Optional Extra Fields The extra fields are also passed to post-login scripts. See [[link,post_login_scripting]]. You can override settings in `dovecot.conf`, see [[link,userdb_extra_fields]]. #### `user` Changes the username (can also be done by the [[link,passdb]] lookup). ## Supported Databases | Database | Description | | -------- | ----------- | | [[link,auth_passwd,Passwd]] | System users (NSS, `/etc/passwd`, or similar). | | [[link,auth_passwd_file,Passwd-file]] | `/etc/passwd`-like file. | | [[link,auth_ldap,LDAP]] | Lightweight Directory Access Protocol. | | [[link,auth_sql,SQL]] | SQL database (PostgreSQL, MySQL, SQLite, Cassandra). | | [[link,auth_staticdb,Static]] | Userdb information generated from a given template. | | [[link,auth_prefetch,Prefetch]] | Prefetch database. This assumes that the [[link,passdb]] already returned also all the required user database information. | | [[link,auth_lua,Lua]] | Lua script for authentication. | ## Settings ## Result Values The following values control the behavior of a userdb lookup result: ### `return-ok` Return success, don't continue to the next `userdb`. ### `return-fail` Return "user doesn't exist", don't continue to the next `userdb`. ### `return` Return earlier `userdb`'s success or failure, don't continue to the next `userdb`. If this was the first `userdb`, return "user doesn't exist". ### `continue-ok` Set the current user existence state to "found", and continue to the next `userdb`. ### `continue-fail` Set the current user existence state to "not found", and continue to the next `userdb`. ### `continue` Continue to the next `userdb` without changing the user existence state. The initial state is "not found". ## Extra Fields A user database lookup typically returns `uid`, `gid`, and `home` fields, as per traditional `/etc/passwd` lookups. Other fields may also be stored in the `userdb`, and these are called 'extra fields'. These fields can be returned the exact same way as `uid`, `gid`, and `home` fields. It's also possible to override settings from `dovecot.conf`. For example the [[setting,mail_path]] and [[setting,quota_storage_size]] settings are commonly overridden to provide per-user mail path or quota limit. The extra fields are also passed to [[link,post_login_scripting]]. ::: info [[changed,extra_fields_empty]] Extra fields can now also be set to empty string, while previously they were changed to `yes`. Extra fields without value (without `=`) will default to `yes`. ::: ### Suffixes The following suffixes added to a field name are handled specially: #### `:default` Set this field only if it hasn't been set before. ::: info [[changed,extra_fields_default]] This was called `:protected` in earlier versions. ::: #### `:remove` Remove this field entirely. For example you can return `uid:remove` to remove the `uid` field from the userdb reply. This differs from `uid=` in that the field is removed entirely (and default is used) instead of just being set to an empty value. ### Fields #### `nice` Set the mail process's priority to be the given value. #### `chroot` Chroot to given directory. Overrides [[setting,mail_chroot]]. #### `system_groups_user` Specifies the username whose groups are read from `/etc/group` (or wherever NSS is configured to taken them from). The logged in user has access to those groups. This may be useful for shared mailboxes. #### `userdb_import` This allows returning multiple extra fields in one TAB-separated field. It's useful for `userdb`s which are a bit less flexible for returning a variable number of fields (e.g. SQL). #### `uidgid_file` Get `uid` and `gid` for user based on the given filename. #### `user` User can be overridden (normally set in [[link,passdb]]). #### `event_` Import `name=value` to mail user event. ### Overriding Settings For example if you have `quota_storage_size=100M` in `doveconf.conf` and the `userdb` lookup returns `quota_storage_size=200M`, the original quota setting gets overridden. In fact, if the lookup always returns a `quota_storage_size` field, there's no point in having [[setting,quota_storage_size]] in `dovecot.conf` at all, because it always gets overridden anyway. To understand how imap and pop3 processes see their settings, it may be helpful to know how Dovecot internally passes them: 1. First all actual settings are first read into memory. 2. Next all the extra fields returned by `userdb` lookup are used to override the settings. 3. Last, if [[link,post_login_scripting]] is used, it may modify the settings. If you want to override settings inside sections, you can separate the section name and key with `/`. For example: ```doveconf[dovecot.conf] namespace default { inbox = yes separator = . } ``` The separator setting can be overridden by returning [[setting_text,namespace_separator,namespace/default/separator]] extra field. ### Examples #### SQL ::: code-group ```doveconf[dovecot.conf] userdb sql { query = SELECT home, uid, gid, CONCAT(quota_bytes, 'B') AS quota_storage_size, separator AS "namespace/default/separator" \ FROM users \ WHERE username = '%{user | username}' and domain = '%{user | domain}' } ``` ::: #### LDAP ::: code-group ```doveconf[dovecot.conf] userdb ldap { ... fields { home = %{ldap:homeDirectory} uid = %{ldap:uidNumber} gid = %{ldap:gidNumber} quota_storage_size = %{ldap:quotaBytes}B namespace/default/separator = %{ldap:mailSeparator} } } ``` ::: #### passwd-file Example that shows how to give two `userdb` extra fields (`mail_driver` and `quota`). Note that all `userdb` extra fields must be prefixed with `userdb_`, otherwise they're treated as [[link,passdb_extra_fields]]. ``` user:{plain}pass:1000:1000::/home/user::userdb_mail_driver=mbox userdb_mail_path=~/mail userdb_quota_storage_size=100M userdb_namespace/default/separator=/ user2:{plain}pass2:1001:1001::/home/user2::userdb_mail_driver=maildir userdb_mail_path=~/Maildir userdb_quota_storage_size=200M ``` ## See Also - [[link,auth_caching]] # System Users System users are typically defined in `/etc/passwd` file, but this isn't necessary. Using [NSS](http://en.wikipedia.org/wiki/Name_Service_Switch) you can configure the lookups to be done from elsewhere (e.g. LDAP). See [[link,auth_passwd]] userdb configuration for how to set this up. Especially if you're using nss_ldap you must set [[setting,userdb_use_worker,yes]]. System users usually have their own separate user IDs (UIDs). This is good from a security point of view, because it means that the kernel will also prevent users from accessing each others' mails. If the users have direct write access to the mail files (eg. the users have shell access), they can easily cause all sorts of mailbox corruptions. That may generate all kinds of error messages to Dovecot's error logs, so it may be sometimes difficult to tell if there really is a problem or if the user is doing something stupid. If users are going to access the mailboxes with other software than Dovecot, it's important to make sure that their mailbox accesses are compatible. This mostly means that with [[link,mbox]]you must make sure that everyone uses the same locking methods in the same order. ## Authentication Admins often wish to use different passwords for IMAP and POP3 than for other services (eg. SSH), because IMAP and POP3 clients often send the password unencrypted over the internet without even bothering to give users any warnings. Dovecot can easily support non-system passwords for system users. If you wish to use system passwords, you'll want to use one of these passdbs: - [[link,auth_pam]]: Most commonly used in Linux and BSDs nowadays. - [[link,auth_bsd]]: BSD authentication is used by OpenBSD. - [[link,auth_passwd]]: System users (NSS, `/etc/passwd`, or similar). This may work instead of PAM (mostly in some BSDs). If you wish to use non-system passwords, you can use pretty much any [[link,passdb]], but for simple installations you'll probably want to use [[link,auth_passwd_file]]. [[link,userdb]] for system users is always [[link,auth_passwd]]. ## Mail Location Usually UNIX systems are configured by default to deliver mails to `/var/mail/username` or `/var/spool/mail/username` mboxes. You may decide to use these, or use newer mailbox formats instead, such as [[link,maildir]] or [[link,dbox]]. Dovecot detects the mailbox format and location automatically if [[setting,mail_driver]] aren't set, but it's still a good idea to explicitly tell Dovecot where to find the mails. This ensures that Dovecot behaves correctly also when the user's mailbox doesn't exist at the moment (eg. a new user). If Dovecot can't figure out where the existing mails are, it will give an error message and quits. It never tries to create a missing mailbox when autodetection is used. See [[link,mail_location]] for more information how to configure the mailbox location. Below are the highlights for mbox and maildir. ### mbox The `/var/mail/username` mbox is called user's INBOX. IMAP protocol supports multiple mailboxes however, so Dovecot needs some directory where to store the other mailboxes. Typically they're stored in `~/mail/` or `~/Mail/` directory. All of these locations are included in mailbox location autodetection. You can specify them manually with: ```doveconf[dovecot.conf] mail_driver = mbox mail_path = ~/mail mail_inbox_path = /var/mail/%{user} ``` Remember that the [[setting,mail_path]] setting is the mailbox root directory, don't try to use the INBOX `/var/mail/%{user}` path in there because that isn't going to work (unless you really want to store mails under `/var/mail/%{user}/` directory). If you're also using other software than Dovecot to access mboxes, you should try to figure out what locking methods exactly they're using and update [[setting,mbox_read_locks]] and [[setting,mbox_write_locks]] settings accordingly. See locking section in [[link,mbox]] for more information. ### Maildir Maildir is typically stored in `~/Maildir` directory. You can specify this manually with: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir ``` See [[link,maildir]] for more information. ## Chrooting Dovecot, including several other software, allow using "/./" in home directory path to specify the chroot path. For example `/home/./user` would chroot to `/home`. If you want to enable this for Dovecot, add the chroot path to [[setting,valid_chroot_dirs]] setting (`/home` in the previous example). If this isn't done, Dovecot ignores the "/./". See [[link,chrooting]] for more details. # Virtual Users There are many ways to configure Dovecot to use virtual users. Users are often categorized as being either system users (in `/etc/passwd`) or virtual users (not in `/etc/passwd`). However from Dovecot's point of view there isn't much of a difference between them. If a [[link,auth_passwd]] lookup and a [[link,auth_sql]] lookup return the same [[link,userdb]] information, Dovecot's behavior is identical. ## Password and User Databases Dovecot supports many different [[link,passdb]] and [[link,userdb]] With virtual users the most commonly used ones are [[link,auth_ldap]], [[link,auth_sql]], and [[link,auth_passwd_file]]. The databases usually contain the following information: - Username - Password - UNIX User ID (UID) and primary UNIX Group ID (GID) - Home directory and/or mail location ## Usernames and Domains Dovecot doesn't care much about domains in usernames. IMAP and POP3 protocols currently have no concept of "domain", so the username is just something that shows up in your logs and maybe in some configuration, but they have no direct functionality. So although Dovecot makes it easier to handle "user@domain" style usernames (eg. `%{user | username}` and `%{user | domain}` [[variable]]), nothing breaks if you use, for example, `domain%user` style usernames instead. However some [[link,authentication_mechanisms]] do have an explicit support for realms (pretty much the same as domains). If those mechanisms are used, the username is changed to be `user@realm`. And of course there's no need to have domains at all in the usernames. ## Passwords The password can be in [[link,password_schemes,any format that Dovecot supports]] but you need to tell the format to Dovecot because it won't try to guess it. The SQL and LDAP configuration files have the `default_pass_scheme` setting for this. If you have passwords in multiple formats, or the passdb doesn't have such a setting, you'll need to prefix each password with `{}`, for example `{PLAIN}plaintext-password` or `{PLAIN-MD5}1a1dc91c907325c69271ddf0c944bc72`. ## UNIX UIDs The most important thing you need to understand is that **Dovecot doesn't access the users' mails as the dovecot user**! So **do not** put *dovecot* into the *mail* group, and don't make mails owned by the *dovecot* user. That will only make your Dovecot installation less secure. So, if not the *dovecot* user, what then? You can decide that yourself. You can create, for example, one *vmail* user which owns all the mails, or you can assign a separate UID for each user. See [[link,system_users]] for more information about different ways to allocate UIDs for users. ## UNIX GIDs Unless you're using [[link,shared_mailboxes]] and multiple UIDs, it doesn't really matter what GIDs you use. You can, for example, use a single GID for all users, or create a separate GID for each user. See [[link,system_users]] for more information. ## Home Directories Home directory is a per-user directory where **Dovecot can save user-specific files**. - Dovecot's home directories have nothing to do with system users' home directories. - It's irrelevant if it's under `/home/` or `/var/mail/` or wherever. - If you have trouble understanding this, mentally replace all occurrences of "home directory" with "mail user's private state directory". And in particular: - Never configure your userdb to return the same home directory for multiple users, this will break things. - Home directory must be an absolute path, don't even try to use relative paths, these do not work. Some uses for home directory are: - By default [[link,sieve]] scripts are in a user's home directory. - The Duplicate mail check database is in a user's home directory. Suppression of duplicate rejects/vacations won't work if home directory isn't specified. - Debugging: If an imap or pop3 process crashes, the core file is written to the user's home directory. ### Home vs. Mail Directory Home directory shouldn't be the same as mail directory with mbox or Maildir formats (but with dbox it's fine). It's possible to do that, but you might run into trouble with it sooner or later. Some problems with this are: - Non-mailbox files may show up as mailboxes. - If you see this with Maildir, [[setting,maildir_stat_dirs,yes]] hides them. - Or a user might not be able to create mailbox with some wanted name, because there already exists a conflicting file or directory. - e.g., with Maildir if you have `.dovecot.sieve` file, user can't create a mailbox called "dovecot.sieve" (i.e. "dovecot" mailbox that has a "sieve" child) - And vice versa: If user creates "dovecot.sieve" mailbox, Dovecot will probably start logging all kinds of errors because the mailbox directory isn't a valid [[link,sieve]] script. - If you ever intend to migrate to another mailbox format, it's much easier to do if you can have both old and new mail directories under the user's home directory. ### Ways to Setup Home Directory The directory layouts for home and mail directories could look like one of these (in the preferred order): 1. Mail directory under home, for example: - `home=/var/vmail/domain/user/` - `mail_path=/var/vmail/domain/user/mail/` 2. Completely distinct home and mail directories: - `home=/home/virtual/domain/user/` - `mail_path=/var/vmail/domain/user/` 3. Home directory under mail, for example: - Maildir: - `home=/var/vmail/domain/user/home/` - `mail_path=/var/vmail/domain/user/` - mbox: There's really no good and safe way to do it. 4. The home directory is the same as the mail directory. If for example `home=/var/vmail/domain/user/` and `mail_path=/var/vmail/domain/user/mail/`, set: ::: code-group ```doveconf[dovecot.conf] mail_home = /var/vmail/%{user | domain}/%{user | username} mail_driver = maildir mail_path = ~/mail ``` ::: ### LDAP with Relative Directory Paths If your LDAP database uses, e.g., `mailDirectory = domain/user/`, you can use it as a base for home directory: ::: code-group ```doveconf[dovecot.conf] userdb ldap { ... fields { home = %{ldap:mailDirectory} } } ``` ::: Then use [[setting,mail_path,~/Maildir]]. ### Mail Location If your users have varying locations for mail location, which cannot be represented by templating, userdb can return the [[link,userdb_extra_fields,mail field]] to override the default [[setting,mail_path]]. Normally this is not needed, and it is sufficient to have the setting in config file. ### Dynamic passwd-file Locations In the following example users are expected to log in as `user@domain`. Their mail is kept in their home directory at `/home///Maildir`. The usernames in the passwd and shadow files are expected to contain only the user part, no domain. This is because the path itself already contained %{user | domain} to specify the domain. If you want the files to contain full `user@domain` names, you can change [[setting,auth_username_format]] to `%{user}` or leave it out (its default value is `%{user|lower}`). ```doveconf[dovecot.conf] mail_driver = maildir mail_path = /home/%{user | domain}/%{user | username}/Maildir passdb passwd-file { passwd_file_path = /home/%{user | domain}/etc/shadow } userdb passwd-file { passwd_file_path = /home/%{user | domain}/etc/passwd } ``` #### Static userdb Many people store only usernames and passwords in their database and don't want to deal with UIDs or GIDs. In that case the easiest way to get Dovecot running is to use the [[link,auth_staticdb,static userdb]]. ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir passdb pam { } userdb static { fields { uid = vmail gid = vmail home = /var/mail/virtual/%{user | domain}/%{user | username} } } ``` This makes Dovecot look up the mails from `/var/mail/virtual///Maildir/` directory, which should be owned by vmail user and vmail group. ## Virtual and System Users If you need to do PAM/passwd lookup for system users, and also have domain users, you can configure authentication to drop the domain part after doing virtual user lookup. ``doveconf[dovecot.conf] ## Your virtual passdb passdb ldap { args = /path/to/ldap/config } passdb static { fields { user = %{domain|lower} noauthenticate = yes } skip = authenticated } passdb pam { skip = authenticated } userdb ldap { args = /path/to/ldap/config } userdb passwd { } ``` # Chrooting (change root) Traditionally chrooting has been done to run the whole server within a single chroot. This is also possible with Dovecot, but it requires manually setting up the chroot and it can be a bit tricky. Dovecot however supports internally running different parts of it in different chroots: - Login processes (imap-login, pop3-login) are chrooted by default into an empty non-writable directory. - Authentication process (dovecot-auth) can be chrooted by setting `chroot=` inside `service auth` and/or `service auth-worker` sections. This could be a good idea to change if you're not using a passdb or userdb that needs to access files outside of the chroot. Also make sure not to run the auth process as root then. - Mail processes (imap, pop3) can be made to chroot in different ways. See below. ## Security Problems If chrooting is used incorrectly, it allows local users to gain root privileges. This is possible by hardlinking setuid binaries inside the chroot jail and tricking them. There are at least two possibilities: 1. Hardlink `/bin/su` inside the chroot and create your own `/etc/passwd`. Then simply run `su root`. 2. Create your own `/lib/libc.so` and run any setuid binary. Of course both of these require that the setuid binary can be run inside the chroot. This isn't possible by default. Either user would have to find a security hole from Dovecot, or the administrator would have had to set up something special that allows running binaries. In any case it's a good idea not to allow users to hardlink setuid binaries inside the chroots. The safest way to do this is to mount the filesystem with "nosuid" option. ## Mail Process Chrooting Due to the potential security problem described above, Dovecot won't chroot mail processes to directories which aren't listed in [[setting,valid_chroot_dirs]] setting. For example if your users may be chrooting under `/var/mail//` and `/home//`, use: ```doveconf[dovecot.conf] valid_chroot_dirs = /var/mail /home ``` You can chroot all users globally into the same directory by using [[setting,mail_chroot]] setting. For example: ```doveconf[dovecot.conf] mail_chroot = /home ``` You can also make userdb return a chroot. There are two ways to do that: 1. Make userdb return `chroot=` field. 2. Insert "/./" inside the returned home directory, eg.: `home=/home/./user` to chroot into `/home`, or `home=/home/user/./` to chroot into `/home/user`. # Dovecot LDA The Dovecot LDA is a [[link,mda]], which takes mail from an [[link,mta]] and delivers it to a user's mailbox, while keeping Dovecot index files up to date. ::: tip These days most people should use [[link,lmtp]] as the MDA instead, as it's somewhat easier to configure (especially related to permissions) and gives better performance. ::: This page describes the common settings required to make LDA work. ## Main features of Dovecot LDA - [Mailbox indexing during mail delivery](#lda-indexing), providing faster mailbox access later - Quota enforcing by a plugin ([[plugin,quota]]) - Sieve language support [[link,sieve]] - Mail filtering - Mail forwarding - Vacation auto-reply ## Parameters See [[man,dovecot-lda]]. ## System Users You can use LDA with a few selected system users (i.e. user is found from `/etc/passwd` / NSS) by calling dovecot-lda in the user's `~/.forward` file: ``` | "/usr/local/libexec/dovecot/dovecot-lda" ``` This should work with any MTA which supports per-user `.forward` files. This method doesn't require the authentication socket explained below since it's executed as the user itself. ## Virtual Users ### With a Lookup Give the destination username to dovecot-lda with `-d` parameter, for example: ```sh dovecot-lda -f $FROM_ENVELOPE -d $DEST_USERNAME ``` You'll need to set up a auth-userdb socket for dovecot-lda so it knows where to find mailboxes for the users: ```doveconf[dovecot.conf] service auth { unix_listener auth-userdb { mode = 0600 user = vmail # User running dovecot-lda #group = vmail # Or alternatively mode 0660 + dovecot-lda user in this group } } ``` The auth-userdb socket can be used to do [[link,userdb]] lookups for given usernames or get a list of all users. Typically the result will contain the user's UID, GID and home directory, but depending on your configuration it may return other information as well. So the information is similar to what can be found from eg. `/etc/passwd` for system users. This means that it's probably not a problem to use mode=0666 for the socket, but you should try to restrict it more just to be safe. ### Without a Lookup If you have already looked up the user's home directory and you don't need a userdb lookup for any other reason either (such as overriding settings for specific users), you can run dovecot-lda similar to how it's run for system users: ```sh HOME=/path/to/user/homedir dovecot-lda -f $FROM_ENVELOPE ``` This way you don't need to have a userdb listener socket. Note that you should verify the user's existence prior to running dovecot-lda, otherwise you'll end up having mail delivered to nonexistent users as well. You must have set the proper UID (and GID) before running dovecot-lda. It's not possible to run dovecot-lda as root without `-d` parameter. ### Multiple UIDs If you're using more than one UID for users, you're going to have problems running dovecot-lda, as most MTAs won't let you run dovecot-lda as root. The only recommended solution is to use [[link,lmtp]]. It is not recommended to make `dovecot-lda` binary setuid-root, nor to run it via `sudo`, as these cannot be used safely. ## Problems with dovecot-lda - If you are using [[link,auth_prefetch]], keep in mind that `dovecot-lda` does not make a password query and thus will not work if `-d` parameter is used. The [[link,auth_prefetch]] page explains how to fix this. ## Logging - Normally Dovecot logs everything through its log process, which is running as root. dovecot-lda doesn't, which means that you might need some special configuration for it to log anything at all. - If dovecot-lda fails to write to log files it exits with temporary failure. - If you have trouble finding where Dovecot logs by default, see [[link,logging]]. - Note that Postfix's `mailbox_size_limit` setting applies to all files that are written to. So if you have a limit of 50 MB, dovecot-lda can't write to log files larger than 50 MB and you'll start getting temporary failures. If you want dovecot-lda to keep using Dovecot's the default log files: - If you're logging to syslog, make sure the syslog socket (usually `/dev/log`) has enough write permissions for dovecot-lda. For example set it world-read/writable: `chmod a+rw /dev/log`. - If you're logging to Dovecot's default log files again you'll need to give enough write permissions to the log files for dovecot-lda. You can also specify different log files for dovecot-lda. This way you don't have to give any extra write permissions to other log files or the syslog socket. You can do this by overriding the [[setting,log_path]] and [[setting,info_log_path]] settings: ```doveconf[dovecot.conf] protocol lda { ... # remember to give proper permissions for these files as well log_path = /var/log/dovecot-lda-errors.log info_log_path = /var/log/dovecot-lda.log } ``` For using syslog with dovecot-lda, set the paths empty: ```doveconf[dovecot.conf] protocol lda { ... log_path = info_log_path = # You can also override the default syslog_facility: #syslog_facility = mail } ``` ## Plugins - Most of the Dovecot plugins work with dovecot-lda. - Virtual quota can be enforced using [[plugin,quota]] - Sieve language support can be added with [[link,sieve]]. ### Non-Dovecot LDA Dovecot allows using non-Dovecot LDA to deliver mails to mbox and Maildir files. Dovecot adds the newly delivered mails to its index files, which is relatively fast operation. However, IMAP clients often want to first fetch some of the email headers and other metadata. This requires Dovecot to open and parse the emails, which may add user-visible latency. By using Dovecot LDA this is done as part of the mail delivery stage, so the user visible latency is smaller. # LMTP Server LMTP is a network-available service that handles local delivery of messages. It is defined by [[rfc,2033]]. The main difference from LDA is that the LDA is a short-running process, started as a binary from command line, while LMTP is a long-running process started by Dovecot's master process. ::: tip LMTP is the recommended method for mail delivery for most installations. ::: ## Envelope Addresses Compared to dovecot-lda parameters, the addresses are taken from: | LDA Flag | LMTP Command | Description | | -------- | ------------ | ----------- | | `-f` | `MAIL FROM:` | Envelope sender address | | `-r` | `RCPT TO:` | Final envelope recipient address | | `-a` | `RCPT TO:`, but may be overridden by [[setting,lda_original_recipient_header]] | Original envelope recipient address | | `-d` | `RCPT TO:`, but with the `+extension` part removed when [[setting,recipient_delimiter]] is enabled | Destination username. If usernames differ from recipient email addresses, the userdb must handle the translation. | ## Listeners You can configure LMTP to be listening on TCP or UNIX sockets: ::: tip By general convention, LMTP is expected to listen on port 24. ::: ```doveconf[dovecot.conf] # add lmtp to protocols, otherwise its listeners are ignored protocols { lmtp = yes } service lmtp { inet_listener lmtp { listen = 192.168.0.24 127.0.0.1 ::1 port = 24 } unix_listener lmtp { #mode = 0666 } } ``` The UNIX listener on `$base_dir/lmtp` is enabled by default when protocols setting contains lmtp. ## Security Unfortunately LMTP process currently needs to run as root, and only temporarily drop privileges to users. Otherwise it couldn't handle mail deliveries to more than a single user with different UID. If you're using only a single global UID/GID (i.e. virtual users), you can improve security by running lmtp processes as that user: ```doveconf[dovecot.conf] service lmtp { user = vmail } ``` ## LMTP Proxying It's possible to use Dovecot LMTP server as a proxy to remote LMTP or SMTP servers. The configuration is similar to [[link,authentication_proxies]], but you'll need to tell Dovecot LMTP to issue passdb lookups: [[setting,lmtp_proxy,yes]]. ## Performance For higher volume sites, it may be desirable to increase the number of active listener processes. A range of 5 - 20 is probably good for most sites: ```doveconf[dovecot.conf] service lmtp { process_min_avail = 5 } ``` ## Logging If you want to store LMTP delivery logs to a different file, you can do it with: ```doveconf[dovecot.conf] service lmtp { executable = lmtp -L } protocol lmtp { info_log_path = /var/log/dovecot-lmtp.log } ``` For rawlogs, please see [[link,rawlog]]. ## Plugins * Most of the Dovecot plugins work with LMTP. * Virtual quota can be enforced using [[plugin,quota]]. * [[setting,lmtp_rcpt_check_quota,yes]] enables quota checking already at RCPT TO stage. This check isn't done for proxied connections. * Sieve language support can be added with [[link,sieve]]. ## Address Extension Delivery To make address extension work with LMTP you must check that these variables are set: * [[setting,lmtp_save_to_detail_mailbox,yes]] * [[setting,recipient_delimiter,+]] ## Using LMTP with different MTAs * Browse the How To section: [[link,howto]] * [Halon](https://docs.halon.io/kb/delivery/lmtp) # MDA An MDA is a Mail Delivery Agent. An MDA is being passed messages from a [[link,mta]] and delivers it to a real or virtual mailbox. Dovecot MDAs: * [[link,lda]] * [[link,lmtp]] ## Other Choices - [maildrop](https://www.courier-mta.org/maildrop/) - [procmail](https://github.com/BuGlessRB/procmail) # MTA MTA is an acronym for Mail Transport Agent. It is the software that works behind the scenes to transport E-Mail messages from one computer to another. MUAs (such as Thunderbird, Outlook, Apple Mail, etc.) hand off newly sent messages to an MTA. MTAs talk to other MTAs, and either deliver mail locally or hand it off for delivery to a [[link,mda]]. MTA is a generic term and usually refers to one of these popular software packages: * [Postfix](https://www.postfix.org/) flexible mailer. * [Exim](https://www.exim.org/) * [Sendmail](https://www.proofpoint.com/us/products/email-protection/open-source-email-solution), the original BSD mailer. * [Courier](https://www.courier-mta.org/) * [qmail](https://cr.yp.to/qmail.html) is an obsolete and unmaintained server. If you really intend to continue using it, read [Dave Sill's Life with qmail](http://www.lifewithqmail.org/) which contains instructions to work around some of qmail's security issues. * [HALON](https://halon.io/) is a commercial MTA, which supports Dovecot Auth and LMTP. Some people also subsume mail fetching utilities under the MTA category, among them: * [fetchmail](https://www.fetchmail.info/), a fast mail retriever. * [getmail](https://pyropus.ca/software/getmail/),a mail retrieval utility written in Python. These mail fetching utilities can be used to store mail for later retrieval by Dovecot. # Dovecot Dictionary (dict) Dovecot's lib-dict can be used to access simple key-value databases. This is used by, for example, [[plugin,last-login]] and [[setting,imap_metadata]]. The dictionaries can be accessed either directly by the mail processes or they can be accessed via [proxy processes](#dictionary-proxy-process). Currently supported drivers are: | Name | Description | | ---- | ----------- | | [`file`](#flat-files) | Flat Files | | [`fs`](#filesystem-lib-fs-wrapper) | FS (lib-fs wrapper) | | [`ldap`](#ldap) | LDAP (read only) | | [`proxy`](#proxy) | Proxy | | [`redis`](#redis) | Redis | | [`sql`](#sql) | SQL | ## Connection Pooling The SQL drivers keep a persistent connection open to the database after it's been accessed once. The connection is reused for other SQL lookups as long as their SQL settings are exactly the same. Opened SQL connections are currently never closed. ## Drivers ### Flat Files The file will contain all the keys that are used. Not very efficient for large databases, but good for small ones such as a single user's quota. ### Filesystem (lib-fs-wrapper) This is a wrapper for lib-fs, which most importantly has the `posix` driver. Use the [[setting,fs]] setting to configure the filesystem. For example: ```doveconf[dovecot.conf] dict fs { fs posix { prefix = /var/lib/dovecot/dict/ } } ``` This create a separate file under `/var/lib/dovecot/dict` for each key. ### LDAP LDAP support is very similar to [`sql`](#sql) support, but there is no write support. Note that the LDAP driver must be used via [`proxy`](#proxy). See [[link,auth_ldap]]. #### Configuration ::: code-group ```doveconf[dovecot.conf] dict_server { dict ldap { driver = ldap ldap_uris = ldap://{{LDAPHOST}} ldap_auth_dn = uid=testadmin,cn=users,dc=dovecot,dc=net ldap_auth_dn_password = testadmin ldap_timeout_secs = 5 ldap_base = dc=dovecot,dc=net ldap_starttls = no ssl_client_require_valid_cert = no dict_map priv/test/home { ldap_filter = (&(homeDirectory=*)(uid=%{user})) value = %{ldap:homeDirectory} } } } ``` ::: #### LDAP Settings #### Examples To map a key to a search: ```doveconf[dovecot.conf] dict_map priv/test/mail { ldap_filter = (&(uid=%{user})(mail=*)) ldap_base = ou=container,dc=domain value = %{ldap:mail} } ``` To do a more complex search: ```doveconf[dovecot.conf] dict_map priv/test/mail/$location { ldap_filter = (&(uid=%{user})(mail=*)(uid=%{pattern:location})) ldap_base = ou=container,dc=domain value = %{ldap:mail} } ``` ### Proxy The proxy driver performs dictionary accessing via the [[link,dict_proxy]]. (The dict processes exist only if dict proxying is used.) This is especially useful with drivers where their initialization is relatively expensive, such as SQL. The dict processes will perform connection pooling. ### Redis The Redis driver is recommended to be used via [`proxy`](#proxy) to support [connection pooling](#connection-pooling). ::: warning Currently using Redis without proxying may cause crashes. ::: ### SQL ::: warning Note that the SQL driver must be used with [`proxy`](#proxy). ::: #### SQL Mapping The SQL database fields are mapped into dict keys using the [[setting,dict_map]] setting. When a dict lookup or update is done, Dovecot goes through all the maps and uses the first one whose pattern matches the dict key. For example when using dict for a per-user quota value the map looks like: ```doveconf[dovecot.conf] dict_map priv/quota/storage { sql_table = quota username_field = username value_field quota_bytes { } } ``` * The dict key must match exactly `priv/quota/storage`. The dict keys are hardcoded in the Dovecot code, so depending on what functionality you're configuring you need to know the available dict keys used it. * This is a private dict key (`priv/` prefix), which means that there must be a `username_field`. The `username_field` is assumed to be (at least part of) the primary key. In this example we don't have any other primary keys. * With MySQL the above map translates to SQL queries: * `SELECT quota_bytes FROM quota WHERE username = '$username_field'` * `INSERT INTO quota (username, quota_bytes) VALUES ('$username_field', '$value') ON DUPLICATE KEY UPDATE quota_bytes='$value'` You can also access multiple SQL fields. For example [[setting,acl_sharing_map]] can contain: ```doveconf[dovecot.conf] dict_map shared/shared-boxes/user/$to/$from { sql_table = user_shares value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } ``` * The [[setting,acl_sharing_map]] always uses `1` as the value, so here the `value` is called `dummy`. * The SQL `from_user` and `to_user` fields are the interesting ones. Typically the extra fields would be part of the primary key. * With MySQL the above map translates to SQL queries: * `SELECT dummy FROM user_shares WHERE from_user = '$from' AND to_user = '$to'` * `INSERT INTO user_shares (from_user, to_user, dummy) VALUES ('$from', '$to', '$value') ON DUPLICATE KEY UPDATE dummy='$value'` #### SQL dict with `mail_attribute` It's possible to implement [[setting,mail_attribute]] also with SQL dict. ::: warning Using shared attributes in [[setting,mail_attribute]] requires the mailbox GUID to be unique between users. This is not the case when mails were migrated via imapc, because it uses a hash of the mailbox name as the GUID. So every migrated user would have exactly the same INBOX GUID, preventing the use of dict-sql. It is currently not possible to add a username as an additional unique identifier. ::: ``` # CREATE TABLE mailbox_private_attributes ( # username VARCHAR(255), # mailbox_guid VARCHAR(32), # attr_key VARCHAR(255), # attr_value TEXT, # PRIMARY KEY (username, mailbox_guid, attr_key) # ) dict_map priv/$mailbox_guid/$key { sql_table = mailbox_private_attributes username_field = user value_field attr_value { } key_field attr_key { value = $key } key_field mailbox_guid { value = $mailbox_guid } } # CREATE TABLE mailbox_shared_attributes ( # mailbox_guid VARCHAR(32), # attr_key VARCHAR(255), # attr_value TEXT, # PRIMARY KEY (mailbox_guid, attr_key) # ); dict_map shared/$mailbox_guid/$key { sql_table = mailbox_shared_attributes value_field attr_value { } key_field attr_key { value = $key } key_field mailbox_guid { value = $mailbox_guid } } ``` ## Dictionary Proxy Process Dict server is used for providing dictionary access via server processes instead of doing it directly from whichever process wants to access the dictionary. This is useful for some drivers with relatively high connection cost (e.g. [`sql`](#sql)), but not necessarily for others (e.g., [`redis`](#redis)). When a mail process uses the dict proxy, it needs to have access the dict UNIX socket. By default only the `dovecot` user has access to the dict socket, which doesn't typically work in any installation. However, giving too wide permissions by default might allow untrusted users to access the dict and cause problems. If all users share a single UNIX UID (e.g. `vmail`), you could make the dict socket accessible only to it: ```doveconf[dovecot.conf] service dict { unix_listener dict { mode = 0600 user = vmail } } ``` If you use multiple UNIX UIDs, you can add an extra group for all Dovecot mail processes. This works even if you have untrusted system users who have shell access to the server: ```doveconf[dovecot.conf] mail_access_groups = dovecot service dict { unix_listener dict { mode = 0660 group = dovecot } } ``` However, it works with [[link,lda]] only if it's started as root. If this isn't possible, use [[link,lmtp]] instead. ### Settings # Event Export ::: tip See Also: * [[link,summary_events]], * [[link,event_filter]], * [[link,stats]], and * [[link,event_design]]. ::: ## Exporter Definition The [[setting,event_exporter]] named list filter defines how [[link,summary_events]] should be exported. The basic definition is split into two orthogonal parts: the format and the driver. The format and its settings specify *how* an event is serialized, while the driver and its settings specify *where* the serialized event is sent. In both cases, the behavior is tweaked via the corresponding arguments setting. For example, the following block defines an exporter that uses the `http-post` driver and `json` format: ```doveconf[dovecot.conf] event_exporter http-localhost { driver = http-post http_post_url = http://localhost:1234/ http_client_request_absolute_timeout = 500msec format = json time_format = rfc3339 } ``` ### Formats The format and its settings specify *how* an event is serialized. Supported Formats: | Formats | Description | | ------- | ----------- | | `json` | JSON output | | `tab-text` | TAB-separated text fields | #### Example: JSON ::: tip NOTE This example is pretty-printed. The actual exported event omits the whitespace between the various tokens. ::: ```json { "event" : "imap_command_finished", "hostname" : "dovecot-dev", "start_time" : "2019-06-19T10:38:25.422744Z", "end_time" : "2019-06-19T10:38:25.424812Z", "categories" : [ "imap" ], "fields" : { "net_in_bytes" : 7, "net_out_bytes" : 311, "last_run_time" : "2019-06-19T10:38:25.422709Z", "lock_wait_usecs" : 60, "name" : "SELECT", "running_usecs" : 1953, "session" : "xlBB1KqLz1isGwB+", "tag" : "a0005", "tagged_reply" : "OK [READ-WRITE] Select completed", "tagged_reply_state" : "OK", "user" : "jeffpc" } } ``` #### Example: tab-text ``` event:imap_command_finished hostname:dovecot-dev start_time:2019-06-19T10:38:25.422744Z end_time:2019-06-19T10:38:25.424812Z category:imap field:user=jeffpc field:session=xlBB1KqLz1isGwB+ field:tag=a0005 field:cmd_name=SELECT field:tagged_reply_state=OK field:tagged_reply=OK [READ-WRITE] Select completed field:last_run_time=2019-06-19T10:38:25.422709Z field:running_usecs=1953 field:lock_wait_usecs=60 field:net_in_bytes=7 field:net_out_bytes=311 ``` ## Drivers The driver and its settings specify *where* the serialized event is sent. Supported drivers: | Driver | Description | | ------ | ----------- | | `drop` | Ignore the serialized event | | `log` | Send serialized event to syslog | | `http-post` | Send the serialized event as a HTTP POST payload to [[setting,event_exporter_http_post_url]]. The driver defaults to [[setting,http_client_request_absolute_timeout,250 milliseconds]]. | | `file` | Send serialized events to a file specified in [[setting,event_exporter_file_path]]
[[added,event_export_drivers_file_unix_added]] | | `unix` | Send serialised events to a unix socket specified in [[setting,event_exporter_unix_path]]. The [[setting,event_exporter_unix_connect_timeout]] setting is used to specify how long the unix socket connection can take. Default is `250 milliseconds`.
[[added,event_export_drivers_file_unix_added]] | The `drop` driver is useful when one wants to disable the event exporter temporarily. Note that serialization still occurs, but the resulting payload is simply freed. The `log` driver is useful for debugging as typically one is already looking at the logs. ::: warning It is possible for the stats process to consume a large amount of memory buffering the POST requests if the timeout for `http-post` is set very high, a lot of events are being generated, and the HTTP server is slow. ::: To reopen the files created by `file` driver, see [[man,doveadm-stats,reopen]]. ## Event Definition The event definition reuses and extends the `metric` config block used for statistics gathering. The only additions to the block are the `exporter` and `exporter_include` settings. These are only meaningful if the event matches the predicate (categories, filter, etc.) specified in the metric block. ### Filtering Events One uses the `metric` block settings documented in [[link,stats]] to select and filter the event to be exported. See [[setting,metric_exporter]] and [[setting,metric_exporter_include]] settings. ## Settings ## Example Configs If one wishes to send the events associated with IMAP commands completion to a datalake having a HTTP API, one could use config such as: ```doveconf[dovecot.conf] event_exporter datalake { driver = http-post http_post_url = https://datalake.example.com/api/endpoint/somewhere http_client_request_absolute_timeout = 1sec format = json time_format = rfc3339 } metric imap_commands { exporter = datalake exporter_include = name hostname timestamps filter = event=imap_command_finished } ``` When debugging, it is sometimes useful to dump information to the log. For example, to output all named events from the IMAP service: ```doveconf[dovecot.conf] event_exporter log { driver = log format = json time_format = rfc3339 } metric imap_commands { exporter = log filter = event=* AND category=service:imap } ``` # Event Filtering Dovecot's event support includes the ability to narrow down which events are processed by filtering them based on the administrator-supplied predicate. Individual events can be identified either by their name or source code location. The source location of course can change between Dovecot versions, so it should be avoided. ::: tip See Also: * [[link,summary_events]], * [[link,event_export]], * [[link,stats]], and * [[link,event_design]]. ::: ## Matching Regardless of the syntax used, matching is performed the same way: * Event names are compared using a case-sensitive wildcard match. The wildcards supported are `?` and `*`. * If wildcard characters are needed as literal characters, they can be escaped with the `\` character, e.g. `\*`. * Event location is compared in two parts: the file name is compared case-sensitively, and the line number is compared as an integer. For a match to occur, the filename must match *and* the line number must either match or be unspecified. * Event categories are compared using a "has a" relationship. A category in the filter must be present in the event for a match to occur. Any other categories on the event do not influence the match. * Event fields are compared using a case-insensitive wildcard match. The wildcards supported are `?` and `*`. ## Common (Unified) Filter Language The unified event filtering language is a SQL-like boolean expression that supports the `AND`, `OR`, and `NOT` boolean operators, the `=`, `<`. `>`, `<=`, and `>=` comparison operators, and parentheses to clarify evaluation order. The key-value comparisons are of the form: ` ` Where the key is one of: * `event` * `category` * `source_location` * a field name The operator is one of: * `=` * `>` * `<` * `>=` * `<=` And the value is either: * a single word token, or * a quoted string The value may contain wildcards if the comparison operator is `=`. The value comparison is case-insensitive, but the key is case-sensitive. There are some limitations on which operators work with what field types: * string: Only the `=` operator is supported. * ip: Only the `=` operator is supported. * The IPs are matched in their parsed form, e.g. `2001::1` matches `2001:0:0:0:0:0:0:1`. * The IPs can be matched against network bitmasks, e.g. `127.0.0.0/8` matches `127.4.3.2`. * Wildcards match the IP as if it was a string, i.e. `2001::1*` will match the IPs `2001::1` and `2001::1234`. However, `2001:0:0:0:0:0:0:1*` will not match either of them. * Link-local addresses match only against the same interface, e.g. `"fe80::1%lo"` won't match against `"fe80::1%eth0"`. Note that the `%` character needs to be inside a quoted string or event filter parsing fails. * number: All operators are supported. * Wildcards match the number as if it was a string, i.e. `40*` will match numbers `40` and `401`. * timestamp: No operators are supported. * a list of strings: Only the `=` operator is supported. It returns true if the key is one of the values in the list. If the value is an empty string, it returns true if the list is empty. Event fields have specific types that constrain the possible values they can be filtered by. For example, `net_out_bytes` and `message_size` are numeric and can only be matched against numeric values. Previously type mismatches were silently ignored, beginning with this version each type mismatch and unsupported operation generate a respective warning. Sizes can be expressed using the unit values `B` - which represents single byte values - as well as `KB`, `MB`, `GB` and `TB` which are all powers of 1024. If no unit is specified `B` is used by default. All size units are case-insensitive. Times can be specified with the units `milliseconds` (abbrev. `msecs`), `seconds` (abbrev. `secs`), `minutes` (abbrev. `mins`), `days`, and `weeks`. ### Examples For example, to match events with the event name `abc`, one would use one of the following expressions. Note that white space is not significant between tokens, and therefore the following are all equivalent: ```doveconf[dovecot.conf] event=abc event="abc" event = abc event = "abc" ``` A more complicated example: ```doveconf[dovecot.conf] event=abc OR (event=def AND (category=imap OR category=lmtp) AND \ NOT category=debug AND NOT (net_in_bytes<1024 OR net_out_bytes<1024)) ``` A complicated example using size matching: ```doveconf[dovecot.conf] (category=debug AND NOT (net_in_bytes<1KB OR net_out_bytes<1KB)) OR \ (event=abc AND (message_size>1gb and message_size<1tB)) OR \ (event=def AND (duration<1mins)) ``` ## Metric Filter Syntax Events can be filtered inside the `metric` blocks (see [[link,stats]]) based on the event name, source location, the categories present, and field values. The `filter` metric key is set to the desired common filter language expression. For example: ```doveconf[dovecot.conf] metric example_http_metric { filter = event=http_request_finished AND \ source_location=http-client.c:123 AND category=storage AND \ category=imap AND user=testuser* AND status_code=200 } ``` ## Global Filter Syntax Settings such as [[setting,log_debug]] use the common filtering language. For example: ```doveconf[dovecot.conf] log_debug = (event=http_request_finished AND category=imap) OR \ (event=imap_command_finished AND user=testuser) ``` # Execute Scripts Some features, e.g. [[link,welcome]] execute an external script. This is configured with the [[setting,execute]] settings. Currently only a single script execution at a time is supported. Supported script execution drivers are: | Name | Description | | --- | --- | | [[link,execute_unix,unix]] | Connect to UNIX socket. | | [[link,execute_tcp,tcp]] | Connect to TCP socket. | | [[link,execute_fork,fork]] | Fork and execute the script directly. | ## UNIX Sockets Execute the script via a script service listening on a UNIX socket. The service must execute the `script` binary to provide the proper communication API. Example: ```doveconf[dovecot.conf] execute test-script { #driver = unix # default args = hello %{user} } service test-script-service { executable = script /usr/local/bin/test-script.sh one unix_listener test-script { mode = 0666 } } ``` The `test-script.sh` is executed with parameters `one hello `. ## TCP sockets Execute the script via a script service listening on a TCP socket. The service must execute the `script` binary to provide the proper communication API. Example: ```doveconf[dovecot.conf] execute localhost:12345 { driver = tcp # default args = hello %{user} } service test-script-service { executable = script /usr/local/bin/test-script.sh one inet_listener script { port = 12345 } } ``` The `test-script.sh` is executed with parameters `one hello `. ## Fork and Execute Fork the process and execute the script directly. Example: ```doveconf[dovecot.conf] execute /usr/local/bin/test-script.sh { driver = fork args = hello %{user} } ``` The `test-script.sh` is executed with parameters `hello `. ## Execute Settings # Dovecot Filesystems Dovecot's `lib-fs` is a simplified API to access filesystems and databases that can be made to look similar to filesystems. It is similar to [[link,dict]] but generally where [[link,dict]] is generally used for small data `fs` is used for larger data. Currently supported FS drivers are: | Name | Description | | --- | --- | | [[link,fs_posix,posix]] | POSIX filesystem. | | [[link,fs_dict,dict]] | Dictionary (`lib-dict` wrapper). | ## Dovecot Filesystem Wrappers Wrapper drivers used on top of other drivers: | Name | Description | | --- | --- | | [[link,fs_metawrap,metawrap]] | File metadata. | | [[link,mail_crypt,crypt]] | File encryption. | | [[link,fs_compress,compress]] | File compression. | When using fs drivers, place the fs wrappers first in the configuration and the primary fs driver as the last one. ### Examples Enable [[link,fs_metawrap,metawrap]] to support storing metadata with [[link,fs_posix,posix]] by configuring the `fs metawrap {}` block before the `fs posix {}` block: Example: ```doveconf[dovecot.conf] fs metawrap { } fs posix { } ``` It is also possible to use multiple fs wrappers on top of each other like this: Example: ```doveconf[dovecot.conf] fs metawrap { } fs compress { } fs posix { } ``` ## FS Settings ## POSIX Filesystem Regular POSIX filesystem. It can also be used with [[link,nfs]]. It doesn't support file metadata, in case you have a need for that use [[link,fs_metawrap]]. ### Settings ## Dictionary Filesystem This is a wrapper for `lib-dict` for using [[link,dict]] drivers as `fs` drivers. ### Settings ## Metawrap Filesystem This is a wrapper for other `fs` drivers that don't support metadata. The metadata is implemented by placing them into the beginning of the file content. # Health Check Scripting If you need dovecot to offer health-check functionality, use the health-check service by extending it's configuration with a listener like this: ```doveconf[dovecot.conf] service health-check { # this is the default configuration using the simple PING->PONG # example health-check. executable = script -p health-check.sh inet_listener health-check { port = 5001 } } ``` ## Options ### `-e` Parameter Define a list of environment variables which can be set by a request before calling the health-check script. Example: `script -e foo bar health-check.sh` sets `FOO=BAR` environment variable. ### `-p` Parameter Enables passthrough mode which allows to directly call a script without any protocol and directly receive the output. Be extremely careful when modifying the `health-check.sh` script or implementing your own. ## Script-Protocol If the passthrough mode is not enabled, the request must implement the following protocol: ``` VERSION .. [alarm= ] [env_= ] [env_= ] ... "noreply" | "-" (or anything really) arg 1 arg 2 ... DATA ``` If "alarm" is specified, it MUST be before "noreply". If "noreply" isn't given, a "-" must be given. ### `arg` Arguments that can be passed to the script. ### `env_` Environment variables that have been marked as allowed by `-e`. ### `noreply` Disable the success/fail answer by script executable itself. ### `VERSION` The VERSION of script (AToW 4.0 eg "VERSION\\tscript\\t4\\t0\\n"). ### `DATA` Input to be passed to the script to be called. # Mail Cache Configuration Dovecot caches the mail headers and other fields to `dovecot.index.cache` files automatically based on what the IMAP client uses. This is a per-folder decision. This works generally well for newly created folders, but not so well during migration, because Dovecot doesn't yet known which fields need to be cached. So Dovecot needs to be told what to initially add to `dovecot.index.cache` while mails are being saved. This can be useful even after migration. For example a user might normally use their mobile app IMAP client, but once a few months they would login to the webmail. Dovecot would normally preserve the fields used by the mobile IMAP client, but drop the extra fields used only by webmail after a month. This might not be wanted. This behavior can be configured with: * [[setting,mail_cache_fields]]: List of fields that are initially cached for newly created users. Afterwards the caching decisions will live on based on the user's IMAP access patterns. Note that the INBOX's caching decisions are copied to newly created folders. * [[setting,mail_always_cache_fields]]: List of fields that are always cached for everyone. These fields won't get dropped automatically even if user never accesses them. * [[setting,mail_never_cache_fields]]: List of fields that should never be cached. This should probably never include anything other than imap.envelope, which isn't needed because it can be generated from the cached header fields. ## Settings For Clients The list of cached fields depends on which IMAP clients are expected to be used. These are commonly used: ### Common IMAP Clients IMAP ENVELOPE is used by many clients, which includes: `hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id` ### Open-Xchange App Suite * IMAP ENVELOPE * `flags date.received imap.bodystructure mime.parts hdr.importance hdr.x-priority hdr.references body.snippet hdr.x-open-xchange-share-url` ### POP3 Clients `pop3.uidl pop3.order` ### iOS 9.3.1 * Some (but not all) of the IMAP ENVELOPE headers: `hdr.date hdr.subject hdr.from hdr.to hdr.cc hdr.bcc hdr.message-id hdr.in-reply-to` * `hdr.content-type hdr.references` ### K-9 Mail `date subject from content-type to cc reply-to message-id references in-reply-to X-K9mail-Identity` ## Cache Fields | Field | Description | | ----- | ----------- | | `flags` | Tracks various boolean flags for the mail: Does the header/body have CRLF linefeeds? Does it have NUL characters? | | `date.sent` | The Date: header parsed to timestamp | | `date.received` | Mail delivery date (IMAP INTERNALDATE) | | `date.save` | Mail save/copy date (mdbox stores this always in dovecot.index) | `size.physical` | Physical message size (line feeds exactly as they are stored in the stored mail). Note that the size is of the mail as plaintext, i.e. after decryption/compression. This is typically used by [[link,quota_driver_fs]] or [[link,quota_driver_maildir]] quota. | | `imap.bodystructure` | IMAP BODYSTRUCTURE response, which describes what the message's MIME structure looks like. | | `imap.body` | IMAP BODY response. This is the short version of imap.bodystructure, not the message body itself. If imap.bodystructure is cached, this field isn't cached because it can be generated from the imap.bodystructure. | | `imap.envelope` | IMAP ENVELOPE response, which contains the From, To, Cc, Bcc, Sender, Reply-To, Date, Subject, Message-ID and In-Reply-To headers in parsed forms. This is typically in the [[setting,mail_never_cache_fields]] because the raw headers are more useful in the cache and the ENVELOPE can be generated from them. | | `pop3.uidl` | POP3 UIDL responses. This is useful especially if some of the UIDLs have been migrated from an old system or if [[setting,pop3_reuse_xuidl]] is used. Otherwise Dovecot generates the UIDL in a way that usually doesn't require cache. | | `pop3.order` | POP3 messages' order. This is used after migration from another system where the IMAP and POP3 messages' order differs. | | `guid` | Internal Dovecot GUID for messages. | | `mime.parts` | MIME parts' sizes. | | `binary.parts` | MIME parts' sizes after decoding Content-Transfer-Encoding to binary. Used by IMAP BINARY extension. | | `body.snippet` | A short snippet of the message body. | | `hdr.*` | Message headers listed individually, e.g. `hdr.date`, `hdr.from` | ## Cache Decision Algorithm Nowadays there are three types of IMAP clients: * Clients that download all the (new) messages' headers and other metadata into local cache. Afterwards they use only the local cache for accessing the metadata. They may download the message bodies later on though. These clients don't benefit from Dovecot's caching after they have downloaded the metadata. For example Outlook, Thunderbird, Mac OS X Mail. * Clients that work otherwise like the local clients described above, but don't download all mails locally (even their metadata). They may also use server-side search for mails. For example iOS Mail. * Clients that don't have a local cache at all, or only a short-lived cache. These clients would benefit from having all mails cached by Dovecot. For example webmails. IMAP clients don't advertise how they work, so Dovecot attempts to figure it out dynamically. The behavior is now: * For a newly created INBOX Dovecot gets the caching decisions from the [[setting,mail_cache_fields]] and [[setting,mail_always_cache_fields]] settings. * For a newly created non-INBOX folder the caching decisions are copied from the INBOX. * Whenever a new non-cached field is accessed, its caching decision is set to TEMP, which means only the last 1 week's mails have the field cached. * Whenever a field is accessed for a mail older than 1 week the caching decision changes from TEMP to YES, which means the field is cached for all mails. * Whenever a single IMAP session accesses the mails in non-ascending order (e.g. mail UIDs 100 -> 99 instead of 99 -> 100) the caching decision changes from TEMP to YES. Especially the SORT/THREAD commands trigger this. * Whenever cache file is recreated (purged) it can cause some fields' decisions to change: * Changes YES -> TEMP if the YES decision hasn't been reconfirmed for the last 30 days ([[setting,mail_cache_unaccessed_field_drop]]). * Changes TEMP -> NO and drops the field if it hasn't been accessed for the last 60 days (2 * [[setting,mail_cache_unaccessed_field_drop]]). # Mail Location ## Settings ## Variables You can use several variables in the mail location settings. See [[variable]] for a full list, but the most commonly used ones are: | Variable | Description | | -------- | ----------- | | `%{user}` | Full username. | | `%{user \| username}` | User part in `user@domain`; same as `%{user}` if there's no domain. | | `%{user \| domain}` | Domain part in `user@domain`; empty if there's no domain. | ### Directory Hashing Examples on how to do it: * `%{ user | sha1 % 256 | hex(2)}` would give maximum 256 different hashes in range of `00` to `ff`. See also [[link,upgrading_directory_hashing]] ## Index Files Index files are by default stored under the same directory as mails. You may want to change the index file location if you're using [[link,nfs]] or if you're setting up [[link,shared_mailboxes]]. You can change the index file location with the [[setting,mail_index_path]] setting. For example: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir mail_index_path = /var/indexes/%{user} ``` The index directories are created automatically, but note that it requires that Dovecot has actually access to create the directories. Either make sure that the index root directory (`/var/indexes` in the above example) is writable to the logged in user, or create the user's directory with proper permissions before the user logs in. Index files can be disabled completely with `mail_index_path=MEMORY`. This is not recommended for production use, as the index files will need to be generated on every access. ## Mailbox Root Autodetection By default the [[setting,mail_driver]] and [[setting,mail_path]] settings are empty, which means that Dovecot attempts to locate automatically where your mails are. This is done by looking, in order, at: * `~/mdbox/` * `~/sdbox/` * `~/Maildir/` * `~/mail/.imap/` * `~/mail/inbox` * `~/mail/mbox` * `~/Mail/.imap/` * `~/Mail/inbox` * `~/Mail/mbox` ::: tip `.imap` is a directory, and `inbox` and `mbox` are files. ::: For autodetection to work, one of the above locations has to be populated; when autodetection is active, Dovecot will not attempt to create a mail folder. It's usually a good idea to explicitly specify where the mails are, even if the autodetection happens to work, in particular to benefit from auto-creation of the folder for new users. ### Custom Autodetection If you need something besides the default autodetection, you can use [[link,post_login_scripting]]. ::: details Example Script ```sh #!/bin/sh if [ -d $HOME/.maildir ]; then export MAIL_DRIVER=maildir export MAIL_PATH=$HOME/.maildir else export MAIL_DRIVER=mbox export MAIL_PATH=$HOME/mail export MAIL_INBOX_PATH=/var/mail/$USER fi export USERDB_KEYS="$USERDB_KEYS mail_driver mail_path mail_inbox_path" exec "$@" ``` ::: ## Mail Storage Autocreation If [[setting,mail_path]] is set, the path is automatically created if any directories are missing. You'll see something like this if you enable [[setting,log_debug]]. Example for mbox: ``` Debug: Namespace : /home/user/Mail doesn't exist yet, using default permissions Debug: Namespace : Using permissions from /home/user/Mail: mode=0700 gid=default ``` and a `Mail/.imap` directory will be present once that process has concluded. This is the easiest way to ensure a freshly created user is correctly set up for access via Dovecot. ## Home-less Users Having a home directory for users is highly recommended. At a minimum, [[link,sieve]] requires a home directory to work. See [[link,home_directories_for_virtual_users]] for more reasons why it's a good idea, and how to give Dovecot a home directory even if you don't have a "real home directory". If you really don't want to set any home directory, you can use something like: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = /home/%{user}/Maildir ``` ## Per-User Mail Locations It's possible to override the default mail location for specific users by making the [[link,userdb]] return the settings as extra field. ::: tip Note that `%{home}` doesn't work in the userdb queries or templates. `~/` gets expanded later, so use it instead. If you have explicit settings inside [[link,namespaces,namespace { .. }]] they need to be overridden in userdb with `namespace//` prefix. For example `namespace/inbox/mail_path` instead of simply `mail_path`. ::: ### SQL ```doveconf[dovecot.conf] userdb sql { query = SELECT home, uid, gid, mail_path FROM users WHERE user = '%{user}' } ``` ### LDAP ::: code-group ```doveconf[dovecot.conf] userdb ldap { ... fields { home = %{ldap:homeDirectory} uid = %{ldap:uidNumber} gid = %{ldap:gidNumber} mail_path = %{ldap:mailLocation} } } ``` ::: ### Passwd-file ``` user:{PLAIN}password:1000:1000::/home/user::userdb_mail_driver=mbox userdb_mail_path=~/mail ``` ## Mixing Multiple Mailbox Formats It's possible to use different mailbox formats same user by configuring multiple namespaces. See [[link,namespaces]]. Each mailbox format has to live in a different namespace. Mixing mailbox formats within the same namespace is not supported. ## Custom Namespace Location If you need to override namespace's mail location settings, first give it a name (`inbox` in this example): ```doveconf[dovecot.conf] namespace inbox { [...] } ``` Then in the executable script use: ```sh #!/bin/sh # do the lookup here mail_driver=mbox mail_path=$HOME/mail export USERDB_KEYS="$USERDB_KEYS namespace/inbox/mail_driver namespace/inbox/mail_path" exec env "NAMESPACE/INBOX/MAIL_DRIVER=$mail_driver" "NAMESPACE/INBOX/MAIL_PATH=$mail_path" "$@" ``` ## Finding Your Mail Before configuring Dovecot, you'll need to know where your mails are located. You should already have an SMTP server installed and configured to deliver mails somewhere, so the easiest way to make Dovecot work is to just use the same location. Otherwise you could create a `~/Maildir` directory and configure your SMTP server to use the Maildir format. First send a test mail to yourself (as your own non-root user): ```sh echo "Hello me" | mail -s "Dovecot test" $USER ``` Now, find where the mail went. Here's a simple script which checks the most common locations: ```sh for mbox in /var/mail/$USER /var/spool/mail/$USER ~/mbox ~/mail/* ~/*; do grep -q "Dovecot test" "$mbox" && echo "mbox: $mbox" done grep -q "Dovecot test" ~/Maildir/new/* 2>/dev/null && echo "Maildir: ~/Maildir" ``` ### mbox In most installations your mail went to `/var/mail/username` file. This file is called **INBOX** in IMAP world. Since IMAP supports multiple mailboxes, you'll also have to have a directory for them as well. Usually `~/mail` is a good choice for this. For installation such as this, the mail location settings are specified with, where `%{user}` is replaced with the username that logs in: * [[setting,mail_driver,mbox]], * [[setting,mail_path,~/mail]], and * [[setting,mail_inbox_path,/var/mail/%{user}]]. Similarly if your INBOX is in `~/mbox`, use: * [[setting,mail_inbox_path,~/mbox]]. ### Maildir Maildir exists almost always in `~/Maildir` directory. The mail location is specified with: * [[setting,mail_driver,maildir]], and * [[setting,mail_path,~/Maildir]]. ### Troubleshooting If you can't find the mail, you should check your SMTP server logs and configuration to see where it went or what went wrong. # dbox Mailbox Format dbox is Dovecot's own high-performance mailbox format. The original version was introduced in v1.0 alpha4, but since then it has been completely redesigned in v1.1 series and improved even further in v2.0. One of the main reasons for dbox's high performance is that it uses Dovecot's index files as the only storage for message flags and keywords, so the indexes don't have to be "synchronized". Dovecot trusts that they're always up-to-date (unless it sees that something is clearly broken). ::: danger **You must not lose the dbox index files, as they can't be regenerated without data loss!** ::: dbox has a feature for transparently moving message data to an [alternate storage](#alternate-storage) area. dbox storage is extensible. Single instance attachment storage was already implemented as such extension. ## dbox Modes ### single-dbox (`sdbox`) One message per file, similar to [[link,maildir]]. For backwards compatibility, `dbox` is an alias to `sdbox` in [[setting,mail_driver]]. ### multi-dbox (`mdbox`) Multiple messages per file,but unlike [[link,mbox]] stores multiple files per mailbox. ## Layout By default, the dbox filesystem layout is as follows. Data which isn't the actual message content is stored in a layout common to both `sdbox` and `mdbox`. In these tables `` is shorthand for the mail location root directory on the filesystem. Index files can be stored in a different location by using the [[setting,mail_index_path]] setting. If specified, it will override the mail location root for index files and mdbox's "map index" file. | Location | Description | | -------- | ----------- | | `/mailboxes/INBOX/dbox-Mails/dovecot.index*` | Index files for INBOX | | `/mailboxes/foo/dbox-Mails/dovecot.index*` | Index files for mailbox "foo" | | `/mailboxes/foo/bar/dbox-Mails/dovecot.index*` | Index files for mailbox "foo/bar" | | `/dovecot.mailbox.log*` | Mailbox changelog | | `/subscriptions` | Subscribed mailboxes list | | `/dovecot-uidvalidity*` | IMAP UID validity | Note that with dbox the Index files contain significant data which is held nowhere else. Index files for both `sdbox` and `mdbox` contain message flags and keywords. For `mdbox`, the index file also contains the map_uids which link (via the "map index") to the actual message data. This data cannot be automatically recreated, so it is important that Index files are treated with the same care as message data files. Actual message content is stored differently depending on whether it is `sdbox` or `mdbox`. ### Message Storage: sdbox | Location | Description | | -------- | ----------- | | `/mailboxes/INBOX/dbox-Mails/u.*` | Numbered files (`u.1`, `u.2`, ...) each containing one message of INBOX | | `/mailboxes/foo/dbox-Mails/u.*` | Files each containing one message for mailbox "foo" | | `/mailboxes/foo/bar/dbox-Mails/u.*` | Files each containing one message for mailbox "foo/bar" | ### Message Storage: mdbox | Location | Description | | -------- | ----------- | | `/storage/dovecot.map.index*` | "Map index" containing a record for each message stored | | `/storage/m.*` | Numbered files (`u.1`, `u.2`, ...) each containing one or multiple messages | The directory layout (under `~/mdbox/`) is: | Location | Description | | -------- | ----------- | | `~/mdbox/storage/` | The mail data for all mailboxes | | `~/mdbox/mailboxes/` | Directories for mailboxes and their index files | The `storage` directory has files: | File | Description | | ---- | ----------- | | `dovecot.map.index*` | The "map index" | | `m.*` | Mail data. Each m.\* file contains one or more messages. [[setting,mdbox_rotate_size]] can be used to configure how large the files can grow. | The "map index" contains a record for each message: | Key | Description | | --- | ----------- | | `map_uid` | Unique growing 32 bit number for the message. | | `refcount` | 16 bit reference counter for this message. Each time the message is copied the refcount is increased. | | `file_id` | File number containing the message. For example if file_id=5, the message is in file `m.5`. | | `offset`| Offset to message within the file. | | `size` | Space used by the message in the file, including all metadata. | Mailbox indexes refer to messages only using map_uids. This allows messages to be moved to different files by updating only the map index. Copying is done simply by appending a new record to mailbox index containing the existing map_uid and increasing its refcount. If refcount grows over 32768, currently Dovecot gives an error message. It's unlikely anyone really wants to copy the same message that many times. Expunging a message only decreases the message's refcount. The space is later freed in "purge" step. This is typically done in a nightly cronjob when there's less disk I/O activity. The purging first finds all files that have refcount=0 mails. Then it goes through each file and copies the refcount>0 mails to other mdbox files (to the same files as where newly saved messages would also go), updates the map index and finally deletes the original file. So there is never any overwriting or file truncation. The purging can be invoked explicitly running [[doveadm,purge]]. There are several safety features built into dbox to avoid losing messages or their state if map index or mailbox index gets corrupted: * Each message has a 128 bit globally unique identifier (GUID). The GUID is saved to message metadata in `m.*` files and also to mailbox indexes. This allows Dovecot to find messages even if map index gets corrupted. * Whenever index file is rewritten, the old index is renamed to `dovecot.index.backup`. If the main index becomes corrupted, this backup index is used to restore flags and figure out what messages belong to the mailbox. * Initial mailbox where message was saved to is stored in the message metadata in `m.*` files. So if all indexes get lost, the messages are put to their initial mailboxes. This is better than placing everything into a single mailbox. ## Alternate Storage Unlike Maildir, with dbox the message file names don't change. This makes it possible to support storing files in multiple directories or mount points. dbox supports looking up files from "altpath" if they're not found from the primary path. This means that it's possible to move older mails that are rarely accessed to cheaper (slower) storage. When messages are moved from primary storage to alternate storage, only the actual message data (stored in files `u.*` under `sdbox` and `m.*` under `mdbox`) is moved to alternate storage; everything else remains in the primary storage. Message data can be moved from primary storage to alternate storage using [[doveadm,altmove]]. The granularity at which data is moved to alternate storage is individual messages. This is true even for `mdbox` when multiple messages are stored in a single `m.*` storage file. If individual messages from an `m.*` storage file need to be moved to alternate storage, the message data is written out to a different `m.*` storage file (either new or existing) in the alternate storage area and the "map index" updated accordingly. Alternate storage is completely transparent at the IMAP/POP level. Users accessing mail through IMAP or POP cannot normally tell if any given message is stored in primary storage or alternate storage. Conceivably users might be able to measure a performance difference; the point is that there is no IMAP/POP command which could be used to expose this information. It is entirely possible to have a mail folder which contains a mix of messages stored in primary storage and alternate storage. ### Configuration To enable this functionality, use the [[setting,mail_alt_path]] setting. For example: ```doveconf[dovecot.conf] mail_driver = mdbox mail_path = /var/vmail/%{user | domain}/%{user | username} mail_alt_path = /altstorage/vmail/%{user | domain}/%{user | username} ``` will make Dovecot look for message data first under `/var/vmail/%{user | domain}/%{user | username}` ("primary storage"), and if it is not found there it will look under `/altstorage/vmail/%{user | domain}/%{user | username}` ("alternate storage") instead. There's no problem having the same (identical) file in both storages. Keep the unmounted `/altstorage` directory permissions such that Dovecot mail processes can't create directories under it (e.g. `root:root 0755`). This way if the alt storage isn't mounted for some reason, Dovecot won't think that all the messages in alt storage were deleted and lose their flags. ## dbox and Mail Header Metadata Unlike when using [[link,mbox]], where mail headers (for example `Status`, `X-UID`, etc.) are used to determine and store metadata, the mail headers within dbox files are (usually) **not** used for this purpose by Dovecot; neither when mails are created/moved/etc. via IMAP nor when dboxes are placed (e.g. copied or moved in the filesystem) in a mail location (and then "imported" by Dovecot). Therefore, it is (usually) **not** necessary, to strip any such mail headers at the [[link,mta]], [[link,mda]], or [[link,lda]] (as it is recommended with [[link,mbox]]). There is one exception, though, namely when [[setting,pop3_reuse_xuidl,yes]]: in this case `X-UIDL` is used for the POP3 UIDLs. Therefore, in this case, is recommended to strip the `X-UIDL` mail headers *case-insensitively* at the mail delivery layer. ## Accessing Expunged Mails with mdbox `mdbox_deleted` storage can be used to access mdbox's all mails that are completely deleted (reference count = 0). The `mdbox_deleted` parameters should otherwise be exactly the same as `mdbox`'s. Then you can use e.g. [[doveadm,fetch]] or [[doveadm,import]] commands to access the mails. For example, if you have: * [[setting,mail_driver,mdbox]], * [[setting,mail_path,~/mdbox]], * [[setting,mail_index_path,/var/index/%{user}]], use: [[doveadm,import,-p mail_index_path=/var/index/%{user} mdbox_deleted:~/mdbox "" subject oops]]. This finds a deleted mail with subject "oops" and imports it into INBOX. ## Mail Delivery Some MTA configurations have the MTA directly dropping mail into Maildirs or mboxes. Since most MTAs don't understand the dbox format, this option is not available. Instead, the MTA should use [[link,lmtp]] or [[link,lda]]. ## dbox Configuration ### Settings ### Mail Location #### sdbox To use **single-dbox**, use the tag `sdbox` in [[setting,mail_driver]]: ```doveconf[dovecot.conf] # single-dbox mail_driver = sdbox mail_path = ~/dbox ``` For backwards compatibility, `dbox` is an alias to `sdbox` in the mail location. (This usage is deprecated.) #### mdbox To use **multi-dbox**, use the tag `mdbox` in [[setting,mail_driver]]: ```doveconf[dovecot.conf] # multi-dbox mail_driver = mdbox mail_path = ~/mdbox ``` #### Default mail settings * [[setting,mail_path,%{home}/sdbox]] for sdbox, [[setting,mail_path,%{home}/mdbox]] for mdbox, * [[setting,mailbox_list_layout,fs]], * [[setting,mailbox_directory_name,dbox-Mails]], and * [[setting,mailbox_root_directory_name,mailboxes]]. ### Migrating away from `mailbox_directory_name_legacy` [[deprecated,settings_mailbox_directory_name_legacy_deprecated]] [[setting,mailbox_directory_name_legacy]] setting is deprecated and its default value is changed from `true` to `false`. This change requires migrations, though: * Start with [[setting,mailbox_directory_name_legacy,yes]], * for each user run: `doveadm -o mail_home=/var/newmails/$user -o mailbox_directory_name_legacy=no sync -u $user`, * shutdown all mail access, * for each user run [[man,doveadm-sync]] again, * switch the [[setting_text,mail_path,mail directory]], * set [[setting,mailbox_directory_name_legacy,no]], * start dovecot. # Imapc Mailbox Format The imapc storage accesses a remote IMAP server as if it were a regular (local) Dovecot mailbox format. Dovecot can treat it as a dummy storage or optionally a more capable storage. ## Settings ## Configuration Example Do a regular IMAP LOGIN, using STARTTLS, to imap.example.com: ```doveconf[dovecot.conf] # In-memory index files: mail_driver = imapc mail_path = # OR, Store index files locally: #mail_path = ~/imapc imapc_host = imap.example.com imapc_password = secret imapc_port = 143 imapc_ssl = starttls imapc_user = user@example.com ``` ## Quota Using the `imapc` quota driver allows asking for the quota from remote IMAP server. By default it uses `GETQUOTAROOT INBOX` to retrieve the quota. There are two parameters that can be used to control how the quota is looked up: ### Example ```doveconf[dovecot.conf] quota "User Quota" { driver = imapc imapc_root_name = Remote Quota } ``` # Maildir Mailbox Format The Maildir format debuted with the qmail server in the mid-1990s. Each mailbox folder is a directory and each message a file. This improves efficiency because individual emails can be modified, deleted and added without affecting the mailbox or other emails, and makes it safer to use on networked file systems such as NFS. ::: warning The Maildir mailbox format is mainly viable for smaller installations. It will be maintained on a best-effort basis for [Dovecot Community Edition][dovecot-ce], without any prioritization of new features or optimizations. ::: ## Dovecot Extensions Since the [Maildir standard][maildir-standard] doesn't provide everything needed to fully support the IMAP protocol, Dovecot had to create some of its own non-standard extensions. The extensions still keep the Maildir standards compliant, so MUAs not supporting the extensions can still safely use it as a normal Maildir. ### IMAP UID mapping IMAP requires each message to have a permanent unique ID number. Dovecot uses the `dovecot-uidlist` file to keep UID <-> filename mapping. The file is basically in the same format as Courier IMAP's `courierimapuiddb` file, except for one difference (see below). The file begins with a header: ``` 3 V1275660208 N25022 G3085f01b7f11094c501100008c4a11c1 ``` * 3 is the file format version number used by Dovecot v1.1+ * 1275660208 is the IMAP UIDVALIDITY * 25022 is the UID that will be given to the next added message * 3085f01b7f11094c501100008c4a11c1 is the 128 bit mailbox global UID in hex * There may be other fields, and the order of these fields isn't important Version 1 file format is compatible with Courier. Version 2 was used by a few Dovecot non-release versions. After the header comes the list of UID <-> filename mappings: ``` 25006 :1276528487.M364837P9451.kurkku,S=1355,W=1394:2, 25017 W2481 :1276533073.M242911P3632.kurkku:2,F ``` * 25006, 25017 are message UIDs * 2481 is the second message's virtual size. First message contains it in the filename itself, so it's not duplicated. * There may be more fields before ':' character * Rest of the line after ':' is the last known filename. This filename doesn't necessarily exist currently, because the filename changes every time a message's flags change. Dovecot doesn't waste disk I/O by rewriting uidlist file every time flags change, but whenever it is rewritten the latest filenames are used. This allows Dovecot to try to guess what the message's current filename is and if successful, avoid having to scan the directory's contents. The `dovecot-uidlist` file doesn't need to be locked for reading. When writing, `dovecot-uidlist.lock` file needs to be created. New lines can be appended to the end of file, but existing data must never be directly modified; it can only be replaced with `rename()` system call. `dovecot-uidlist` is updated lazily to optimize for disk I/O. If a message is expunged, it may not be removed from `dovecot-uidlist` until sometimes later. This means that if you create a new file using the same file name as what already exists in `dovecot-uidlist`, Dovecot thinks you "unexpunged" message by restoring a message from backup. This causes a warning to be logged and the file to be renamed. Note that messages must not be modified once they've been delivered. IMAP (and Dovecot) requires that messages are immutable. If you wish to modify them in any way, create a new message instead and expunge the old one. ### IMAP Keywords All the non-standard message flags are called keywords in IMAP. Some clients use these automatically for marking spam (eg. `$Junk`, `$!NonJunk`, `$Spam`, `$!NonSpam` keywords). Thunderbird uses labels which map to keywords `$Label1`, `$Label2`, etc. Dovecot stores keywords in the Maildir filename's flags field using letters `a..z`. This means that only 26 keywords are possible to store in the Maildir. If more are used, they're still stored in Dovecot's index files. The mapping from single letters to keyword names is stored in `dovecot-keywords` file. The file is in format: ``` 0 $Junk 1 $NonJunk ``` 0 means letter `a` in the Maildir filename, 1 means `b`, and so on. The file doesn't need to be locked for reading, but when writing `dovecot-uidlist` file must be locked. The file must not be directly modified; it can only be replaced with `rename()` system call. For example, a file named ``` 1234567890.M20046P2137.mailserver,S=4542,W=4642:2,Sb ``` would be flagged as `$NonJunk` with the above keywords. ### Maildir Filename Extensions The standard filename definition is: `:2,`. Dovecot has extended the `` field to be `[,]`. This means that if Dovecot sees a comma in the `` field while updating flags in the filename, it doesn't touch anything after the comma. However other Maildir MUAs may mess them up, so it's still not such a good idea to do that. Basic `` are described in the Maildir standard. The `` isn't used by Dovecot for anything currently. Dovecot supports reading a few fields from the ``: * `,S=`: `` contains the file size. Getting the size from the filename avoids doing a system `stat()` call, which may improve the performance. This is especially useful with [[link,quota_driver_maildir]]. * `,W=`: `` contains the file's RFC822.SIZE, i.e., the file size with linefeeds being CR+LF characters. If the message was stored with CR+LF linefeeds, `` and `` are the same. Setting this may give a small speedup because now Dovecot doesn't need to calculate the size itself. A Maildir filename with those fields would look something like: ``` 1035478339.27041_118.foo.org,S=1000,W=1030:2,S ``` ### Usage of Timestamps Timestamps of message files: * `mtime` is used as IMAP INTERNALDATE [[rfc,3501,2.3.3]], and must never change (see [[rfc,3501,2.3.1.1]]). * `ctime` is used as Dovecot's internal "save/copy date", unless the correct value is found from `dovecot.index.cache`. This is used only by external commands, e.g. [[doveadm,expunge,savedbefore]]. * `atime` is not used. Timestamps of `cur` and `new` directories: * `mtime` is used to detect changes of the mailbox and may force regeneration of index files * `atime` and `ctime` not used. ### Filename Examples For a filename `1491941793.M41850P8566V0000000000000015I0000000004F3030E_0.mx1.example.com,S=10956:2,STln`: `1491941793` : UNIX timestamp of arrival. `S=10956` : Size of the e-mail. `STln` : * **S** = seen (marked as read) * **T** = trashed * **l** = IMAP tag #12 (0=a, 1=b, 2=c, etc.) as defined in that folder's `dovecot-keywords` file. * **n** = IMAP tag #14 (0=a, 1=b, 2=c, etc.) as defined in that folder's `dovecot-keywords` file. ## Issues with the Maildir Specification ### Locking Although Maildir was designed to be lockless, Dovecot locks the Maildir while doing modifications to it or while looking for new messages in it. This is required because otherwise Dovecot might temporarily see mails incorrectly deleted, which would cause trouble. Basically the problem is that if one process modifies the Maildir (eg. a `rename()` to change a message's flag), another process in the middle of listing files at the same time could skip a file. The skipping happens because `readdir()` system call doesn't guarantee that all the files are returned if the directory is modified between the calls to it. This problem exists with all the commonly used filesystems. Because Dovecot uses its own non-standard locking (`dovecot-uidlist.lock` dotlock file), other MUAs accessing the Maildir don't support it. This means that if another MUA is updating message flags or expunging messages, Dovecot might temporarily lose some message(s). After the next sync when it finds it again, an error message may be written to log and the message will receive a new UID. Delivering mails to `new/` directory doesn't have any problems, so there's no need for LDAs to support any type of locking. ### Mail Delivery [Qmail's how a message is delivered page][qmail-message-delivery] suggests to deliver the mail like this: 1. Create a unique filename (only `time.pid.host` here, later Maildir spec has been updated to allow more uniqueness identifiers) 2. Do `stat(tmp/)`. If the `stat()` found a file, wait 2 seconds and go back to step 1. 3. Create and write the message to `tmp/`. 4. `link()` it into `new/` directory. Although not mentioned here, the `link()` could again fail if the mail existed in `new/` dir. In that case you should probably go back to step 1. All this trouble is rather pointless. Only the first step is what really guarantees that the mails won't get overwritten, the rest just sounds nice. Even though they might catch a problem once in a while, they give no guaranteed protection and will just as easily pass duplicate filenames through and overwrite existing mails. Step 2 is pointless because there's a race condition between steps 2 and 3. PID/host combination by itself should already guarantee that it never finds such a file. If it does, something's broken and the `stat()` check won't help since another process might be doing the same thing at the same time, and you end up writing to the same file in `tmp/`, causing the mail to get corrupted. In step 4 the `link()` would fail if an identical file already existed in the Maildir, right? Wrong. The file may already have been moved to `cur/` directory, and since it may contain any number of flags by then you can't check with a simple `stat()` anymore if it exists or not. Step 2 was pointed out to be useful if clock had moved backwards. However, this doesn't give any actual safety guarantees because an identical base filename could already exist in `cur/`. Besides if the system was just rebooted, the file in `tmp/` could probably be even overwritten safely (assuming it wasn't already `link()`\ ed to `new/`). So really, all that's important in not getting mails overwritten in your Maildir is step 1: Always create filenames that are guaranteed to be unique. Forget about the 2 second waits and such that the Qmail's man page talks about. ## Maildir and Mail Header Metadata Unlike when using [[link,mbox]], where mail headers (for example `Status`, `X-UID`, etc.) are used to determine and store metadata, the mail headers within Maildir files are (usually) **not** used for this purpose by Dovecot; neither when mails are created/moved/etc. via IMAP nor when Maildirs are placed (e.g., copied or moved in the filesystem) in a mail location (and then "imported" by dovecot). Therefore, it is (usually) **not** necessary, to strip any such mail headers at the [[link,mta]], [[link,mda]], or [[link,lda]] (as is recommended with [[link,mbox]]). There is one exception, though, namely when [[setting,pop3_reuse_xuidl,yes]] is used: in this case `X-UIDL` is used for the POP3 UIDLs. Therefore, in this case, is recommended to strip the `X-UIDL` mail headers *case-insensitively* at the mail delivery layer. ## Procmail Problems Maildir format is somewhat compatible with MH format. This is sometimes a problem when people configure their procmail to deliver mails to `Maildir/new`. This makes procmail create the messages in MH format, which basically means that the file is called `msg.inode_number`. While this appears to work first, after expunging messages from the Maildir the inodes are freed and will be reused later. This means that another file with the same name may come to the Maildir, which makes Dovecot think that an expunged file reappeared into the mailbox and an error is logged. The proper way to configure procmail to deliver to a Maildir is to use `Maildir/` as the destination. ## Settings ## Configuration ### Mail Location Maildir exists almost always in `~/Maildir` directory. The mail location is specified with: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir ``` #### Directory Layout By default, Dovecot uses Maildir++ directory layout. This means that all mailboxes are stored in a single directory and prefixed with a dot. For example: * `Maildir/.folder/` * `Maildir/.folder.subfolder/` If you want Maildirs to use hierarchical directories, such as: * `Maildir/folder/` * `Maildir/folder/subfolder/` you'll need to enable fs layout: ```doveconf[dovecot.conf] mailbox_list_layout = fs ``` #### Default mail settings * [[setting,mail_path,%{home}/Maildir]], * [[setting,mailbox_list_layout,maildir++]], * [[setting,mail_inbox_path,.]] with `fs` and `maildir++` layouts. This is used to store INBOX into the `~/Maildir/` directory root instead of `~/Maildir/.INBOX`. ### Control Files Dovecot stores some Maildir metadata into two control files: * `dovecot-uidlist` file contains IMAP UID <-> Maildir filename mapping * `dovecot-keywords` file contains Maildir filename flag (a..z = 0..25) <-> keyword name mapping They shouldn't be treated the same way as index files. Index files can be deleted and rebuilt without any side effects, but if you delete control files you'll cause messages to get new UIDs and possibly lose keyword names. If the messages get new UIDs, the IMAP clients will invalidate their local cache and download the messages all over again. If you do this for all the users, you could cause huge disk I/O bursts to your server. Dovecot cannot currently handle not being able to write the control files, so it will cause problems with [[link,quota_driver_fs]]. To avoid problems with this, you should place control files into a partition where quota isn't checked. You can specify this with the [[setting,mail_control_path]] setting: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir mail_control_path = /var/no-quota/%{user} ``` ### Index Files By default, index files are stored in the actual Maildirs. See [[link,mail_location]] for an explanation of how to change the index path. Example: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir mail_index_path = /var/indexes/%{user} ``` ### Optimizations * [[setting,maildir_copy_with_hardlinks,yes]] * [[setting,maildir_stat_dirs,no]] * [[setting,maildir_very_dirty_syncs,yes]] ### Mailbox Directory Name When using [[setting,mailbox_list_layout,fs]], there is a potential for naming collisions between Maildir's `new/`, `cur/`, and `tmp/` subdirectories, and mail folders of the same names. For example, consider a mail folder `foo/bar`. Under [[setting,mailbox_list_layout,fs]], data for this mail folder will be stored under Maildir's usual three directories `~/Maildir/foo/bar/{new,cur,tmp}/`. If the user then tries to create a mail folder `foo/bar/new`, this would then imply that data should be stored in Maildir's three directories `~/Maildir/foo/bar/new/{new,cur,tmp}/`. But this would overlap Maildir's `new/` subdirectory of mail folder `foo/bar`. This may not be a problem in many installations, but if a risk of collisions with Maildir's three subdirectory names is perceived, then the [[setting,mailbox_directory_name]] setting can be used. For example, if we specify the mail location as: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir mailbox_list_layout = fs mailbox_directory_name = mAildir ``` then this will push Maildir's `new/`, `cur/`, and `tmp/` subdirectories down into a subdirectory `mAildir/`, so a mail folder `foo/bar` would be stored at `~/Maildir/foo/bar/mAildir/{new,cur,tmp}/`. A mail folder `foo/bar/new` would be stored at `~/Maildir/foo/bar/new/mAildir/{new,cur,tmp}/`, which would then have no overlap with the mail folder `foo/bar`. [[setting,mailbox_directory_name]] affects INBOX slightly differently. If unset, INBOX will be stored at `~/Maildir/{new,cur,tmp}`, but when [[setting,mailbox_directory_name]] is specified, we get an extra path component `INBOX/` immediately prior to the [[setting,mailbox_directory_name]] value. In the example above INBOX would be stored at `~/Maildir/INBOX/mAildir/{new,cur,tmp}/`. The value for [[setting,mailbox_directory_name]] should be chosen carefully so as to minimise the chances of clashing with mail folder names. In the example here, unusual upper/lower casing has been used. ### Multiple Namespaces pointing to INBOX When there are multiple namespaces that point to the same INBOX namespace, `dovecot.list.index` can potentially keep fighting over whether INBOX exists or not. For example: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir mailbox_list_layout = fs namespace inbox { inbox = yes prefix = INBOX/ separator = / subscriptions = no } namespace empty { prefix = separator = / alias_for = inbox subscriptions = yes } ``` The solution is to disable `dovecot.list.index` for the alias namespace. In the above example, this is done by adding: ```doveconf[dovecot.conf] namespace empty { mailbox_list_index_prefix = } ``` [dovecot-ce]: https://repo.dovecot.org/ [maildir-standard]: https://cr.yp.to/proto/maildir.html [qmail-message-delivery]: http://qmail.org/man/man5/maildir.html # Mbox Mailbox Format ::: danger Mbox format is deprecated and should not be used in production setups at all. Mbox is no longer being maintained for write fixes, for any new or advanced features, nor for optimization improvements. E.g. mbox is incapable of writing very large payloads approaching 4GB in size. It still exists solely to read old mail storages, and for backwards utility purposes (specifically for archival purposes, as mbox allows multiple messages to be natively stored in a single file). In a production system, a more modern mailbox format should be used, e.g., [[link,dbox]] (or [[link,maildir]]). ::: Usually UNIX systems are configured by default to deliver mails to `/var/mail/username` or `/var/spool/mail/username` mboxes. In the IMAP world, these files are called INBOX mailboxes. IMAP protocol supports multiple mailboxes , so there needs to be a place for them as well. Typically they're stored in `~/mail/` or `~/Mail/` directories. The mbox file contains all the messages of a single mailbox. Because of this, the mbox format is typically thought of as a slow format. However with Dovecot's indexing this isn't true. Only expunging messages from the beginning of a large mbox file is slow with Dovecot, most other operations should be fast. Also because all the mails are in a single file, searching is much faster (if FTS is not used) than with Maildir. Modifications to mbox may require moving data around within the file, so interruptions (eg. power failures) can cause the mbox to break more or less badly. Although Dovecot tries to minimize the damage by moving the data in a way that data should never get lost (only duplicated), mboxes still aren't recommended to be used for important data. ## History The history of mbox format, and a discussion of its historical use and generally agreed-upon conventions, can be found in [[rfc,4155]]. Additionally, see the [mbox Wikipedia page](https://en.wikipedia.org/wiki/Mbox). ## Locking Locking is a mess with mboxes. There are multiple different ways to lock a mbox, and software often uses incompatible locking. The only standard way to lock an mbox is using a method called "dotlock". This means that a file named `.lock` is created in the same directory as the mailbox being locked. This works pretty well when the mbox is locked for writing, but for reading it's very inefficient. That's why other locking methods have been used. It's important that all software that's reading or writing to mboxes use the same locking settings. If they use different methods, they might read/write to an mbox while another process is modifying it, and see corrupted mails. If they use the same methods but in a different order, they can both end up in a deadlock. ### Locking Methods There are at least four different ways to lock a mbox: #### dotlock `mailboxname.lock` file created by almost all software when writing to mboxes. This grants the writer an exclusive lock over the mbox, so it's usually not used while reading the mbox so that other processes can also read it at the same time. So while using a dotlock typically prevents actual mailbox corruption, it doesn't protect against read errors if mailbox is modified while a process is reading. Another problem with dotlocks is that if the mailboxes exist in `/var/mail/`, the user may not have write access to the directory, so the dotlock file can't be created. There are a couple of ways to work around this: * Give a mail group write access to the directory and then make sure that all software requiring access to the directory runs with the group's privileges. This may mean making the binary itself setgid-mail, or using a separate dotlock helper program which is setgid-mail. With Dovecot this can be done by setting [[setting,mail_privileged_group,mail]]. * Set sticky bit to the directory (`chmod +t /var/mail`). This makes it somewhat safe to use, because users can't delete each others mailboxes, but they can still create new files (the dotlock files). The downside to this is that users can create whatever files they wish in there, such as a mbox for newly created user who hadn't yet received mail. #### flock `flock()` system call is quite commonly used for both read and write locking. The read lock allows multiple processes to obtain a read lock for the mbox, so it works well for reading as well. The downside is that it doesn't work if mailboxes are stored in NFS. #### fcntl Very similar to flock, also commonly used by software. In some systems this `fcntl()` system call is compatible with `flock()`, but in other systems it's not, so you shouldn't rely on it. fcntl works with NFS if you're using lockd daemon in both NFS server and client. #### lockf POSIX `lockf()` locking. Because it allows creating only exclusive locks, it's somewhat useless so Dovecot doesn't support it. With Linux `lockf()` is internally compatible with `fcntl()` locks, but again you shouldn't rely on this. ### Deadlocks If multiple lock methods are used, which is usually the case since dotlocks aren't typically used for read locking, the order in which the locking is done is important. Consider if two programs were running at the same time, both use dotlock and fcntl locking but in different order: * Program A: fcntl locks the mbox * Program B at the same time: dotlocks the mbox * Program A continues: tries to dotlock the mbox, but since it's already dotlocked by B, it starts waiting * Program B continues: tries to fcntl lock the mbox, but since it's already fcntl locked by A, it starts waiting Now both of them are waiting for each others locks. Finally after a couple of minutes they time out and fail the operation. ### Lock Configuration For Dovecot you can configure locking using the [[setting,mbox_read_locks]] and [[setting,mbox_write_locks]] settings. The defaults are: ```doveconf[dovecot.conf] mbox_read_locks = fcntl mbox_write_locks = dotlock fcntl ``` Here's a list of how to find out the locking settings for other software: #### Debian Debian's policy specifies that all software should use "fcntl and then dotlock" locking. All software in Debian packages are supposed to be patched to use this order by default. #### Procmail ```sh procmail -v 2>&1|grep Locking ``` ``` Locking strategies: dotlocking, fcntl() ``` #### Postfix Postfix has two different ways to deliver to mboxes. One is the "mailbox" transport and another one is the "virtual" transport. ```doveconf[dovecot.conf] # postconf mailbox_delivery_lock mailbox_delivery_lock = fcntl, dotlock # postconf virtual_mailbox_lock virtual_mailbox_lock = fcntl ``` In the above case, if you used the mailbox transport, you'd have to change Dovecot's configuration to [[setting,mbox_write_locks,fcntl dotlock]] or vice versa for Postfix. If you used the virtual transport, it doesn't really matter if the dotlock is missing, since the fcntl is common with Dovecot and Postfix. #### Exim Locks are controlled by the appendfile transport's `use_lockfile`, `use_fcntl_lock` and `use_flock_lock` settings. The default is to use lockfile (dotlock) and then fcntl lock. #### Sendmail Sendmail's mail.local delivery always uses dotlock followed by flock. #### mutt ```sh mutt -v|grep -i lock ``` ## Directory Structure By default, when listing mailboxes, Dovecot simply assumes that all files it sees are mboxes and all directories mean that they contain sub-mailboxes. There are two special cases however which aren't listed: * `.subscriptions` file contains IMAP's mailbox subscriptions. * `.imap/` directory contains Dovecot's index files. Because it's not possible to have a file which is also a directory, it's not normally possible to create a mailbox and child mailboxes under it. However if you really want to be able to have mailboxes containing both messages and child mailboxes under mbox, then Dovecot can be configured to do this, subject to certain provisos; see [child folders](#child-folders). ## Dovecot's Metadata Dovecot uses c-Client (ie. UW-IMAP, Pine) compatible headers in mbox messages to store metadata. These headers are: | Header | Description | | ------ | ----------- | | `X-IMAPbase` | Contains UIDVALIDITY, last used UID, and list of used keywords | | `X-IMAP` | Same as X-IMAPbase but also specifies that the message is a "pseudo-message" | | `X-UID` | Message's allocated UID | | `Status` | **R** (\Seen) and **O** (non-\Recent) flags | | `X-Status` | **A** (\Answered), **F** (\Flagged), **T** (\Draft), and **D** (\Deleted) flags | | `X-Keywords` | Message's keywords | | `Content-Length` | Length of the message body in bytes | Whenever any of these headers exist, Dovecot treats them as its own private metadata. It does sanity checks for them, so the headers may also be modified or removed completely. None of these headers are sent to IMAP/POP3 clients when they read the mail. ::: warning **The [[link,mta]], [[link,mda]], or [[link,lda]] should strip all these headers case-insensitively before writing the mail to the mbox.** ::: Only the first message contains the X-IMAP or X-IMAPbase header. The difference is that when all the messages are deleted from mbox file, a pseudo message is written to the mbox which contains X-IMAP header. This is the "DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA" message which you hate seeing when using non-C-client and non-Dovecot software. This is however important to prevent abuse, otherwise the first mail which is received could contain faked X-IMAPbase header which could cause trouble. If message contains X-Keywords header, it contains a space-separated list of keywords for the mail. Since the same header can come from the mail's sender, only the keywords are listed in X-IMAP header are used. The UID for a new message is calculated from last used UID in X-IMAP header + 1. This is done always, so fake X-UID headers don't really matter. This is also why the pseudo-message is important. Otherwise the UIDs could easily grow over 231 which some clients start treating as negative numbers, which then cause all kinds of problems. Also when 232 is exceeded, Dovecot will also start having some problems. Content-Length is used as long as another valid mail starts after that many bytes. Because the byte count must be exact, it's quite unlikely that abusing it can cause messages to be skipped (or rather appended to the previous message's body). Status and X-Status headers are trusted completely, so it's pretty good idea to filter them in LDA if possible. ## Dovecot's Speed Optimizations Updating messages' flags and keywords can be a slow operation since you may have to insert a new header (Status, X-Status, X-Keywords) or at least insert data in the header's value. Some mbox MUAs do this simply by rewriting all of the mbox after the inserted data. If the mbox is large, this can be very slow. Dovecot optimizes this by always leaving some space characters after some of its internal headers. It can use this space to move only minimal amount of data necessary to get the necessary data inserted. Also if data is removed, it just grows these spaces areas. There are several configuration options that can be used that will affect optimization: * [[setting,mbox_dirty_syncs]] * [[setting,mbox_lazy_writes]] * [[setting,mbox_very_dirty_syncs]] ## From Escaping In mboxes a new mail always begins with a "From " line, commonly referred to as `From_`-line. To avoid confusion, lines beginning with "From " in message bodies are usually prefixed with '>' character while the message is being written to in mbox. Dovecot doesn't currently do this escaping however. Instead it prevents this confusion by adding Content-Length headers so it knows later where the next message begins. Dovecot also doesn't remove the '>' characters before sending the data to clients. ## Mbox Variants There are a few minor variants of this format: ### mboxo An original mbox format originated with Unix System V. Messages are stored in a single file, with each message beginning with a line containing "From SENDER DATE". If "From " (case-sensitive, with the space) occurs at the beginning of a line anywhere in the email, it is escaped with a greater-than sign (to ">From "). Lines already quoted as such, for example ">From " or ">>>From " are not quoted again, which leads to irrecoverable corruption of the message content. ### mboxrd Named for Raul Dhesi in June 1995, though several people came up with the same idea around the same time. An issue with the mboxo format was that if the text ">From " appeared in the body of an email (such as from a reply quote), it was not possible to distinguish this from the mailbox format's quoted ">From ". mboxrd fixes this by always quoting already quoted "From " lines (e.g. ">From ", ">>From ", ">>>From ", etc.) as well, so readers can just remove the first ">" character. This format is used by qmail and getmail (>=4.35.0). ### mboxcl Originated with Unix System V Release 4 mail tools. It adds a Content-Length field which indicates the number of bytes in the message. This is used to determine message boundaries. It still quotes "From " as the original mboxo format does (and not as mboxrd does it). ### mboxcl2 Like mboxcl but does away with the "From " quoting. Dovecot uses this format internally. ### MMDF (Multi-channel Memorandum Distribution Facility mailbox format) originated with the MMDF daemon. The format surrounds each message with lines containing four control-A's. This eliminates the need to escape From: lines. ## How a message is read stored in mbox extension * An email client reader scans throughout mbox file looking for `From_` lines. * Any `From_` line marks the beginning of a message. * Once the reader finds a message, it extracts a (possibly corrupted) envelope sender and delivery date out of the `From_` line. * It then reads until the next `From_` line or scans till the end of file, whenever `From_` comes first. * It removes the last blank line and deletes the quoting of `>From_` lines and `>>From_` lines and so on. ## Known Problems ### External modifications In general Dovecot doesn't mind if you modify the mbox file externally. It's fine if external software expunges messages or appends new ones. However moving around existing messages, inserting messages in the middle of the file or modifying existing messages isn't allowed. Especially modifying existing messages (eg. removing attachments) may cause all kinds of problems. If you do that, at the minimum go and delete `dovecot.index.cache` file from the mailbox, otherwise weird things may happen. However IMAP protocol guarantees that messages don't change at all, and deleting Dovecot's cache file doesn't clear clients' local caches, so it still may not work right. If you insert messages, or if you "undelete" messages (eg. replace mbox from a backup), you may see errors in Dovecot's logs: ``` mbox sync: UID inserted in the middle of mailbox /home/tss/mail/inbox (817 > 787, seq=18, idx_msgs=32) ``` This is normal. Dovecot just assigned new UIDs for the messages. See below for other reasons why UID insertions could happen. ### Debugging UID insertions The above error message can be read as: "18th message in the mbox file contained X-UID: 787 header, however the index file at that position told the message was supposed to have UID 817. There are 32 messages currently in the index file." There are four possibilities why the error message could happen: 1. Message with a X-UID: 787 header really was inserted in the mbox file. For example you replaced mbox from a backup. 2. Something changed the X-UID headers. Very unlikely. 3. The message was expunged from the index file, but for some reason it wasn't expunged from the mbox file. The index file is updated only after a successful mbox file modification, so this shouldn't really happen either. 4. If this problem happens constantly, it could mean that you're sharing the same index file for multiple different mboxes! - This could happen if you let Dovecot do mailbox autodetection and it sometimes uses `/var/mail/%{user}` (when it exists) and other times `~/mail/inbox`. Use explicit [[link,mail_location]] settings to make sure the same INBOX is used. - Another possibility is that you're sharing index files between multiple users. Each user must have their own home directory. It's possible that broken X-UID headers in mails and [[setting,mbox_lazy_writes,yes]] combination has some bugs. If you're able to reproduce such an error, please let us know how. ### UIDVALIDITY changes UIDVALIDITY is stored in X-IMAPbase: or X-IMAP: header of the first message in mbox file. This is done by both Dovecot and UW-IMAP (and Pine). It's also stored in `dovecot.index` file. It shouldn't normally change, because if it does it means that client has to download all the messages for the mailbox again. If the UIDVALIDITY in mbox file doesn't match the one in `dovecot.index` file, Dovecot logs an error: ``` UIDVALIDITY changed (1100532544 -> 1178155834) in mbox file /home/user/mail/mailbox ``` This can happen when the following happens: 1. Dovecot accesses the mailbox saving the current UIDVALIDITY to `dovecot.index` file. 2. The UIDVALIDITY gets lost from the mbox file - X-IMAP: or X-IMAPbase: header gets lost because something else than Dovecot or UW-IMAP deletes the first message - The whole file gets truncated - Something else than Dovecot deletes or renames the mbox 3. The mailbox is accessed (or created if necessary) by UW-IMAP or Pine. It notices that the mailbox is missing UIDVALIDITY, so it assigns a new UIDVALIDITY and writes the X-IMAPbase: or X-IMAP: header. - Also Dovecot that's configured to not use index files behaves the same. 4. Dovecot accesses again the mailbox. UIDVALIDITY in the mbox file's header doesn't match the one in `dovecot.index` file. It logs an error and updates the UIDVALIDITY in the index file to the new one. ### Crashes Dovecot's mbox code is a bit fragile because of the way it works. However instead of just corrupting the mbox file, it usually assert-crashes whenever it notices an inconsistency. You may see crashes such as: ``` Panic: mbox /home/user/mail/mailbox: seq=2 uid=45 uid_broken=0 originally needed 12 bytes, now needs 27 bytes ``` This is a bit difficult problem to fix. Usually this crash has been related to Dovecot rewriting some headers that were broken. If you see these crashes, it would really help if you were able to reproduce the crash. If you have such a mailbox which crashes every time when it's tried to be opened, please put the mbox through [mbox anonymizer](https://github.com/dovecot/tools/blob/main/mbox-anonymize.pl) and send it, the mailbox's `dovecot.index` and `dovecot.index.log` files to dovecot@dovecot.org. None of those files contain any actual message contents so it's safe to send them. ### Avoiding Crashes and Errors Since the problems usually have been related to broken headers, you should be able to avoid them by filtering out all the Dovecot's internal metadata headers. This is a good idea to do in any case. If you use [[link,lda]] it does this filtering automatically. Otherwise you could do this in your SMTP server. The headers that you should filter out are: - Content-Length - Status - X-IMAP - X-IMAPbase - X-Keywords - X-Status - X-UID - X-UIDL (if you're using [[setting,pop3_reuse_xuidl,yes]]) ## Configuration ### Settings ### Mail Location Configuration In many systems, the user's mails are by default stored in `/var/mail/username` file. This file is called INBOX in IMAP world. Since IMAP supports multiple mailboxes, you'll need to have a directory for them as well. Usually `~/mail` is a good choice for this. For an installation such as this, the mail location is specified with: ```doveconf[dovecot.conf] # %{user} is replaced with the username that logs in mail_driver = mbox mail_path = ~/mail mail_inbox_path = /var/mail/%{user} ``` It's in no way a requirement to have the INBOX in `/var/mail/` directory. In fact, this often just brings problems because Dovecot might not be able to write dotlock files to the directory (see below). You can avoid this completely by just keeping everything in `~/mail/`: ```doveconf[dovecot.conf] # INBOX exists in ~/mail/inbox mail_driver = mbox mail_path = ~/mail ``` #### Default mail settings * [[setting,mail_path,%{home}/mail]], * [[setting,mailbox_list_layout,fs]], * [[setting,mailbox_subscriptions_filename,.subscriptions]], and * [[setting,mail_inbox_path,inbox]] with fs layout (so INBOX is in `~/mail/inbox` rather than `~/mail/INBOX`). ### Index Files By default, index files are stored under an `.imap/` directory. See the [[link,mail_location]] for an explanation of how to change the index path. Example: ```doveconf[dovecot.conf] mail_driver = mbox mail_path = ~/mail mail_inbox_path = /var/mail/%{user} mail_index_path = /var/indexes/%{user} ``` ### Locking Make sure that all software accessing the mboxes are using the same locking methods in the same order. The order is important to prevent deadlocking. From Dovecot's side you can change these from [[setting,mbox_read_locks]] and [[setting,mbox_write_locks]] settings. #### /var/mail/ Dotlocks Often mbox write locks include dotlock, which means that Dovecot needs to create a new `.lock` file to the directory where the mbox file exists. If your INBOXes are in `/var/mail/` directory, you may have to give Dovecot write access to the directory. There are two ways the `/var/mail/` directory's permissions have traditionally been set up: * World-writable with sticky bit set, allowing anyone to create new files but not overwrite or delete existing files owned by someone else (i.e. same as `/tmp`). You can do this with `chmod a+rwxt /var/mail`. * Directory owned by a mail group and the directory set to group-writable (mode=0770, group=mail) You can give Dovecot access to mail group by setting: ```doveconf[dovecot.conf] mail_privileged_group = mail ``` NOTE: With [[link,lda]] the [[setting,mail_privileged_group]] setting unfortunately doesn't work, so you'll have to use the sticky bit, disable dotlocking completely, or use LMTP server instead. ### /var/mail/\* Permissions In some systems the `/var/mail/$USER` files have 0660 mode permissions. This causes Dovecot to try to preserve the file's group, and if it doesn't have permissions to do so, it'll fail with an error like: ``` imap(user): Error: chown(/home/user/mail/.imap/INBOX, -1, 12(mail)) failed: Operation not permitted (egid=1000(user), group based on /var/mail/user) ``` There is rarely any real need for the files to have 0660 mode, so the best solution for this problem is to just change the mode to 0600: ```sh chmod 0600 /var/mail/* ``` ### Only /var/mail/ mboxes With POP3 it's been traditional that users have their mails only in the `/var/mail/` directory. IMAP however supports having multiple mailboxes, so each user has to have a private directory where the mailboxes are stored. Dovecot also needs a directory for its index files unless you disable them completely. If you **really** want to use Dovecot as a plain POP3 server without index files, you can work around not having a per-user directory: * Set users' home directory in an empty non-writable directory, e.g. [[setting,mail_home,/var/empty]]. * Set [[setting,mail_path]] to an empty non-writable directory, e.g. [[setting,mail_path,/var/empty]]. * Set [[setting,mail_inbox_path]], e.g. [[setting,mail_inbox_path,/var/mail/%{user}]]. * Note that if you have IMAP users, they'll see `/var/empty` as the directory containing other mailboxes than INBOX. If the directory is writable, all the users will have their mailboxes shared. ### Directory Layout By default Dovecot uses [[setting,mailbox_list_layout,fs]] layout under mbox. This means that mail is stored in mbox files under hierarchical directories, for example: | File | Description | | --- | --- | | `~/mail/inbox` | mbox file containing mail for INBOX | | `~/mail/foo` | mbox file containing mail for mailbox "foo" | | `~/mail/bar/baz` | mbox file containing mail for mailbox "bar/baz" | One upshot of this is that it is not normally possible to have mailboxes which are subfolders of mailboxes containing messages. As an alternative, it is possible to configure Dovecot to store all mailboxes in a single directory with hierarchical levels separated by a dot. This can be configured by adding [[setting,mailbox_list_layout,maildir++]] to the mail location. There are, however, some further considerations when doing this; see [child folders](#child-folders) for some examples. ### Control Files Under mbox format, Dovecot maintains the subscribed mailboxes list in a file `.subscriptions` which by default is stored in the mail location root. So in the example configuration this would be at `~/mail/.subscriptions`. If you want to put this somewhere else, you can change the directory in which the `.subscriptions` file is kept by using the [[setting,mail_control_path]] setting. For example: ```doveconf[dovecot.conf] mail_driver = mbox mail_path = ~/mail mail_control_path = ~/mail-control ``` would store the subscribed mailboxes list at `~/mail-control/.subscriptions`. One practical application of the [[setting,mail_control_path]] setting is described at [child folders](#child-folders). ### Message Filename By default, Dovecot stores messages for INBOX in an mbox file called "inbox", and messages for all other mailboxes in an mbox file whose relative path is equivalent to the name of the mailbox. Under this scheme, it is not possible to have mailboxes which contain both messages and child mailboxes. However, the behaviour (for mailboxes other than INBOX) can be changed using the [[setting,mailbox_directory_name]] setting. If it is specified, Dovecot stores messages in a mbox file with a name of that value, in a directory with a name equivalent to the mailbox name. There are, however, some further considerations when doing this; see [child folders](#child-folders) for an example. ### Child Folders Under mbox, it is not normally possible to have a mail folder which contains both messages and sub-folders. This is because there would be a filesystem name collision between the name of the mbox file containing the messages and the name of the directory containing the sub-folders. For example: * Mail folder "foo" containing messages would be stored in a file at `~/mail/foo`. * Mail folder "foo/bar" containing messages would be stored in a file at `~/mail/foo/bar`, but this cannot happen because this relies on the existence of a directory `~/mail/foo/` which can't exist because there is already a file with that name. Under mbox, Dovecot normally stores mail folders in "filesystem" layout. In this layout, mail folders are stored in mbox files (potentially under subdirectories) with the same relative path as the mail folder path. For example: | File | Description | | ---- | ----------- | | `~/mail/foo` | mbox file containing mail for mail folder "foo"; cannot create any mail sub-folders of "foo" | | `~/mail/bar/baz` | mbox file containing mail for mail folder "bar/baz"; cannot create any mail sub-folders of "bar/baz" | | `~/mail/inbox` | mbox file containing mail for INBOX | If there is a requirement to be able to have a mail folder which contains both messages and sub-folders, then there are two ways to do it: 1. Maildir++ layout 2. Messages in named file These approaches are described in more detail below. #### Maildir++ Layout Dovecot can be configured to keep mbox mail in a Maildir++-like layout. This makes Dovecot keep mail in mbox files where all the mailbox folder naming levels are separated with dots (with a leading dot). For example: | File | Description | | ---- | ----------- | | `~/mail/.foo` | mbox file containing mail for mail folder "foo" | | `~/mail/.foo.bar`| mbox file containing mail for mail folder "foo/bar". We can now do this. | | `~/mail/.bar.baz`| mbox file containing mail for mail folder "bar/baz" | | `~/mail/inbox` | mbox file containing mail for INBOX | This can be enabled by adding the [[setting,mailbox_list_layout,maildir++]] setting to the mail location: ```doveconf[dovecot.conf] # Incomplete example. Do not use! mail_driver = mbox mail_path = ~/mail mailbox_list_layout = maildir++ ``` However, there is a problem. Under mbox, the [[setting,mailbox_list_layout,maildir++]] setting alone leaves Dovecot unable to place index files, which would likely result in performance issues. So when using [[setting,mailbox_list_layout,maildir++]] with mbox, it is advisable to also configure [[setting,mail_index_path]]. Now, mail files (other than INBOX) all have names beginning with a dot, so if we like we can store other things in the `~/mail` directory by using names which do not begin with a dot. So we could think to use [[setting,mail_index_path]] to store indexes at `~/mail/index/`. Example: ```doveconf[dovecot.conf] # Incomplete example. Do not use! mail_driver = mbox mail_path = ~/mail mail_index_path = ~/mail/index mailbox_list_layout = maildir++ ``` If we do this, then indexes will be kept at `~/mail/index/` and this will not clash with any names used for mail folders. There is one more thing we may want to consider though. By default Dovecot will maintain a list of subscribed folders in a file `.subscriptions` under the mail location root. In this case that means it would end up at `~/mail/.subscriptions`. This would then mean that it would be impossible to create a mail folder called "subscriptions". We can get around this by using the [[setting,mail_control_path]] setting to move the `.subscriptions` file somewhere else, for example into the directory `~/mail/control` (again, choosing a name which doesn't begin with a dot so we don't collide with the names of mbox files storing mail folders). That gives us: ```doveconf[dovecot.conf] # Trick mbox configuration which allows a mail folder which contains both # messages and sub-folders mail_driver = mbox mail_path = ~/mail mailbox_list_layout = maildir++ mail_index_path = ~/mail/index mail_control_path = ~/mail/control ``` This then allows mail folders which contains both messages and sub-folders without possibility of naming collisions between mail folders and other data. There is one further wrinkle. Specifying [[setting,mailbox_list_layout,maildir++]] for mbox changes the default hierarchy separator from a slash to a dot. This should not be a problem for IMAP clients as the hierarchy separator is exposed through IMAP. However anything which expects to just "know" that the hierarchy separator is a slash may get confused. This can be worked around by configuring [[link,namespaces]] to set the folder separator back to a slash. #### Messages in Named File In the default "filesystem" example from above, we can't create any sub-folders of "foo" because there is a file - `foo` - in the way. So we could think to get rid of that file and put a directory there instead. But if we do that then we need somewhere to put the messages for folder "foo". We could think to put them in a specially-named file in the directory: `foo/`. Then if we wanted to create a sub-folder of "foo" we would be fine because we could then do that. The rule would then be that messages go into the specially-named file in the directory corresponding to the mail folder name. We want to choose a special name which would be unlikely to collide with a folder name. We could think to use something like `mBoX-MeSsAgEs`. Now, it turns out that you can configure Dovecot to do this using the [[setting,mailbox_directory_name]] setting: ```doveconf[dovecot.conf] # Incomplete example. Do not use! mail_driver = mbox mail_path = ~/mail mailbox_directory_name = mBoX-MeSsAgEs ``` With that config, we would get a layout like this: | File | Description | | ---- | ----------- | | `~/mail/inbox` | mbox file containing mail for INBOX | | `~/mail/foo/mBoX-MeSsAgEs` | mbox file containing mail for mail folder "foo" | | `~/mail/foo/bar/mBoX-MeSsAgEs` | mbox file containing mail for mail folder "foo/bar" | However there is a problem. Under mbox, setting [[setting,mailbox_directory_name]] alone leaves Dovecot unable to place index files, which would likely result in performance issues, or worse, if the index directory gets created first, this will obstruct the creation of the mbox file. So when using [[setting,mailbox_directory_name]] with mbox, it is also necessary to configure [[setting,mail_index_path]]. The question then arises where to put index files. Any directory under the `~/mail` directory could be considered as a mail folder. We could think to use a name beginning with a dot, for example `~/mail/.index` but that would then mean that it would not be possible to create a mail folder called ".index"; unlikely, but it would be nice to have as few implementation-specific restrictions as possible. In addition, by default, Dovecot will create a file `.subscriptions` at the mail location root to hold a list of mailbox subscriptions. This would make it impossible to create a mail folder called ".subscriptions". But we can move the `.subscriptions` file to another directory by using the [[setting,mail_control_path]] setting. To get around these issues, we can add another directory layer which separates these purposes. For example: ```doveconf[dovecot.conf] # Trick mbox configuration which allows a mail folder which contains both # messages and sub-folders mail_driver = mbox mail_path = ~/mail/mailboxes mailbox_directory_name = = mBoX-MeSsAgEs mail_index_path = ~/mail/index mail_control_path = ~/mail/control ``` would result in the following layout: | File | Description | | ---- | ----------- | | `~/mail/mailboxes/foo/mBoX-MeSsAgEs` | mbox file containing messages for mail folder "foo" | | `~/mail/mailboxes/foo/bar/mBoX-MeSsAgEs` | mbox file containing messages for mail folder "foo/bar" | | `~/mail/mailboxes/inbox` | mbox file containing messages for INBOX | | `~/mail/control/.subscriptions` | File containing list of subscribed mailboxes | | `~/mail/index/INBOX/dovecot.index.*` | Index files for INBOX | | `~/mail/index/foo/dovecot.index.*` | Index files for mail folder "foo" | | `~/mail/index/foo/bar/dovecot.index.*` | Index files for mail folder "foo/bar" | | `~/mail/index/dovecot.mailbox.log` | Other index files | Restrictions on mail folder names are then minimised; we can't have mail folders with the names "mBoX-MeSsAgEs", "dovecot.index.*, or "dovecot.mailbox.log". Unlike the Maildir++ layout approach above, because we are still using "filesystem" layout, the hierarchy separator remains as a slash. # Mailbox Formats Mailbox formats control the way that mail data is stored. ## Available Formats Mailbox formats supported by Dovecot: ### mbox See [[link,mbox]]. Traditional UNIX mailbox format. Users' INBOX mailboxes are commonly stored in `/var/spool/mail` or `/var/mail` directory. Single file contains multiple messages. ### Maildir See [[link,maildir]]. One file contains one message. A reliable choice since files are never modified and all operations are atomic. The top-level Maildir directory contains the `Maildir/cur`, `Maildir/new`, and `Maildir/tmp` subdirectories. ### dbox See [[link,dbox]]. Dovecot's own high performance mailbox format. Messages are stored in one or more files, each containing one or more messages. There are two flavors of dbox: * `sdbox`: "single-dbox" - one message per file * `mdbox`: "multi-dbox" - multiple messages per file ### imapc See [[link,imapc]]. Use remote IMAP server as mail storage. ### pop3c See [[link,pop3c]]. Use remote POP3 server as mail storage. ## Configuration See [[link,mail_location]] for configuration information. ## Physical Storage The mailbox formats define how Dovecot stores mail data, but it does not address where that data will physically live - that is a decision for the administrator to make. There are two general categories of storage: local and shared. ### Local Storage #### Filesystems * See [[link,maildir]] for Maildir-specific filesystem optimizations * Dovecot doesn't rely on atime updates, so you can mount the filesystem with `noatime` #### Index Files Keeping index files on a different disk than the mail spool gives you better performance. The indexes have a lot of write activity so it is recommended to use RAID-10 instead of RAID-5 for them. #### Fsyncing By default, Dovecot calls `fsync()` and `fdatasync()` whenever it's useful to prevent potential data loss. The main reason for this is so that Dovecot won't lie that the message was saved to the disk, if in fact a power failure a second later would lose the message. With IMAP clients this is perhaps a less serious problem, because the lost message was most likely either a mail in Draft mailbox or a message in "Sent Messages" mailbox; in other words, a message that the user had already seen. However if [[link,lda]] or [[link,lmtp]] loses a message, the user never even knew that the message existed, unless the sender decides to resend it. Since power failures and kernel panics are quite rare, many people are tempted to disable fsyncing because it may increase the performance quite a lot. Dovecot allows this by setting [[setting,mail_fsync,never]]. However, this is dangerous, especially with IMAP, LDA, and LMTP. If you do want to set to `never`, you should only explicitly do this for services that you are comfortable with data loss. Example: ```doveconf[dovecot.conf] # Default mail_fsync = optimized protocol pop3 { # Enable fsyncing for POP3 mail_fsync = never } ``` ## Shared Storage The recommended storage solution for large installations that require high-availability and scalable performance is object storage. [[link,dovecot_pro]] provides the obox mailbox format to efficiently interact with object storage systems. Dovecot allows keeping mails and index files in clustered filesystems. Dovecot does not specifically support any specific clustered solution - it is the responsibility of the admin to perform functional and load testing to guarantee the storage solution provides adequate performance. Dovecot also supports keeping mails and index files on NFS. Everything described in this page applies to NFS as well, but see [[link,nfs]] for additional NFS-specific problems and optimizations. Dovecot CE only supports mailbox access on a single server: a user can only be accessed by a single Dovecot server at a time. ### Memory Mapping By default, Dovecot `mmap()s` the index files. This may not work with all clustered filesystems, and it most certainly won't work with NFS. Setting [[setting,mmap_disable,yes]] disables `mmap()` and Dovecot does its own internal caching. If `mmap()` is supported by your filesystem, it's still not certain that it gives better performance. Try benchmarking to make sure. ### Locking Dovecot supports locking index files with fcntl (default), flock or dotlocks. Some clustered filesystems may not support fcntl, so you can change it to use flock instead. Fcntl locks may also cause problems with some NFS configurations, in which case you can try if switching to dotlocks helps. Note that dotlocks are the slowest locking method. You can change the locking method from [[setting,lock_method]] setting. Regardless of the `lock_method` setting, Dovecot always uses dotlocks for some locks. ### Clock Synchronization Run ntpd on each node to make sure clocks are synchronized. If the clocks are more than one second apart from each others and multiple computers access the same mailbox simultaneously, you may get errors from Dovecot. ### Caching Your cluster will probably perform better if users are usually redirected to the same server. This is because the mailbox may already be cached in the memory and it may also reduce the traffic between the clusterfs nodes. At the very least, make sure that your load balancer redirects connections from the same IP address to the same server, if possible. ### FUSE / GlusterFS FUSE caches dentries and file attributes internally. If you're using multiple GlusterFS clients to access the same mailboxes, you're going to have problems. Worst of these problems can be avoided by using NFS cache flushes, which just happen to work with FUSE as well: ```doveconf[dovecot.conf] mail_nfs_index = yes mail_nfs_storage = yes ``` These probably don't work perfectly. ### Samba / CIFS Dovecot's temporary files may include a colon character `:` in their filename, which is not a permitted character when using CIFS. Dovecot also renames the temporary files whilst holding a lock in them, which generates the error "Text file is busy". In short, CIFS/smbfs is unlikely to work as a remote filesystem. # Pop3c Mailbox Format The pop3c storage accesses a remote POP3 server as if it were a regular (local) Dovecot mailbox format. The remote POP3 mailbox is visible as the INBOX folder on the Dovecot side. ## Settings ## Configuration Example Connect using STARTTLS to pop3.example.com: ```doveconf[dovecot.conf] # In-memory index files: mail_driver = pop3c mail_path = # OR, Store index files locally: #mail_path = ~/pop3c pop3c_host = pop3.example.com pop3c_password = secret pop3c_port = 110 pop3c_ssl = starttls pop3c_user = user@example.com ``` # Namespaces Dovecot supports fully configurable, hierarchical namespaces, which can use different storage drivers. Their original and primary purpose is to provide Namespace IMAP extension ([[rfc,2342]]) support, which allows giving IMAP clients hints about where to locate mailboxes and whether they're private, shared or public. Dovecot namespaces can be used for several other purposes too: * Changing the [[link,namespaces_hierarchy_separators,Hierarchy Separators]] * Providing backwards compatibility when switching from another IMAP server * Provides support for [[link,shared_mailboxes_public]] and [[link,shared_mailboxes_user]] mailboxes * Allows having mails in multiple different locations with possibly different formats These different locations and drivers are presented to the client as a single tree. Each namespace has: * prefix (usually empty or "INBOX.") * namespace separator (usually '/' or '.') * 0 or more folders There must be one namespace where the case-insensitive folder named INBOX exists. All visible namespaces must have the same separator. Inside each namespace there is a list of folders, which form a sub-hierarchy. ::: info Enable default INBOX namespace and English language mailbox names with [[setting,mailbox_special_use]] flags with [[setting,@mailbox_defaults,english]] Using this setting will set these settings by default: ::: details Click to show settings ```doveconf[dovecot.conf] namespace inbox { inbox = yes mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Junk { auto = subscribe special_use = \Junk } mailbox Sent { auto = subscribe special_use = \Sent } mailbox Trash { auto = subscribe special_use = \Trash } } ``` ::: ## Folder Names Each folder has a name. In configuration files and log files Dovecot almost always uses the "virtual name", which uses the configured namespace's hierarchy separator as well as the namespace prefix. Depending on the used [[setting,mailbox_list_layout]] setting the internal folder name may be different. The internal name is stored in databases (e.g. mailbox subscriptions), which allows changing the namespace prefix or separator without having to change the databases. The folder names use UTF-8 character set internally. All folder names must be valid UTF-8. With [[setting,mailbox_list_layout,fs]] and [[setting,mailbox_list_layout,Maildir++]] the folder names are stored in filesystem paths as mUTF-7 (see IMAP [[rfc,3501]]) mainly for legacy reasons. This can be changed with the [[setting,mailbox_list_utf8]] setting. ### Folder Name Lengths Folder name length restrictions: * Maximum length of an individual folder name within a hierarchy is 255 bytes. For example with "a/b/c" hierarchy each of the a, b and c can be a maximum of 255 bytes. * The maximum folder path length is 4096 bytes. The maximum folder name lengths work correctly when folder names aren't stored in filesystem, i.e. [[setting,mailbox_list_layout,index]] is used. Otherwise the OS adds its own limitations to path name lengths and the full 4096 bytes can't be used. With [[setting,mailbox_list_layout,Maildir++]] the path must fit to 254 bytes (due to OS limitations). ### Parent Folders A folder can have one or more parent folders that do not physically exist. These are presented with `\NoSelect` or `\Nonexistent` attribute. It's possible to try to avoid creating these by using the [[setting,mailbox_list_drop_noselect]] setting (enabled by default). ## Configuration If the Dovecot configuration doesn't explicitly specify a namespace, the inbox namespace is created automatically. Namespace configuration is defined within a dovecot configuration block with the format: ```doveconf[dovecot.conf] namespace { [... namespace settings ...] } ``` The namespace name is only used internally within configurations. It allows you to update an existing namespace - by repeating the namespace block and adding additional configuration settings - or allows userdb to override namespace settings for specific users, e.g.: ``` namespace/name/prefix=foo/ ``` Example configuration for default namespace: ```doveconf[dovecot.conf] namespace inbox { separator = . prefix = inbox = yes } ``` ## Settings ## Hierarchy Separators [[setting,namespace_separator]] specifies the character that is used to separate the parent mailbox from its child mailbox. For example if you have a mailbox "foo" with child mailbox "bar", the full path to the child mailbox would be "foo/bar" with `/` as the separator, and "foo.bar" with `.` as the separator. IMAP clients, Sieve scripts, and many parts of Dovecot configuration use the configured separator when referring to mailboxes. This means that if you change the separator, you may break things. However, changing the separator doesn't change the on-disk "layout separator". Example: | `mailbox_list_layout` | Layout Separator | Namespace Separator | Mailbox Name | Directory | | --- | --- | --- | --- | --- | | `Maildir++` (default) | `.` | `.` | `foo.bar` | `~/Maildir/.foo.bar/` | | `Maildir++` (default) | `.` | `/` | `foo/bar` | `~/Maildir/.foo.bar/` | | `fs` | `/` | `.` | `foo.bar` | `~/Maildir/foo/bar/` | | `fs` | `/` | `/` | `foo/bar` | `~/Maildir/foo/bar/` | ::: tip The "namespace separator" changes only the "mailbox name", but doesn't change the directory where the mails are stored. The "layout separator" can only be changed by changing [[setting,mailbox_list_layout]], which also affects the entire directory structure. ::: The layout separator also restricts the mailbox names. For example if the layout separator is `.`, you can't just set separator to `/` and create a mailbox named `foo.bar`. A commonly used separator is `/`. It probably causes the least amount of trouble with different IMAP clients. The `^` separator is troublesome with Thunderbird. If `\` has to be used, it needs to be escaped in configuration: ```doveconf[dovecot.conf] namespace inbox { separator = "\\" } ``` You should use the same hierarchy separator for all namespaces. All `list=yes` namespaces must use the same separator, but if you find it necessary (e.g. for backwards compatibility namespaces) you may use different separators for `list=no` namespaces. ## Values From userdb To change namespace settings from userdb, you need to return `namespace//setting+=value`. To create a namespace, make sure you first return `namespace+=[,,...]` and settings after this. This adds a new given namespace. Without `+` all the namespaces are replaced with the given list. ```doveconf[dovecot.conf] userdb static { fields { namespace += special namespace/special/mail_path = /var/special/%{user} namespace/special/prefix = special/ } } ``` ## Shared Mailboxes See [[link,shared_mailboxes]]. ## Examples ### Mixed mbox and Maildir If you have your INBOX as mbox in `/var/mail/username` and the rest of the mailboxes in Maildir format under `~/Maildir`, you can do this by creating two namespaces: ```doveconf[dovecot.conf] namespace inbox { separator = / prefix = "#mbox/" mail_driver = mbox mail_path = ~/mail mail_inbox_path = /var/mail/%{user} inbox = yes hidden = yes list = no } namespace maildir { separator = / prefix = mail_driver = maildir mail_path = ~/Maildir } ``` Without the `list = no` setting in the first namespace, clients would see the "#mbox" namespace as a non-selectable mailbox named "#mbox" but with child mailboxes (the mbox files in the "~/mail" directory), i.e. like a directory. So specifically with `inbox = yes`, having `list = no` is often desirable. ### Backwards Compatibility: UW-IMAP When switching from UW-IMAP and you don't want to give users full access to filesystem, you can create hidden namespaces which allow users to access their mails using their existing namespace settings in clients. ```doveconf[dovecot.conf] # default namespace namespace inbox { separator = / prefix = inbox = yes } # for backwards compatibility: namespace compat1 { separator = / prefix = mail/ hidden = yes list = no alias_for = inbox } namespace compat2 { separator = / prefix = ~/mail/ hidden = yes list = no alias_for = inbox } namespace compat3 { separator = / prefix = ~%{user}/mail/ hidden = yes list = no alias_for = inbox } ``` ### Backwards Compatibility: Courier IMAP **Recommended:** You can continue using the same `INBOX.` namespace as Courier: ```doveconf[dovecot.conf] namespace inbox { separator = . prefix = INBOX. inbox = yes } ``` **Alternatively:** Create the `INBOX.` as a compatibility name, so old clients can continue using it while new clients will use the empty prefix namespace: ```doveconf[dovecot.conf] namespace inbox { separator = / prefix = inbox = yes } namespace compat { separator = . prefix = INBOX. inbox = no hidden = yes list = no alias_for = inbox } ``` The `separator=/` allows the INBOX to have child mailboxes. Otherwise with `separator=.` it wouldn't be possible to know if "INBOX.foo" means INBOX's "foo" child or the root "foo" mailbox in "INBOX." compatibility namespace. With `separator=/` the difference is clear with "INBOX/foo" vs. "INBOX.foo". The alternative configuration is not recommended, as it may introduce issues: * Although clients may do `LIST INBOX.*`, they may still do `LSUB *`, resulting in mixed results. * If clients used empty namespace with Courier, they now see the mailboxes with different names, resulting in redownloading of all mails (except INBOX). * Some clients may have random errors auto-detecting the proper default folders (Sent, Drafts etc) if the client settings refer to old paths while the server lists new paths. See also [[link,migrating_mailboxes]] ### Per-user Namespace Location From SQL You need to give the namespace a name, for example "docs" below: ```doveconf[dovecot.conf] namespace docs { type = public separator = / prefix = Public/ } ``` Then you have an SQL table like: ```sql CREATE TABLE Namespaces ( [...] Location varchar(255) NOT NULL, [...] ) ``` Now if you want to set the namespace location from the Namespaces table, use something like: ```doveconf[dovecot.conf] userdb sql { query = SELECT Location as 'namespace/docs/mail_path' \ FROM Namespaces \ WHERE .. } ``` If you follow some advice to separate your "INBOX", "shared/" and "public/" namespaces by choosing "INBOX/" as your prefix for the inboxes you will see, that you run into troubles with subscriptions. Thats, because there is no parent namespace for "shared/" and "public/" if you set `subscriptions = no` for those namespaces. If you set `subscriptions = yes` for "shared/" and "public/" you will see yourself in the situation, that all users share the same subscription files under the location of those mailboxes. One good solution is, to create a so called "hidden subscription namespace" with subscriptions turned on and setting `subscriptions = no` for the other namespaces: ```doveconf[dovecot.conf] namespace subscriptions { subscriptions = yes prefix = "" list = no hidden = yes } namespace inbox { inbox = yes subscriptions = no prefix = INBOX/ separator = / mailbox Drafts { auto = subscribe special_use = \Drafts } mailbox Sent { auto = subscribe special_use = \Sent } mailbox "Sent Messages" { special_use = \Sent } mailbox Spam { auto = subscribe special_use = \Junk } mailbox Trash { auto = subscribe special_use = \Trash } } namespace shared { type = shared prefix = shared/$user/ mail_driver = mdbox mail_path = %{owner_home}/mdbox mail_index_private_path = %{owner_home}/mdbox/shared list = children subscriptions = no } namespace public { type = public separator = / prefix = public/ mail_driver = mdbox mail_path = /usr/local/mail/public/mdbox mail_index_private_path = ~/mdbox/public subscriptions = no list = children } ``` ## Mailbox Settings Mailbox configuration is typically defined inside a [[setting,namespace]] block so it only applies to the specific namespace. ### Settings ### Example In general it's recommended to use [[setting,@mailbox_defaults,english]], which will create and autosubscribe to a standard default set of mailboxes with appropriate [[setting,mailbox_special_use]] settings. In case you need separate or additional folders with special use flags, consider the following example: ```doveconf[dovecot.conf] namespace inbox { # the namespace prefix isn't added again to the mailbox names. #prefix = INBOX. inbox = yes # ... mailbox Trash { auto = no special_use = \Trash } mailbox Drafts { auto = no special_use = \Drafts } mailbox Sent { auto = subscribe # autocreate and autosubscribe the Sent mailbox special_use = \Sent } mailbox "Sent Messages" { auto = no special_use = \Sent } mailbox Spam { auto = create # autocreate Spam, but don't autosubscribe special_use = \Junk } mailbox virtual/All { # if you have a virtual "All messages" mailbox auto = no special_use = \All } } ``` # NFS Dovecot is commonly used with NFS. However, Dovecot does **not** support accessing the same user simultaneously by different servers. That will result in more or less severe mailbox corruption. Note that this applies to all mailbox access, including mail delivery. * Users must be assigned to specific backends (i.e. in the proxy's passdb lookups). * Use [[link,lmtp]] for mail deliveries. * Set [[setting,mmap_disable,yes]] * Set [[setting,mail_fsync,always]] * Do **not** set [[setting,mail_nfs_index]] or [[setting,mail_nfs_storage]] (i.e. keep them as `no`) * Do **not** use the `quota-status` service. * Unmounted NFS mount point directory should not be writable to Dovecot mail processes (i.e. often the `vmail` user). Otherwise if the NFS isn't mounted for some reason and user access mails, a new empty user mail directory is created, which breaks things. ## NFS Mount Options * `actimeo`: This or the more specific settings can be used to control NFS caching. Increasing this can reduce NFS traffic. It should be at least 60 seconds (`actimeo=60`). * `nordirplus`: Disable readdirplus operations, which aren't needed by Dovecot. They can also slow down some NFS servers. * `noatime`: Disable updating atime. Dovecot doesn't need this and it may slow down NFS servers. * `root_squash`: Dovecot doesn't care about this. Typically Dovecot doesn't store any root-owned files in NFS. * `nolock` / `local_lock=all`: This is possible to use as a slightly unsafe optimization. All file locking is handled only locally instead of via NFS server. Assuming users are never accessed simultaneously by multiple backends, there is no need to use locking across NFS. Each user only locks their own files, and the user should only be accessed by a single server at a time. In some rare situations the same user can become accessed by multiple servers simultaneously. In those situations the mails are more likely to become corrupted if `nolock` is used. However, if indexes and emails are on different mountpoints, email corruption shouldn't be possible if the `nolock` is enabled only for the index mountpoint. This can still increase the likelihood of index corruption (which can lose message flags), but locking won't prevent index corruption completely anyway. ## Optimizations Potential optimizations to use: * mdbox format is likely more efficient to use than the sdbox format. The downside is that it requires running periodic [[doveadm,purge]] for each user. Theses commands should be run via a doveadm proxy so they are run in the proper backends. * Use [[setting,mail_volatile_path,/dev/shm/dovecot/%{user | sha1 % 256 | hex(2)}/%{user}]] to store some temporary files (e.g. lock files) in tmpfs rather than NFS. * Use [[setting,mailbox_list_index_prefix,/fast/%{user | sha1 % 256 | hex(2)}/%{user}]] to use "smaller fast storage" for index files and "larger slow storage" for mail files. Also use [[setting,mailbox_list_iter_from_index_dir,yes]] to list mailboxes via the fast index storage rather than the slow mail storage. * Use [[setting,mailbox_list_iter_from_index_dir,/slow/%{user | sha1 % 256 | hex(2)}/%{user}]] to use "smaller fast storage" for new mails and "larger slow storage" for old mails. The [[doveadm,altmove]] command needs to be run periodically. Also use [[setting,mail_alt_check,no]] to disable a sanity check to make sure alt storage path doesn't unexpectedly change. * See the NFS mount options above. ## Clock Synchronization Run ntpd in the NFS server and all the NFS clients to make sure their clocks are synchronized. If the clocks are more than one second apart from each others and multiple computers access the same mailbox simultaneously, you may get errors. # Dovecot Optimizations ## TZ (timezone) Environment Variable The use of the TZ environment variable can dramatically reduce the number of system calls and kernel context switches performed by the application. The `localtime()` function in glibc checks whether the `TZ` environment variable is set. If it is not set, then glibc will use the `stat()` system call every time `localtime()` is called, even with vDSO in place. Setting the `TZ` environment variable to `:/etc/localtime` (or some other timezone file of your choice) for a process will save glibc from making those extra unnecessary system calls (Notice the column `:` prefix before the file path). The variable can be set either from the shell: ```sh export TZ=:/etc/localtime ``` or directly from inside the Dovecot configuration file: ```doveconf[dovecot.conf] import_environment { TZ = :/etc/localtime } ``` Note that a reload is not sufficient for the change to take effect. A restart is required. ::: tip See Also: * [GNU man page for the TZ environment variable](https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html), and * [Article explaining in detail the issue](https://blog.packagecloud.io/set-environment-variable-save-thousands-of-system-calls/). ::: ## Disk I/O Usually heavily loaded IMAP and POP3 servers don't use much CPU, but they use all the disk I/O they can get. So reducing disk I/O is probably the most useful optimization you can do. - See [[link,mbox]] for mbox-specific optimizations. - See [[link,maildir]] for Maildir-specific optimizations. - See [[link,dbox]] for Dovecot's own high-performance mailbox format. It usually gives much better performance than mbox/Maildir. - See [[plugin,fts]] for optimizing IMAP SEARCH command. - See [[link,pop3]] for POP3 optimizations, especially [[setting,pop3_no_flag_updates,yes]]. - [[setting,mailbox_list_index,yes]] can help a lot by replying to IMAP STATUS (and similar) lookups from a single index without having to open each mailbox index separately. This is the default. - Also [[setting,mailbox_list_index_very_dirty_syncs,yes]] makes Dovecot assume that the list index is up-to-date. - [[setting,mail_prefetch_count]] setting may be helpful with some mailbox formats. - [[setting,mail_volatile_path,/tmp/dovecot-volatile/%{user | sha1 % 256 | hex(2)}/%{user}]] moves, e.g., lock files to the volatile directory. This is helpful especially if the [[link,mail_location,mail location settings]] otherwise point to a remote filesystem like NFS. - If the [[plugin,acl]] is used, but only global ACLs are needed, set [[setting,acl_globals_only,yes]]. ## CPU Usage - See [[link,login_processes]] for optimizing CPU usage caused by logins. - See [[setting,auth_cache_size]] setting for caching passdb and userdb lookups. - To distribute password hash calculations to multiple CPU cores (via auth-worker processes), set [[setting,auth_cache_verify_password_with_worker,yes]]. - Services having [[link,service_client_limit]] > 1 and [[link,service_process_limit]] > 1, set [[link,service_process_min_avail]] to the number of CPU cores. - To reduce forks by reusing existing processes for new requests, increase [[setting,service_restart_request_count]] from `1` to higher (e.g. `100`) for imap and pop3 services. It's better not to set it too high or unlimited, because different users use different amounts of memory, and it's wasteful when a lot of processes end up having a lot of "free" memory. ## Memory Usage There aren't many settings which affect Dovecot's memory usage. In general Dovecot uses as much memory as it needs, which is usually quite little. - [[setting,auth_cache_size]] controls maximum memory size for caching passdb/userdb lookups - [[link,login_processes_high_performance]] for login processes - [[setting,imap_hibernate_timeout]]` controls when to move IDLEing IMAP connections to wait for changes in a shared imap-hibernate process. This frees up the imap process. Note that these settings do NOT directly affect the memory usage: - [[link,service_vsz_limit]]: These are simply safe guards against potential memory leaks. If the process's virtual size reaches the limit, the process is killed by the kernel. - [[link,service_process_limit]] and [[link,service_client_limit]]: These are mostly to avoid DoS attacks using up all your memory. ### glibc For Linux/glibc it's recommended to set: ```doveconf[dovecot.conf] import_environment { MALLOC_MMAP_THRESHOLD_ = 131072 } ``` This allocates all memory larger than 128 kB using mmap(), which allows the OS to free the memory afterwards. This is important for backends which have a lot of long-running imap and pop3 processes. ## Operating Systems ::: warning Dovecot is developed for Linux. Although Dovecot may work on other OS platforms, the main developer focus (and the focus of this page) is exclusively Linux. ::: The default Linux configurations are usually quite good. The only things needed to check are: * `/proc/sys/fs/inotify/max_user_watches` and `max_user_instances` need to be large enough to handle all the IDLEing IMAP processes. ``` fs.inotify.max_user_instances = 65535 fs.inotify.max_user_watches = 65535 ``` * In order to reduce I/O on the backends, it is recommended to disable the ext4 journal: ```sh tune2fs -O ^has_journal /dev/vdb e2fsck -f /dev/vdb ``` * Dovecot doesn't require atimes, so you can mount the filesystem with noatime: ```sh mount -o defaults,discard,noatime /dev/vdb /storage ``` * All the servers' hostnames must be unique. This is relied on in many different places. * Make sure the servers are running ntpd or some other method of synchronizing clocks. The clocks shouldn't differ more than 1 second. The time must never go backwards - this is especially important in Dovecot backends when using Cassandra, because otherwise `DELETEs` or `UPDATEs` may be ignored when the query timestamp is older than the previous `INSERT/UPDATE`. * With busy servers Dovecot might run out of TCP ports. It may be useful to increase `net.ipv4.ip_local_port_range`. ``` net.ipv4.ip_local_port_range = 1024 65500 ``` ## TIME-WAIT Connections * `net.ipv4.tcp_tw_reuse=1` can help to avoid "Cannot assign requested address" errors for outgoing connections and is rather safe to set. It only affects outgoing connections. See: https://vincent.bernat.ch/en/blog/2014-tcp-time-wait-state-linux ### NOT Recommended Adjusting TCP buffer sizes is also usually a bad idea, unless your kernel is very old and you have good knowledge of the types of TCP traffic (number of connections, bandwidth consumed, activity patterns etc) you will have. # POP3 Dovecot was primarily designed to be an IMAP server, so although it works fine as a POP3 server, it's not really optimized for that. ## Maildir Performance The main problem with Dovecot's POP3 implementation with [[link,maildir]] is how to get messages' size fast enough. The POP3 specification requires that the sizes are reported exactly, not just approximately. This means that linefeeds must be counted as `CR+LF` characters. Normally with Maildir the linefeeds are stored as plain LF characters, which means that simply getting the file size would produce the wrong POP3 message size. Some Maildir POP3 servers do this anyway and violate the POP3 specification. Dovecot returns correct message sizes by reading the entire message and counting the linefeeds correctly. After this is done, the `virtual size` is stored into `dovecot-uidlist` file and future calculations can be avoided by simply looking up the cached value. You can also avoid the initial message size calculation by storing the size directly into the filename. You can do this by appending ,`W=` at the end of the base filename. For example `1199932653.M583975P6568.host,W=2211:2`, is a file whose virtual size is 2211 bytes (and real size somewhat smaller). Note that this must not be done for existing files, only to newly delivered mails. If Dovecot's [[link,lda]] is used, `dovecot-uidlist` and the index files are updated upon message arrival, therefore there will be no message-size performance issues. [[setting,pop3_fast_size_lookups,yes]] setting uses the virtual message sizes when they're already available, but fallbacks to using the physical message sizes (violating POP3 specifications, but then again a lot of POP3 servers do that). ## mbox Performance Index files are quite useless if your users don't keep mails in the server. They get first updated when the POP3 session starts to include all the messages, and after the user has deleted all the mails, they again get updated to contain zero mails. With this kind of a session the index reads and writes could have been avoided if the index files had just been completely disabled. You may want to try how performance changes if you disable indexes for POP3 users. You can also try preserving indexes but try different values for [[setting,mbox_min_index_size]]. Do not disable indexing if there are users that do not delete messages after downloading them. Also, if you use Dovecot LDA, indexes may be helpful to have fast access to the message sizes. ## Session Locking By default Dovecot allows multiple POP3 connections to the same mailbox. This is (was?) especially useful for dialup connections which die in the middle of the download, because the half-dead connections won't keep the mailbox locked. Setting [[setting,pop3_lock_session,yes]] makes Dovecot lock the mailbox for the whole session. This is also what the POP3 [[rfc,1939]] specifies should be done. If another connection comes while the mailbox is locked, Dovecot waits until the locking times out (2 minutes with Maildir, [[setting,mbox_lock_timeout]] with mbox). ## Flag Changes By default when a message is RETRed, \Seen flag is added to it. POP3 itself doesn't support flags, but if the mailbox is opened with IMAP it's shown as seen. You can disable this (to get better performance) with [[setting,pop3_no_flag_updates,yes]]. ## POP3 Client Workarounds pop3_client_workarounds setting allows you to set some workarounds to avoid POP3 clients breaking with some broken mails. See [[setting,pop3_client_workarounds]]. ## UIDL format UIDLs are used by POP3 clients to keep track of what messages they've downloaded, typically only if you've enabled keep messages in server option. If the UIDL changes, the existing messages are re-downloaded as new messages, which the users don't really appreciate. Dovecot supports multiple different ways to set the UIDL format, mostly to make migrations from other POP3 servers transparent by preserving the old UIDL values. See [[link,migrating_mailboxes]] for how to set the UIDLs to be compatible with your previous POP3 server. For new POP3 servers, the easiest way to set up UIDLs is to use IMAP's UIDVALIDITY and UID values. The default is: ```doveconf[dovecot.conf] pop3_uidl_format = %{uid | hex(8)}%{uidvalidity | hex(8)} ``` Another good default is to use the message's global UID: ```doveconf[dovecot.conf] pop3_uidl_format = %{guid} ``` However, note that GUIDs may not be unique, as the GUID does not change when a message is copied. (While copying is not possible using only POP3, it can be done using IMAP, Sieve, or doveadm.) ### MD5 UIDL format (mbox-only) ```doveconf[dovecot.conf] pop3_uidl_format = %{md5} ``` This works by getting the MD5 sum of a couple of message headers that uniquely identify the message. The one good thing about MD5 format is that it doesn't rely on the IMAP UID or UIDVALIDITY value. This allows you to modify the mbox files in ways that Dovecot doesn't like, without causing the UIDLs to change. For example: * Inserting messages in the middle of mbox files (eg. restoring mbox files from backups can cause "Expunged message reappeared" errors) * Reordering messages inside mbox * [[link,mbox,Other random problems]] causing UID renumbering (although you should figure out why they're happening) The MD5 summing method however doesn't work well if you receive two identical messages. Usually the MD5 sum is taken from these headers: * The first Received: header * Delivered-To: header Normally there won't be a problem, because the MTA adds a unique identifier to the first Received: header. If the same message is sent to multiple users in one delivery, the Delivered-To: header is still different, making the MD5 sum different. Except the MTA can be configured to support aliases, so for example sending the mail to both root@ and webmail@ aliases causes the message to be delivered to the same user, with identical Received: and Delivered-To: headers. The messages really are identical, so their MD5 sums are also identical, and that can cause some POP3 clients to keep downloading the messages over and over again, never deleting them. To avoid this, there's also a 3rd header that is included in the MD5 sum calculation: * X-Delivery-ID: header If you use [[link,lda]] or IMAP APPEND and [[setting,pop3_uidl_format,%{md5}]] it always appends the X-Delivery-ID: header to saved mailbox. Any existing X-Delivery-ID: headers in the saved mails are dropped. ## Optimization ### Don't Update \Seen Flag Improve performance by not updating the IMAP \Seen flag whenever downloading mails via POP3: [[setting,pop3_no_flag_updates,yes]]. # Post-login Scripting If you want to do something special after authentication, but before beginning the IMAP or POP3 session, you can do this by telling imap/pop3 executable to use post-login service by editing `dovecot.conf`: ```doveconf[dovecot.conf] service imap { # tell imap to do post-login lookup using a socket called "imap-postlogin" executable = imap imap-postlogin } # The service name below doesn't actually matter. service imap-postlogin { # all post-login scripts are executed via script-login binary executable = script-login /usr/local/bin/postlogin.sh # the script process runs as the user specified here (v2.0.14+): user = $SET:default_internal_user # this UNIX socket listener must use the same name as given to imap executable unix_listener imap-postlogin { } } ``` You can run multiple post-login scripts by just giving multiple scripts as parameters to `script-login`, for example: ```doveconf[dovecot.conf] executable = script-login rawlog /usr/local/bin/postlogin.sh /usr/local/bin/postlogin2.sh ``` The scripts are run in the specified order. Remember that the post-login script runs with the privileges of the `user` setting given to the service (root by default). If you need the script to access user's mail files, change it to whatever user owns the mails (e.g. vmail). If you're using multiple UNIX UIDs (e.g. system users), use `script-login -d` to drop to the `UID` or `GID` specified by the userdb lookup (ignoring user/group/chroot service settings). It's not currently possible to run post-login scripts in [[link,authentication_proxies]] because they're not actually logging into the local Dovecot. ## Running Environment Standard input and output file descriptors are redirected to the client's network socket, so you can send data to client by simply writing to stdout. Standard error fd is redirected to Dovecot's error log, you can write errors there as well. The script can use environment variables: * `USER`: Username * `IP`: Remote IP address * `LOCAL_IP`: Local IP address * Fields returned by [[link,userdb]] lookup with their keys uppercased (e.g. if userdb returned home, it's stored in `HOME`). It's possible to add/modify userdb fields by adding them to environment and adding the field to `USERDB_KEYS`. For example to change user's mail location: ```sh #!/bin/sh export MAIL_DRIVER=maildir export MAIL_PATH=/tmp/test export USERDB_KEYS="$USERDB_KEYS mail_driver mail_path" exec "$@" ``` You can change any Dovecot settings using the above method. ## Custom Mailbox Location Autodetection See [[link,mail_location]]. ## Example Actions ::: tip Generally, many of these tasks can today be done much easier (and entirely within Dovecot configuration) by using [[link,auth_lua]]. ::: ### Alerts If you want to give the user's client some warning notification, you can do it just by writing it to stdout. But note: * Not all clients show the alerts, even though IMAP RFC requires it. * IMAP protocol requires CRLF (\r\n) line feeds. Some clients will break if you only send LF. ```sh #!/bin/sh if [ -f ~/.out-of-office ]; then printf "* OK [ALERT] You're still marked as being out of office.\r\n" fi exec "$@" ``` ### Use UNIX Groups for ACL Authorization ```sh #!/bin/sh ACL_GROUPS=`groups $USER | tr ' ' ','` export ACL_GROUPS export USERDB_KEYS="$USERDB_KEYS acl_groups" exec "$@" ``` ### Denying Connection from Some IP/User You can use the IP and USER shell variables that are setup by Dovecot in a bash script in order to deny connection (after a successful login), like this: ```bash #!/bin/bash if [ "$USER" = "myuser" ] ; then printf "* NO [ALERT] The user '$USER' cannot login\r\n" exit 0 fi if [ ! "$IP" = "192.168.1.1" ] ; then printf "* NO [ALERT] Access not allowed from the Internet\r\n" exit 0 fi exec "$@" ``` ### Dynamically Adding Shared Mailboxes According to Filesystem Permissions ::: details ::: code-group ```perl[shared_mailboxes.pl] #!/usr/bin/perl use strict; my $SHAREDDIR= '/var/spool/mail/Shared'; if (! @ARGV) { exit 1; } # for testing... #if ($ENV{USER} eq 'lemur') { # # print "* OK [ALERT] Hello $ENV{'USER'}!\n"; # &set_namespaces(); # system("env >> /tmp/dovecot-env-$$"); #} &set_namespaces(); exec(@ARGV) or die "Unable to exec @ARGV: $!"; sub set_namespaces { my $mailbox; local *D; if (opendir(D, $SHAREDDIR)) { my $dir; my @namespaces = (); while ($mailbox= readdir(D)) { next if ($mailbox =~ /^\./); if (-r "${SHAREDDIR}/${mailbox}") { my $nsname = 'S-'.uc($mailbox); push(@namespaces, lc($nsname)); &log("adding NAMESPACE/${nsname}/PREFIX ${SHAREDDIR}/${mailbox}"); $ENV{"NAMESPACE/${nsname}/MAIL_PATH"} = "$SHAREDDIR/$mailbox" $ENV{"NAMESPACE/${nsname}/MAIL_INDEX_PATH"} = "~/Maildir/index/Shared/$mailbox"; $ENV{"NAMESPACE/${nsname}/PREFIX"} = "Shared/$mailbox/"; $ENV{"NAMESPACE/${nsname}/TYPE"}= "public"; $ENV{"NAMESPACE/${nsname}/SEPARATOR"}= "/"; $ENV{"NAMESPACE/${nsname}/LIST"}= "yes"; # $ENV{"NAMESPACE/${nsname}/SUBSCRIPTIONS"} = "no" } } closedir D; if (@namespaces) { $ENV{"NAMESPACE"} = join(' ', @namespaces); my @userdb_keys; if ($ENV{'USERDB_KEYS'}) { push(@userdb_keys, $ENV{'USERDB_KEYS'}); } push(@userdb_keys, grep(/^NAMESPACE/, keys(%ENV))); $ENV{'USERDB_KEYS'} = join(' ', @userdb_keys); } } } sub log { print STDERR "@_\n"; } ``` ```[Environment Variables] NAMESPACE/S-SPAMREP/LIST=yes NAMESPACE/S-SPAMREP/MAIL_PATH=/var/spool/mail/Shared/spamrep NAMESPACE/S-SPAMREP/MAIL_INDEX_PATH=~/Maildir/index/Shared/spamrep NAMESPACE/S-SPAMREP/PREFIX=Shared/spamrep/ NAMESPACE/S-SPAMREP/SEPARATOR=/ NAMESPACE/S-SPAMREP/TYPE=public NAMESPACE/S-TESTSHARED/LIST=yes NAMESPACE/S-TESTSHARED/MAIL_PATH=/var/spool/mail/Shared/testshared NAMESPACE/S-TESTSHARED/MAIL_INDEX_PATH=~/Maildir/index/Shared/testshared NAMESPACE/S-TESTSHARED/PREFIX=Shared/testshared/ NAMESPACE/S-TESTSHARED/SEPARATOR=/ NAMESPACE/S-TESTSHARED/TYPE=public NAMESPACE=s-testshared s-spamrep USERDB_KEYS=SYSTEM_GROUPS_USER UID GID HOME NAMESPACE/S-SPAMREP/LIST NAMESPACE NAMESPACE/S-TESTSHARED/SEPARATOR NAMESPACE/S-TESTSHARED/TYPE NAMESPACE/S-TESTSHARED/PREFIX NAMESPACE/S-TESTSHARED/LIST NAMESPACE/S-TESTSHARED/MAIL_PATH NAMESPACE/S-TESTSHARED/MAIL_INDEX_PATH NAMESPACE/S-SPAMREP/SEPARATOR NAMESPACE/S-SPAMREP/TYPE NAMESPACE/S-SPAMREP/PREFIX NAMESPACE/S-SPAMREP/MAIL_PATH NAMESPACE/S-SPAMREP/MAIL_INDEX_PATH ``` ::: # Forwarding parameters in IMAP/POP3/LMTP/SMTP proxying Dovecot supports proxying various pieces of information and even variables for various protocols when forwarding connection. It requires that the sender is listed under [setting,login_trusted_networks]]. For IMAP, it uses the `ID` command, for other protocols, `XCLIENT` is used. ## IMAP For IMAP, forwarding is done by extending the ID ([[rfc,2971]]) command. * RFC Requirements * Maximum key length is 30 bytes. * Value strings MUST NOT be longer than 1024 octets. * Dovecot has exactly 1024 byte limit to values. Trying to send 1025 bytes results in "BYE Input buffer full, aborting" response. * Implementations MUST NOT send more than 30 field-value pairs. * That being said, there doesn't seem to be any limit to number of field-value pairs Dovecot can accept. In a test of thousands of pairs sent to Dovecot, there was not any increased memory usage (since each key-value pair was read separately and then discarded when not used). The parameters are forwarded as part of the ID command field-value list. ``` 5 ID ("x-originating-ip" "127.0.0.1" "x-originating-port" "143" ...) ``` ### Supported Fields | Field | Description | | ----- | ----------- | | `x-originating-ip` | Client IP address | | `x-originating-port` | Client port | | `x-connected-ip` | Server IP address | | `x-connected-port` | Server port address | | `x-connected-name` | TLS SNI provided name. | | `x-proxy-ttl` | TTL which is reduced by each hop, loop prevention. When TTL drops to 0, the connection is dropped. | | `x-session-id`,
`x-session-ext-id` | Session ID to be used. | | `x-forward-` | Forwarded variable, see [[variable]] | ## POP3 For POP3, forwarding is done with custom `XCLIENT` command which accepts a space separated list of field=value parameters. ::: warning There is a 1024 byte line limit for the XCLIENT command when using POP3. Reaching this limit would cause the XCLIENT command to fail. This would be visible to the POP3 client as "-ERR Input buffer full, aborting" or some other AUTH error. ::: ### Supported Fields | Field | Description | | ----- | ----------- | | `ADDR` | Client IP | | `PORT` | Client port | | `DESTADDR` | [[added,xclient_dest_added]] Server IP | | `DESTPORT` | [[added,xclient_dest_added]] Server port | | `SESSION` | Session ID | | `TTL` | TTL which is reduced by each hop, loop prevention. When TTL drops to 0, the connection is dropped. | | `DESTNAME` | Name provided by TLS SNI. | | `FORWARD` | Base64-encoded, tab-separated list of `key=value` pairs to be forwarded to auth process. The keys and values are escaped using Dovecot's tab-escape format. | ## SMTP/LMTP See [XCLIENT information](https://www.postfix.org/XCLIENT_README.html). ### Supported Fields (SMTP/LMTP) | Field | Description | | ----- | ----------- | | `ADDR` | Client IP; prefix (`IPV6:`) is required for IPv6. However, Dovecot currently forwards without the IPv6 prefix, which does not follow the correct Postfix XCLIENT syntax. | | `DESTADDR` | [[added,xclient_dest_added]] Server IP | | `DESTPORT` | [[added,xclient_dest_added]] Server port | | `PORT` | Client port | | `TTL` | TTL which is reduced by each hop, loop prevention. When TTL drops to 0, the connection is dropped. | | `HELO` | Original `HELO`/`EHLO` | | `LOGIN` | Original `LOGIN` value | | `TIMEOUT` | Original `TIMEOUT` | | `PROTO` | Forwarded protocol: `SMTP`, `ESTMP`, or `LMTP`. | | `DESTNAME` | Name provided by TLS SNI. | ### Supported Fields (*SMTP/Submission* ONLY) | Field | Description | | ----- | ----------- | | `FORWARD` | Base64-encoded, tab-separated list of `key=value` pairs to be forwarded to auth process. The keys and values are escaped using Dovecot's tab-escape format. This value is effectively limited to around 1000 bytes. | | `SESSION` | Session ID | | `DESTNAME` | Name provided by TLS SNI. | ### Supported Fields LMTP Additional fields supported for the LMTP `RCPT TO` command: | Field | Description | | ----- | ----------- | | `XRCPTFORWARD` | Base64-encoded, tab-separated list of `key=value` pairs to be forwarded. The keys and values are escaped using Dovecot's tab-escape format. This value is effectively limited to around 900 bytes. | # Dovecot Proxying Dovecot supports proxying IMAP, POP3, [[link,submission]], [[link,lmtp]], [[link,managesieve]] and doveadm connections to other hosts. The proxying can be done for all users, or only for some specific users. There are two ways to do the authentication on the remote server: ## Configuration Proxying is enabled by the `proxy` or `proxy_maybe` extra field. Additionally, `host` is also a required field. See below for details on them and other optional extra fields. In backends, set [[setting,login_trusted_networks]] to point to the proxies' IP addresses. This way you'll get the clients' actual IP addresses logged instead of the proxy's. The destination servers don't need to be running Dovecot, but you should make sure that the Dovecot proxy doesn't advertise more capabilities than the destination server can handle. For IMAP you can do this by changing [[setting,imap_capability]]. For POP3 you'll have to modify Dovecot's sources for now (`src/pop3/capability.h`). Dovecot IMAP proxy also automatically sends updated untagged CAPABILITY reply if it detects that the remote server has different capabilities than what it already advertised to the client, but some clients simply ignore the updated CAPABILITY reply. ## Fields ### `proxy` Enables the proxying. Either this or `proxy_maybe` is required to enable proxying. ### `proxy_maybe` Enables optional proxying. Either this or `proxy` is required to enable proxying. `proxy_maybe` can be used to implement "automatic proxying" to implement a mixed mode of running proxies and backends in the same servers. If the proxy destination matches the current connection, the user gets logged in normally instead of being proxied. If the same happens with `proxy`, the login fails with `Proxying loops` error. [[setting,auth_proxy_self]] can be used to specify extra IPs that are also considered to be the proxy's own IPs. ### `host=` The destination server's IP address. This field is required. ### `source_ip=` The source IP address to use for outgoing connections. ### `port=` The destination server's port. The default is `143` with IMAP and `110` with POP3. ### `protocol=` The protocol to use for the connection to the destination server. This field is currently only relevant for LMTP: it can be used to select either `lmtp` or `smtp`. ### `destuser=s` Tell client to use a different username when logging in. ### `proxy_mech=` Tell client to use this SASL authentication mechanism when logging in. See [[setting,imapc_sasl_mechanisms]] for supported mechanisms ### `proxy_timeout=` Abort connection after this much time has passed. This overrides the default [[setting,login_proxy_timeout]]. This setting applies only to proxying via login processes, not to lmtp or doveadm processes. ### `proxy_no_multiplex` [[added,proxy_no_multiplex_added]] IMAP only: Do not enable multiplexing for the backend connection. By default the proxy requests a multiplexed connection from the backend by sending `x-multiplex` in the pre-login `ID` command. The multiplexed stream adds a side channel that the backend uses to hand off work to the proxy. Currently this is used only for handling the IMAP `COMPRESS` extension in the proxy, see [[setting,imap_compress_on_proxy]]. ::: warning This field should normally not be set: the multiplexed connection is the intended default between a Dovecot proxy and a backend. ::: When the field is set, the proxy-backend connection is a plain stream and the side channel functionality is disabled: * [[setting,imap_compress_on_proxy]] has no effect for the connection. The `COMPRESS` extension keeps working, but compression is handled by the backend imap process instead of the proxy, increasing CPU usage on the backends. This is a passdb extra field [[link,passdb_extra_fields]] only; there is no equivalent global setting. To disable multiplexing for all connections, return the field unconditionally from the proxy's passdb, e.g.: ``` passdb static { fields { proxy = yes host = 10.0.0.1 proxy_no_multiplex = yes nopassword = yes } } ``` ### `proxy_nopipelining` Don't pipeline IMAP commands. This is a workaround for broken IMAP servers that hang otherwise. ### `proxy_not_trusted` IMAP/POP3 proxying never sends the `ID/XCLIENT` command to remote. This can be used when proxying to remote servers that shouldn't see the clients' original IP addresses or other information. ## SSL You can use SSL/TLS connection to destination server by returning: * `ssl=yes`: Use SSL and require a valid verified remote certificate. * `ssl=any-cert`: Use SSL, but don't require a valid remote certificate. * `starttls=yes`: Use STARTTLS command instead of doing SSL handshake immediately after connected. * `starttls=any-cert`: Combine `starttls` and `ssl=any-cert`. ::: info Login processes are chrooted, so [[setting,ssl_client_ca_dir]] setting doesn't work. You can instead use [[setting,ssl_client_ca_file]]. ::: Additionally you can also tell Dovecot to send SSL client certificate to the remote server using [[setting,ssl_client_cert_file]] and [[setting,ssl_client_key_file]] settings. ## Source IPs If your proxy handles a lot of connections `(~64k)` to the same destination IP, you may run out of TCP ports. The only way to work around this is to use either multiple destination IPs or ports, or multiple source IPs. Multiple source IPs can be easily used by adding them to [[setting,login_source_ips]]. You can also use hostnames which expand to multiple IPs. It's probably better not to include the server's default outgoing IP address in the setting, as explained here: https://idea.popcount.org/2014-04-03-bind-before-connect/. ## Disconnection Delay To avoid reconnection load spikes when a backend server dies, you can tell proxy to spread the client disconnections over a longer time period (after the server side of the connection is already disconnected). [[setting,login_proxy_max_disconnect_delay]] controls this. ## Forwarding Fields You can forward arbitrary variables by returning them prefixed with `forward_`. Dovecot will use a protocol-dependent extension to forward these variables to the next hop. The next hop imports these to the auth request as passdb extra fields, so they are visible in, e.g., `%{passdb:forward_variable}`. If the proxying continues, all these fields are further forwarded to the next hop again. This feature requires that the sending host is in the destination's [[setting,login_trusted_networks]]. See [[link,forwarding_parameters]] for more details on how this is implemented for different protocols, which includes limits to the key and value lengths and counts. ::: info Most importantly the IMAP ID command restricts the forward key length to just 20 bytes (excluding `forward_` prefix). Larger keys are silently dropped. ::: ## Moving Users Between Backends/Clusters A safe way to move users from one cluster to another is to do it like: * Set `delay_until=` [[link,passdb_extra_fields]] where `` is the current timestamp plus some seconds into future (e.g. 31s). You may also want to append, e.g., +5 for some load balancing if a lot of users are moved at once. * Set `host=` [[link,passdb_extra_fields]]. This update should be atomic together with the `delay_until` field. * Use [[doveadm,kick]] to kick the user's existing connections. * The processes may still continue running in the backend for a longer time. If you want to be absolutely sure, you could also run a script to `kill -9` all processes for the user in the backend. This of course has its own problems. The idea here is that while the user's connections are being kicked and the backend processes are finishing up and shutting down, new connections are being delayed in the proxy. This delay should be long enough that the user's existing processes are expected to die, but not so large that clients get connection timeouts. A bit over 30 seconds is likely a good value. Once the `delay_until` timestamp is reached, the connections continue to the new host. If you have a lot of users, it helps to group some of them together and do the `host/delay_until` updates on a per-group basis rather than per-user basis. ## ID Command Forwarding If you want to forward, for some reason, the IMAP ID command provided by the client, set [[setting,imap_id_retain,yes]]. This will also enable `client_id` variable in variable expansions for auth requests, which will contain the ID command as IMAP arglist. ## Password Forwarding If you don't want proxy itself to do authentication, you can configure it to succeed with any given password. You can do this by returning an empty password and `nopassword` field. ## Master Users Note that this is different from master passwords. This way of forwarding requires the destination server to support master user feature. The users will be normally authenticated in the proxy and the common proxy fields are returned, but you'll need to return two fields specially: * `master=`: This contains the master username (e.g. `proxy`). It's used as SASL authentication ID. * Alternatively you could return `destuser=user*master` and set [[setting,auth_master_user_separator,*]]. * `pass=`: This field contains the master user's password. See [[link,auth_master_users]] for more information how to configure this. ## Examples ### Password Forwarding with Static DB See [[link,auth_staticdb]]. ### Password Forwarding with SQL Create the SQL table: ```sql CREATE TABLE proxy ( user varchar(255) NOT NULL, host varchar(16) default NULL, destuser varchar(255) NOT NULL default '', PRIMARY KEY (user) ); ``` Insert data to SQL corresponding your users. Working data could look like this: | user | host | destuser | | ---- | ---- | -------- | | john | 192.168.0.1 | | | joe | 192.168.0.2 | joe@example.com | ::: code-group ```doveconf[dovecot.conf] # If you want to trade a bit of security for higher performance, change # these settings: service imap-login { restart_request_count = unlimited } service pop3-login { restart_request_count = unlimited } # If you are not moving mailboxes between hosts on a daily basis you can # use authentication cache pretty safely. auth_cache_size = 4096 auth_mechanisms = plain sql_driver = mysql mysql sqlhost1 { } mysql sqlhost2 { } mysql_dbname = mail mysql_user = dovecot mysql_password = secret passdb sql { query = SELECT NULL AS password, 'Y' as nopassword, host, destuser, 'Y' AS proxy \ FROM proxy \ WHERE user = '%{user}' } ``` ### `proxy_maybe` with SQL ::: code-group ```sql[SQL Table] CREATE TABLE users ( user varchar(255) NOT NULL, domain varchar(255) NOT NULL, password varchar(100) NOT NULL, host varchar(16) NOT NULL, home varchar(100) NOT NULL, PRIMARY KEY (user) ); ``` ```doveconf[dovecot.conf] # user/group who owns the message files: mail_uid = vmail mail_gid = vmail auth_mechanisms = plain sql_driver = mysql mysql localhost { } passdb sql { query = SELECT concat(user, '@', domain) AS user, password, host, 'Y' AS proxy_maybe \ FROM users \ WHERE user = '%{user | username}' AND domain = '%{user | domain}' } userdb sql { query = SELECT user AS username, domain, home \ FROM users \ WHERE user = '%{user | username}' AND domain = '%{user | domain}' } ``` ::: # Login Referrals Login referrals are an IMAP extension specified by [[rfc,2221]]. It is practically not used by anyone, so this page exists mainly for historical reasons. Their purpose is to redirect clients to an different IMAP server in case of hardware failures or organizational changes. No client action is needed to invoke the LOGIN-REFERRALS capability: the redirection is triggered by the server and occurs transparently. ::: danger As stated by [[rfc,2221]], a man in the middle attack may use a rogue 'password catching' server to collect login data and redirect your clients to their own rogue IMAP server. Although this would be avoided by enforcing SSL/TLS. Login referrals are not supported by many clients, so you probably don't want to use them anyway. ::: Dovecot does NOT use login referrals by default. ## Configuration ::: info The `host` field is also used by proxying. Login referrals are used only if the `proxy` field isn't set. ::: Login referrals can be used in two ways: 1. Tell the client to log into another server without allowing to log in locally. 2. Suggest the client to log into another server, but log it in anyway. The following fields can be used to configure login referrals: | Field | Description | | ----- | ----------- | | `host=` | The destination server's hostname. This field is required for login referrals to be used. | | `port=` | The destination server's port. The default is `143`. | | `destuser=` | Tell client to use a different username when logging in. | | `reason=` | Optional reason to use as the reply to the login command. The default is "Logged in, but you should use this server instead." | Using the above settings, you can suggest client to log in elsewhere. To require it, you'll also have to return: * `nologin`: User is not allowed to log in. * `reason=`: Optional reason. The default is "Try this server instead." ## Client Support The following clients are known to support login referrals: * Pine * Outlook (but not Outlook Express) ## Examples Forward user to another server after successful authentication (SQL): ```doveconf[dovecot.conf] passdb sql { query = SELECT password, host, 'Y' as nologin \ FROM users \ WHERE userid = '%{user}' } ``` Forward all users to another server without authentication: ```doveconf[dovecot.conf] passdb sql { query = SELECT NULL AS password, 'Y' AS nopassword 'imap2.example.com' AS host, 'This server is down, try another one.' AS reason, 'Y' AS nologin, 'Y' AS nodelay } ``` # Rootless Installation It's possible to make Dovecot run under a single system user without requiring root privileges at any point. This shouldn't be thought of as a security feature, but instead simply as a way for non-admins to run Dovecot in their favorite mail server. It's also useful if you just wish to test Dovecot without messing up your system. If you think of this as a good way to achieve security, ask yourself which is worse: - A very small possibility to get root privileges through Dovecot. - A small possibility without logging in, to get into system as a non-privileged **dovecot** user, chrooted into an empty directory. - A small possibility to get user's privileges after logging in, but no possibility to read others' mails since they're saved with different UIDs (plus you might also be chrooted to your own mailbox). **or** - Absolutely zero possibility to get root privileges through Dovecot. - A small possibility to get into system as a mail user, possibly even without logging in, and being able to read everyone's mail (and finally gaining roots by exploiting some just discovered local vulnerability, unless you bothered to set up a special chrooted environment). ## Installation Install somewhere under home directory: ```sh ./configure --prefix=$HOME/dovecot make make install ``` Dovecot is then started by running `~/dovecot/sbin/dovecot`. An example configuration is automatically installed in `~/dovecot/etc/dovecot/dovecot.conf`. ### Add Capabilities Modern linux systems support capabilities which allows you to permit selective rights to processes. This allows you to run dovecot rootless without losing chroot and privileged ports. Use following commands to enable this: ```sh setcap cap_net_bind_service+ep ~/dovecot/sbin/dovecot setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/script-login setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/imap-urlauth-login setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/submission-login setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/managesieve-login setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/pop3-login setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/imap-login setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/lmtp setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/anvil # if you have installed managesieve setcap cap_sys_chroot+ep ~/dovecot/libexec/dovecot/managesieve-login ``` ## Configuration The important settings to change for rootless installation are: - Set usernames and group to the user which dovecot will be run under: ```doveconf[dovecot.conf] default_internal_user = user default_login_user = user default_internal_group = group ``` - Remove default chrooting from all services, this is optional if you want to use Linux capabilities instead. ```doveconf[dovecot.conf] service anvil { chroot = } service imap-login { chroot = } service pop3-login { chroot = } ``` - Change listener ports, this is optional if you want to use Linux capabilities instead: ```doveconf[dovecot.conf] service imap-login { inet_listener imap { port = 10143 } inet_listener imaps { port = 10993 } } service pop3-login { inet_listener pop3 { port = 10110 } inet_listener pop3s { port = 10995 } } ``` - Change logging destination: ```doveconf[dovecot.conf] log_path = /home/user/dovecot.log ``` - Instead of [[link,auth_pam]], use, for example, [[link,auth_passwd_file]]: ```doveconf[dovecot.conf] passdb passwd-file { passwd_file_path = /home/user/dovecot/etc/passwd } userdb passwd { } ``` Where the `passwd` file contains the username and password for your login user: ``` user:{PLAIN}pass ``` # Security Dovecot has been designed with security in mind. It uses multiple processes and privilege separation to isolate different parts from each others in case a security hole is found from one part. Additional things you can configure: - Allocate each user their own UID and GID (see [[link,system_users]]) - Use a separate `dovecot-auth` user for authentication process (see [[link,system_users]]) - You can chroot authentication and mail processes (see [[link,chrooting]]) - There are some security related SSL settings (see [[link,ssl_configuration]]) - Set `first/last_valid_uid/gid` settings to contain only the range actually used by mail processes # Service Configuration This page describes Dovecot's services comprehensively. Most admins don't need to know these details. ## Settings ## Service Limits There are 3 types of services that need to be optimized in different ways: 1. Master services (e.g. `auth`, `anvil`, `indexer`, `log`): Currently there isn't any easy way to optimize these. If these become a bottleneck, typically you need to run another Dovecot server. In some cases it may be possible to create multiple master processes and have each one be responsible for only specific users/processes, although this may also require some extra development. 1. Services that do disk I/O or other blocking operations (e.g. `imap`, `pop3`, `lmtp`): These should have [[setting,service_client_limit,1]], because any blocking operation will block all the other clients and cause unnecessary delays and even timeouts. This means that [[setting,service_process_limit]] specifies the maximum number of available parallel connections. 1. Services that have no blocking operations (e.g. `imap-login`, `pop3-login`): For best performance (but a bit less safety), these should have [[setting,service_process_limit]] and [[setting,service_process_min_avail]] set to the number of CPU cores, so each CPU will be busy serving the process but without unnecessary context switches. Then [[setting,service_client_limit]] needs to be set high enough to be able to serve all the needed connections (max connections = [[setting,service_process_limit]] * [[setting,service_client_limit]]). [[setting,service_restart_request_count]] is commonly set to `unlimited` for these services. Otherwise when the limit is beginning to be reached, the total number of available connections will shrink. With very bad luck that could mean that all the processes are simply waiting for the existing connections to die away before the process can die and a new one can be created. Although this could be made less likely by setting [[setting,service_process_limit]] higher than [[setting,service_process_min_avail]], but that's still not a guarantee since each process could get a very long running connection and the [[setting,service_process_limit]] would be eventually reached. ## Default Services ### anvil The anvil process tracks state of users and their connections. It is also used to kick users' connections. * [[setting_text,service_user,user=root]], because it needs the ability to send signals to mail processes to kick the users. * [[setting_text,service_process_limit,process_limit=1]], because there can be only one. * [[setting_text,service_client_limit,client_limit]] should be large enough to handle all the simultaneous connections. Dovecot attempts to verify that the limit is high enough at startup. If it's not, it logs a warning such as: * "Warning: service anvil { client_limit=200 } is lower than required under max. load (207)" This is calculated by counting the [[setting,service_process_limit]] of auth and login services, because each of them has a persistent connection to anvil. * [[setting_text,service_idle_kill_interval,idle_kill_interval=infinite]], because it should never die or all of its tracked state would be lost. * [[doveadm,who]] and some other doveadm commands connect to anvil's UNIX listener and request its state. ### auth The master auth process. There are 4 types of auth client connections: **auth** : Only [[link,sasl]] authentication is allowed. This can be safely exposed to entire world. **userdb** : userdb lookups and passdb lookups (without the password itself) can be done for any user, and a list of users can be requested. This may or may not be a security issue. Access to userdb lookup is commonly needed by [[link,lda]], doveadm, and other tools. **login** : Starts a two phase user login by performing authenticating (same as `client` type). Used by login processes. **master** : Finishes the two phase user login by performing a userdb lookup (similar to "userdb" type). Used by post-login processes (e.g. imap, pop3). ::: info [[changed,service_auth_listener_type]] The listener type is configured explicitly using the **type** field. For older versions, the listener type is selected based on the (file)name after the last `-` in the name. For example `anything-userdb` is of `userdb` type. The default type is `auth` for unrecognized listeners. You can add as many `auth` and `userdb` listeners as you want (and you probably shouldn't touch the `login` and `master` listeners). ::: * [[setting_text,service_process_limit,process_limit=1]], because there can be only one auth master process. * [[setting_text,service_user,user=$SET:default_internal_user]], because it typically doesn't need permissions to do anything (PAM lookups are done by auth-workers). * [[setting_text,service_chroot,chroot]] could be set (to e.g. `empty`) if passdb/userdb doesn't need to read any files (e.g. SQL, LDAP config is read before chroot) ### auth-worker Auth master process connects to auth worker processes. It is mainly used by passdbs and userdbs that do potentially long running lookups. For example MySQL supports only synchronous lookups, so each query is run in a separate auth worker process that does nothing else during the query. PostgreSQL and LDAP supports asynchronous lookups, so those don't use worker processes at all. With some passdbs and userdbs you can select if worker processes should be used. * [[setting_text,service_client_limit,client_limit=1]], because only the master auth process connects to auth worker. * [[setting_text,service_process_limit,process_limit]] indicates the maximum number of workers. * [[setting_text,service_user,user=root]] by default, because by default PAM authentication is used, which usually requires reading `/etc/shadow`. If this isn't needed, it's a good idea to change this to something else, such as `$SET:default_internal_user`. * [[setting_text,service_chroot,chroot]] could also be set if possible. * [[setting_text,service_restart_request_count,restart_request_count=unlimited]] counts the number of processed auth requests. This can be used to cycle the process after the specified number of auth requests (default is unlimited). The worker processes also stop after being idle for [[setting,service_idle_kill_interval]]. ### config Config process reads and parses the `dovecot.conf` file, and exports the parsed data in simpler format to config clients. * [[setting_text,service_user,user=root]], because the process needs to be able to reopen the config files during a config reload, and often some parts of the config having secrets are readable only by root. * Only root should be able to connect to its UNIX listener, unless there are no secrets in the configuration. Passwords are obviously secrets, but less obviously [[setting,ssl_server_key_file]] is also a secret, since it contains the actual SSL key data instead of only a filename. ### dict Dovecot has a [[link,dict,lib-dict]] API for doing simple key-value lookups/updates in various backends (SQL, file). This is optionally used by things like quota, expire plugin, and other things in the future. It would be wasteful for each mail process to separately create a connection to SQL, so usually they go through the `proxy` dict backend. These proxy connections are the client connections of dict processes. * dict / Synchronous lookups (e.g. mysql) * `client_limit=1`, because dict lookups are synchronous and the client is supposed to disconnect immediately after the lookup. * dict-async / Asynchronous lookups (e.g. pgsql, cassandra, ldap) * [[setting,service_process_limit]] should commonly be the same as number of CPU cores. Although with Cassandra this may not be true, because Cassandra library can use multiple threads. * [[setting_text,service_user,user=$SET:default_internal_user]], because the proxy dict lookups are typically SQL lookups, which require no filesystem access. (The SQL config files are read while still running as root.) * The dict clients can do any kind of dict lookups and updates for all users, so they can be rather harmful if exposed to an attacker. That's why by default only root can connect to dict socket. Unfortunately that is too restrictive for all setups, so the permissions need to be changed so that Dovecot's mail processes (and only them) can connect to it. ### dict-expire [[added,service_dict_expire]] This process periodically goes through configured dicts and deletes all expired rows in them. Currently this works only for dict-sql when `expire_field` has been configured. * [[setting_text,service_process_limit,process_limit=1]], because only one process should be running expires. * [[setting_text,service_user,user]] and other permissions should be the same as for the dict service. ### dns_client Used by lib-dns library to perform asynchronous DNS lookups. The dns-client processes internally use the synchronous `gethostbyname()` function. * [[setting_text,service_client_limit,client_limit=1]], because the DNS lookup is synchronous. * [[setting_text,service_user,user=$SET:default_internal_user]], because typically no special privileged files need to be read. * [[setting_text,service_chroot,chroot]] can be used only if it contains `etc/resolv.conf` and other files necessary for DNS lookups. ### doveadm It's possible to run doveadm mail commands via doveadm server processes. This is useful for running doveadm commands for multiple users simultaneously, and it's also useful in a multiserver system where doveadm can automatically connect to the correct backend to run the command. * [[setting_text,service_client_limit,client_limit=1]], because doveadm command execution is synchronous. * [[setting_text,service_user,user=root]], but the privileges are (temporarily) dropped to the mail user's privileges after userdb lookup. If only a single UID is used, user can be set to the mail UID for higher security, because the process can't gain root privileges anymore. ### imap, pop3, submission, managesieve Post-login process for handling IMAP/POP3/Submission/ManageSieve client connections. * [[setting_text,service_client_limit,client_limit]] may be increased from the default `1` to save some CPU and memory, but it also increases the latency when one process serving multiple clients is waiting for a long time for a lock or disk I/O. In the future these waits may be reduced or avoided completely, but for now it's not safe to set this value higher than `1` in enterprise mail systems. For small, mostly-idling hobbyist servers, a larger number may work without problems. * [[setting_text,service_process_limit,process_limit]] specifies the maximum number of simultaneous connections for the protocol that this service handles (IMAP, POP3, Submission, or ManageSieve). If you expect more connections, increase this value. ### imap-login, pop3-login, submission-login, managesieve-login See [[link,login_processes]]. ### indexer Indexer master process, which tracks and prioritizes indexing requests from mail processes. The actual indexing is done by indexer-worker processes. The indexing means both updating Dovecot's internal index and cache files with new messages and updating full text search indexes (if enabled). The indexer master process guarantees that the FTS index is never modified by more than one process. * [[setting_text,service_process_limit,process_limit=1]], because only one process can keep the FTS guarantee. * [[setting_text,service_user,user=$SET:default_internal_user]], because the process doesn't need any permissions. * [[setting_text,service_chroot,chroot]] could be set to [[setting,base_dir]] for extra security. It still needs to be able to connect to indexer-worker socket. ### indexer-worker Indexer worker process. indexer-workers are background processes that are not normally visible to the end user (exception: if mails are not indexed, i.e. on delivery, indexing needs to occur on-demand if a user issues a SEARCH command). Therefore, they generally should be configured to a lower priority to ensure that they do not steal resources from other processes that are user facing. A recommendation is to execute the process at a lower priority. This can be done by prefixing the executable location with a priority modifier, such as: ```doveconf[dovecot.conf] service indexer-worker { executable = /usr/bin/nice -n 10 /usr/libexec/dovecot/indexer-worker } ``` * [[setting_text,service_client_limit,client_limit=1]], because indexing is a synchronous operation. * [[setting_text,service_process_limit,process_limit=10]], because the FTS index updating can eat a lot of CPU and disk I/O. You may need to adjust this value depending on your system. * [[setting_text,service_user,user=root]], but the privileges are (temporarily) dropped to the mail user's privileges after userdb lookup. If only a single UID is used, user can be set to the mail UID for higher security, because the process can't gain root privileges anymore. ### lmtp LMTP process for delivering new mails. * [[setting_text,service_client_limit,client_limit=1]], because most of the time spent on an LMTP client is spent waiting for disk I/O and other blocking operations. There's no point in having more clients waiting around during that doing nothing. However, LMTP proxying is only writing to temporary files that normally stay only in memory. So for LMTP proxying, a `client_limit` above `1` could be useful. * [[setting_text,service_user,user=root]], but the privileges are (temporarily) dropped to the mail user's privileges after userdb lookup. If only a single UID is used, user can be set to the mail UID for higher security, because the process can't gain root privileges anymore. ### log All processes started via Dovecot master process log their messages via the `log` process. This allows some nice features compared to directly logging via syslog. * [[setting_text,service_process_limit,process_limit=1]], because the log process keeps track of all the other logging processes. * [[setting_text,service_user,user=root]], because it guarantees being able to write to syslog socket and to the log files directly. ### stats Event statistics tracking. Its behavior is very similar to the anvil process, but anvil's data is of higher importance and lower traffic than stats, so stats are tracked in a separate process. * [[setting_text,service_client_limit,client_limit]] should be large enough to handle all the simultaneous connections. Dovecot attempts to verify that the limit is high enough at startup. If it's not, it logs a warning such as: `Warning: service stats { client_limit=1000 } is lower than required under max. load (7945)` This is calculated by counting the [[setting,service_process_limit]] of all the services, because each of them has a persistent connection to stats. # Shared Mailboxes Dovecot supports mailbox sharing in a single backend setup: * [Public Shared](#public-shared-mailboxes): Shared mailboxes created by administrators. * [User Shared](#user-shared-mailboxes): Users sharing their mailboxes to other users. * [Symlinking](#mailbox-sharing-with-symlinks): Quick and dirty way of sharing a few mailboxes. Sharing mailboxes when running multiple backends requires [[link,dovecot_pro]]. See [Filesystem Permissions](#filesystem-permissions) for common filesystem related permission problems. Note that these permissions only make sense when using a shared filesystem to enable sharing between users. ## Public Shared Mailboxes Public mailboxes are typically mailboxes that are visible to all users or to large user groups. They are created by defining a public namespace, under which all the shared mailboxes are. See [[link,namespaces]] for details of how namespaces are configured. For example to create a public Maildir mailboxes, use: ```dovecot[dovecot.conf] # User's private mail location mail_driver = maildir mail_path = ~/Maildir # When creating any namespaces, you must also have a private namespace: namespace inbox { type = private separator = / prefix = # use global mail_path inbox = yes } namespace public { type = public separator = / prefix = Public/ mail_path = /var/mail/public subscriptions = no } ``` In the above example, you would then create Maildir mailboxes under the `/var/mail/public/` directory. Note that with [[link,maildir]] format Dovecot uses Maildir++ layout by default for folders, where the folder names must begin with a "." or Dovecot will ignore them. You can also optionally use the "fs" layout if you want the directory structure to look like: - `/var/mail/public/` (root dir) - `/var/mail/public/info/` (maildir folder) - `/var/mail/public/company/` (maildir folder) ### Per-user \\Seen Flag The recommended way to enable private flags for shared mailboxes is to create private indexes with [[setting,mail_index_private_path]]. This creates `dovecot.index.pvt[.log]` files, which contain only the message UIDs and the private flags. Currently the list of private flags is hardcoded only to the \\Seen flag. ```doveconf[dovecot.conf] namespace public { type = public separator = / prefix = Public/ mail_driver = maildir mail_path = /var/mail/public mail_index_private_path = ~/Maildir/public subscriptions = no } ``` ### Maildir: Keyword Sharing Make sure you don't try to use per-user [[setting,mail_control_path]] directory. Otherwise `dovecot-keywords` file doesn't get shared and keyword mapping breaks. ### Subscriptions Typically you want each user to have control over their own subscriptions for mailboxes in public namespaces. This is why you should set `subscriptions=no` to the namespace. Dovecot will then use the parent namespace's subscriptions file. If you don't otherwise have a namespace with empty prefix, create one: ```doveconf[dovecot.conf] namespace subscriptions { prefix = separator = / subscriptions = yes hidden = yes list = no alias_for = inbox # the INBOX namespace's name mailbox_subscriptions_filename = subscriptions-shared } ``` ### Read-Only Mailboxes #### mbox If you have a read-only directory structure containing mbox files, you'll need to store index files elsewhere: ```doveconf[dovecot.conf] namespace public { type = public prefix = Public/ mail_driver = mbox mail_path = /var/mail/public/ mail_index_path = /var/indexes/public subscriptions = no } ``` In the above example all the users would still be sharing the index files, so you might have problems with filesystem permissions. Alternatively you could place the index files under user's home directory. #### Maildir If your Maildir is read-only, the control and index files still need to be created somewhere. You can specify the path for these with the [[setting,mail_control_path]] and [[setting,mail_index_path]] settings. The path may point to a directory that is shared among all users, or to a per-user path. Note that if the Maildir has any keywords, the per-user control directory breaks the keywords since there is no `dovecot-keywords` file. When configuring multiple namespaces, the control/index path must be different for each namespace. Otherwise if namespaces have identically named mailboxes their control/index directories will conflict and cause all kinds of problems. If you put the control files to a per-user directory, you must also put the index files to a per-user directory, otherwise you'll get errors. It is however possible to use shared control files but per-user index files, assuming you've set up permissions properly. ```doveconf[dovecot.conf] namespace public { type = public separator = / prefix = Public/ mail_driver = maildir mail_path = /var/mail/public mail_control_path = ~/Maildir/public mail_index_path = ~/Maildir/public subscriptions = no } namespace public { type = public separator = / prefix = Team/ mail_driver = maildir mail_path = /var/mail/team mail_control_path = ~/Maildir/team mail_index_path = ~/Maildir/team subscriptions = no } ``` ### Example: Public mailboxes with ACLs See [[plugin,acl]] for more information about ACLs. ```doveconf[dovecot.conf] namespace public { type = public separator = . prefix = public. mail_driver = maildir mail_path = /var/mail/public subscriptions = no list = children } acl_driver = vfile ``` It's important that the namespace type is "public" regardless of whether you set the namespace prefix to "shared." or something else. After this you have to place `dovecot-acl` files in every mailbox/folder below `/var/mail/public` with rights for that folder (e.g. `user=someone lr`). [[setting,acl_sharing_map]] is not relevant for public mailboxes (only for shared). ## User Shared Mailboxes To enable mailbox sharing, you'll need to create a shared namespace. See [[plugin,acl]] for more information about ACL-specific settings. ```doveconf[dovecot.conf] # User's private mail location. mail_driver = maildir mail_path = ~/Maildir # When creating any namespaces, you must also have a private namespace: namespace inbox { type = private separator = / prefix = # use global mail_path inbox = yes } namespace shared { type = shared separator = / prefix = shared/$user/ mail_path = %{owner_home}/Maildir mail_index_private_path = ~/Maildir/shared/%{owner_user} # If users have direct filesystem level access to their mails, it's safer # to not share the index files between users: #mail_index_path = ~/Maildir/shared/%{owner_user} subscriptions = no list = children } mail_plugins { acl = yes } protocol imap { mail_plugins { imap_acl = yes } } acl_driver = vfile ``` This creates a `shared/` namespace under which each user's mailboxes are. If you have multiple domains and allow sharing between them, you might want to set [[setting,namespace_prefix,shared/$domain/$username/]] instead (although `$user` works just fine too). If you don't, you might want to drop the domain part and instead use [[setting,namespace_prefix,shared/$username/]]. [[changed,namespace_prefix_shared_variables_changed]] The shared namespaces now use `$user`, `$username` and `$domain` template variables, rather than the old `%%u`, `%%n` and `%%d`. [[setting,namespace_list,children]] specifies that if no one has shared mailboxes to the user, the "shared" directory isn't listed by the LIST command. If you wish it to be visible always, you can set [[setting,namespace_list,yes]]. The sharing user can be accessed with `%{owner_user}`, `%{owner_username}` and `%{owner_domain}` variables. The sharing user's home directory can also be looked up via [[link,userdb,User Databases]] using `%{owner_home}` variable. These can be used in [[link,mail_location]]. If the users' mailboxes can be found using a template, it's a bit more efficient to not use `%{owner_home}`. For example: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = /var/mail/%{owner_domain}/%{owner_username}/Maildir mail_index_private_path = ~/Maildir/shared/%{owner_user} ``` ### dbox With dbox, the index files are a very important part of the mailboxes. You must not try to change [[setting,mail_index_path]] to a user-specific location. This will only result in mailbox corruption. ([[setting,mail_index_private_path]] can be used though.) ### Shared Mailbox Listing With the above configuration it's possible to open shared mailboxes if you know their name, but they won't be visible in the mailbox list. This is because Dovecot has no way of knowing what users have shared mailboxes to whom. Iterating through all users and looking inside their mail directories would be horribly inefficient for more than a couple users. To overcome this problem Dovecot needs a dictionary, which contains the list of users who have shared mailboxes and to whom they have shared. If the users aren't properly listed in this dictionary, their shared mailboxes won't be visible. Currently there's no way to automatically rebuild this dictionary, so make sure it doesn't get lost. If it does, each user having shared mailboxes must use the IMAP SETACL command (see below) to get the dictionary updated for themselves. See [[setting,acl_sharing_map]] for plugin setting information. You could use any dictionary driver, including SQL or Cassandra, but a simple flat file should work pretty well too: ```doveconf[dovecot.conf] acl_sharing_map { dict file { path = /var/lib/dovecot/db/shared-mailboxes.db } } ``` The IMAP processes must be able to write to the `db/` directory. If you're using system users, you probably want to make it mode 0770 and group `sharedusers` and set `mail_access_groups=sharedusers` (or something similar). If you use multiple domains and don't wish users to share their mailboxes to users in other domains, you can use separate dict files for each domain: ```doveconf[dovecot.conf] acl_sharing_map { dict file { path = /var/mail/%{user | domain}/shared-mailboxes.db } } ``` #### Using SQL dictionary See [[link,dict]] for more information, especially about permission issues. ::: code-group ```doveconf[dovecot.conf] acl_sharing_map { dict proxy { name = acl } } acl_dict_index = yes dict_server { dict acl { driver = sql sql_driver = pgsql pgsql localhost { parameters { dbname = mails user = sqluser password = sqlpass } } dict_map shared/shared-boxes/user/$to/$from { sql_table = user_shares value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } dict_map shared/shared-user-boxes-rev/$from/$to { sql_table = user_shares value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } dict_map shared/shared-boxes/anyone/$from { sql_table = anyone_shares value_field dummy { } key_field from_user { value = $from } } } } ``` ```sql[Database Tables] CREATE TABLE user_shares ( from_user varchar(100) not null, to_user varchar(100) not null, dummy char(1) DEFAULT '1', -- always '1' currently primary key (from_user, to_user) ); COMMENT ON TABLE user_shares IS 'User from_user shares folders to user to_user.'; CREATE INDEX user_shares_from_user ON user_shares (from_user); -- because we search for from_user when rebuilding ACLs CREATE TABLE anyone_shares ( from_user varchar(100) not null, dummy char(1) DEFAULT '1', -- always '1' currently primary key (from_user) ); COMMENT ON TABLE anyone_shares IS 'User from_user shares folders to anyone.'; ``` ::: ### Mailbox Sharing You can use [[doveadm,acl]] to share mailboxes, or it can be done using IMAP SETACL command. It is the only way to update the shared mailbox list dictionary. Below is a quick introduction to IMAP ACL commands. See [[rfc,4314]] for more details. #### `MYRIGHTS ` Returns the user's current rights to the mailbox. #### `GETACL ` Returns the mailbox's all ACLs. #### `SETACL [+|-]` Give `` the specified rights to the mailbox. #### `DELETEACL [-]` Delete ``'s ACL from the mailbox. | `` | Description | | ------ | ----------- | | `anyone` | Matches all users, including anonymous users. | | `authenticated` | Like "anyone", but doesn't match anonymous users. | | `$group` | Matches all users belonging to the group ($ is not part of the group name). | | `$!group` | See `group-override` in [[plugin,acl]] (Dovecot-specific feature). | | `user` | Matches the given user. | The `$group` syntax is not a standard, but it is mentioned in [[rfc,4314]] examples and is also understood by at least Cyrus IMAP. Having '`-`' before the identifier specifies negative rights. See [[plugin,acl]] for list of ``. ### Sharing Mailboxes to Everyone See [[setting,imap_acl_allow_anyone]]. Note that you can also do this only for some users by using the second table "`anyone_shares`". Every user listed in this table shares his folders with everyone. See also [[link,userdb_extra_fields]]. ### IMAP ACL examples Let's begin with some simple example that first gives "read" and "lookup" rights, and later adds "write-seen" right: ``` 1 SETACL Work user@domain rl 1 OK Setacl complete. 2 SETACL Work user@domain +s 2 OK Setacl complete. 3 GETACL Work * ACL "Work" "user@domain" lrs "myself" lrwstipekxacd 3 OK Getacl completed. ``` Let's see how negative rights work by testing it on ourself. See how we initially have "lookup" right, but later we don't: ``` 1 MYRIGHTS Work * MYRIGHTS "Work" lrwstipekxacd 1 OK Myrights completed. 2 SETACL Work -myself l 2 OK Setacl complete. 3 GETACL Work * ACL "Work" "-myself" l "user@domain" lr "myself" lrwstipekxacd 3 OK Getacl completed. 4 myrights Work * MYRIGHTS "Work" rwstipekxacd 4 OK Myrights completed. ``` ### Troubleshooting - Make sure `$user` or `$username` is specified in the [[setting,namespace_prefix]] setting rather than the old `%%u` or `%%n`. - Make sure the [[setting,mail_path]] is set correctly in the namespace location. [[setting,log_debug,category=mail]] will help you see if Dovecot is trying to access correct paths. - [[doveadm,acl debug,-u user@domain shared/user/box]] can be helpful in figuring out why a mailbox can't be accessed. ## Mailbox Sharing with Symlinks It's possible to share mailboxes simply by symlinking them among user's private mailboxes. See [Filesystem Permissions](#filesystem-permissions) for issues related to filesystem permissions. ### Maildir ```sh ln -s /home/user2/Maildir/.Work /home/user1/Maildir/.shared.user2 ln -s /home/user3/Maildir/.Work /home/user1/Maildir/.shared.user3 ``` Now user1 has a "shared" directory containing "user2" and "user3" child mailboxes, which point to those users' "Work" mailbox. With Maildir++ layout it's not possible to automatically share "mailbox and its children". You'll need to symlink each mailbox separately. With the "fs" layout this is possible though. mbox ---- Doing the same as in the above Maildir example: ```sh mkdir /home/user1/mail/shared ln -s /home/user2/mail/Work /home/user1/mail/shared/user2 ln -s /home/user3/mail/Work /home/user1/mail/shared/user3 ``` One additional problem with mbox format is the creation of dotlock files. The dotlocks would be created under user1's directory, which makes them useless. Make sure the locking works properly with only fcntl or flock locking (See [[link,mbox_locking]]) and just disable dotlocks. Alternatively instead of symlinking an mbox file, put the shared mailboxes inside a directory and symlink the entire directory. ## Filesystem Permissions IMAP processes need filesystem level permissions to access shared/public mailboxes. This means that: - If you use more than one [[link,system_users_used_by_dovecot,UNIX UID]] for your mail users (e.g. you use system users), you'll need to make sure that all users can access the mailboxes on filesystem level. ([[plugin,acl]] won't help you with this.) - You can remove write permissions on purpose from public namespace root directory to prevent users from creating new mailboxes under it. Dovecot never modifies permissions for existing mail files or directories. When users share mailboxes between each others, the system must have been set up in a way that filesystem permissions don't get in the way. The easiest way to do that is to use only a single UID. Another possibility would be to use one or more groups for all the mail files that may be shared to other users belonging to the same group. For example if you host multiple domains, you might create a group for each domain and allow mailbox sharing (only) between users in the same domain. ### System User UNIX Groups There's no requirement to use UNIX groups (i.e. typically defined in `/etc/group`) for anything. If you don't care about them, you can safely ignore this section. If you use [[link,auth_passwd]], the IMAP process has access to all the UNIX groups defined for that user. You may use these groups when granting filesystem permissions. If you wish to use UNIX groups defined in `/etc/group` but don't use passwd userdb, you can still do this by returning `system_groups_user` [[link,userdb_extra_fields]], which contains the UNIX user name whose groups are read from the group file. You can also set up extra UNIX groups by listing them in [[setting,mail_access_groups]]. To have per-user UNIX groups, return `mail_access_groups` as userdb extra field. The advantage of using this method is that only Dovecot mail processes have access to the group, but nothing else, such as user's SSH session. For example, a simple way to set up shared mailbox access for all' system users is to make all mail dirs/files 0770/0660 mode and owned by group "sharedmail" and then set [[setting,mail_access_groups,sharedmail]]. Using more fine-grained groups of course leaks less mail data in case there's a security hole in Dovecot. ### Permissions For New Mailboxes When creating a new mailbox, Dovecot copies the permissions from the mailbox root directory. For example, with [[link,mbox]] if you have directories: ``` drwx--xr-x 8 user group 4096 2009-02-21 18:31 /home/user/mail/ drwxrwxrwx 2 user group 4096 2009-02-21 18:32 /home/user/mail/foo/ ``` When creating a new foo/bar/ directory, Dovecot gives it permissions: ``` drwx--xr-x 2 user group 4096 2009-02-21 18:33 /home/user/mail/foo/bar/ ``` As you can see, the file mode was copied from mail/ directory, not mail/foo/. The group is also preserved. If this causes problems (e.g. different users having different groups create mailboxes, causing permission denied errors when trying to preserve the group) you can set the setgid bit for the root directory: ```sh chmod g+s /home/user/mail ``` This will cause the group to be automatically copied by the OS for all created files/directories under it, even if the user doesn't belong to the group. ### Permissions For New Files in Mailboxes When creating new files inside a mailbox, Dovecot copies the read/write permissions from the mailbox's directory. For example if you have: ``` drwx--xr-x 5 user group 4096 2009-02-21 18:53 /home/user/Maildir/.foo/ ``` Dovecot creates files under it with modes: ``` drwx--xr-x 2 user group 4096 2009-02-21 18:54 cur/ drwx--xr-x 2 user group 4096 2009-02-21 18:54 new/ drwx--xr-x 2 user group 4096 2009-02-21 18:54 tmp/ -rw----r-- 1 user group 156 2009-02-21 18:54 dovecot.index.log -rw----r-- 1 user group 17 2009-02-21 18:54 dovecot-uidlist ``` Note how the g+x gets copied to directories, but for files it's simply ignored. The group is copied the same way as explained in the previous section. When mails are copied between Maildirs, it's usually done by hard linking. If the source and destination directory permissions are different, Dovecot create a new file and copies data the slow way so that it can assign the wanted destination permissions. The source and destination permission lookups are done only by looking at the mailbox root directories' permissions, not individual mail files. This may become a problem if the mail files' permissions aren't as Dovecot expects. ### Permissions to New /domain/user Directories If each user has different UIDs and you have `/var/mail/domain/user/` style directories, you run into a bit of trouble. The problem is that the first user who creates `/var/mail/domain/` will create it as 0700 mode, and other users can't create their own user/ directories under it anymore. The solution is to use a common group for the users and set `/var/mail/` directory's permissions properly (group-suid is required): ```sh chgrp dovemail /var/mail chmod 02770 /var/mail # or perhaps 03770 for extra security ``` and in `dovecot.conf`: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = /var/vmail/%{user | domain}/%{user | username}/Maildir mail_access_groups = dovemail ``` The end result should look like this: ``` drwxrwsr-x 3 user dovemail 60 Oct 24 12:04 domain.example.com/ drwx--S--- 3 user user 60 Oct 24 12:04 domain.example.com/user/ ``` Note that this requires that the [[setting,mail_path]] setting is in its explicit format with [[link,settings_variables,%variables]]. Using `~/Maildir` won't work, because Dovecot can't really know how far down it should copy the permissions from. ### Permissions to New User Home Directories When [[setting,mail_path]] begins with `%{home}` or `~/`, its permissions are copied from the first existing parent directory if it has setgid-bit set. This isn't done when the path contains any other [[link,settings_variables,%variables]]. ### Mail Delivery Agent Permissions When using [[link,lda]], it uses all the same configuration files as IMAP/POP3, so you don't need to worry about it. When using an external [[link,mda]] to deliver to a shared mailbox, you need to make sure that the resulting files have proper permissions. For example with Procmail + Maildir, set `UMASK=007` in `.procmailrc` to make the delivered mail files group-readable. To get the file to use the proper group, set the group to the Maildir's `tmp/` directory and also set its setgid bit (`chmod g+s`). ### Dictionary Files Created dictionary files (e.g. `acl_sharing_map { dict file { ... } }`) also base their initial permissions on parent directory's permissions. After the initial creation, the permissions are permanently preserved. So if you want to use different permissions, just chown/chmod the file. # Sieve: Duplicate Extension The duplicate extension ([[rfc,7352]]) adds a new test command called `duplicate` to the Sieve language. This test adds the ability to detect duplications. The main application for this new test is handling duplicate deliveries commonly caused by mailing list subscriptions or redirected mail addresses. The detection is normally performed by matching the message ID to an internal list of message IDs from previously delivered messages. For more complex applications, the `duplicate` test can also use the content of a specific header field or other parts of the message. ::: warning [[changed,sieve_vnd_duplicate]] `vnd.dovecot.duplicate` extension has been removed in favor of this. ::: ## Configuration The duplicate extension is available by default. ### Settings ### Example ```doveconf[dovecot.conf] sieve_script personal { path = ~/.dovecot.sieve } sieve_duplicate_default_period = 1h sieve_duplicate_max_period = 1d ``` # Sieve: Editheader Extension The editheader extension ([[rfc,5293]]) enables Sieve scripts to delete and add message header fields, thereby allowing interaction with other components that consume or produce header fields. ## Configuration The editheader extension is not available by default and needs to be enabled explicitly by adding it to [[setting,sieve_extensions]]. ### Settings ### Example ```doveconf[dovecot.conf] # Use editheader sieve_extensions { editheader = yes } # Header fields must not exceed one kilobyte sieve_editheader_max_header_size = 1k # Protected special headers sieve_editheader_header X-Verified { forbid_add = yes forbid_delete = yes } sieve_editheader_header X-Seen { forbid_delete = yes } ``` # Sieve: Extension for Notifications The Sieve enotify extension ([[rfc,5435]]) adds the `notify` action to the Sieve language. ## Configuration ### Settings ### Examples #### Send Notifications with Different Importance Levels ``` require ["enotify", "fileinto", "variables"]; if header :contains "from" "boss@example.org" { notify :importance "1" :message "This is probably very important" "mailto:alm@example.com"; # Don't send any further notifications stop; } if header :contains "to" "sievemailinglist@example.org" { # :matches is used to get the value of the Subject header if header :matches "Subject" "*" { set "subject" "${1}"; } # :matches is used to get the value of the From header if header :matches "From" "*" { set "from" "${1}"; } notify :importance "3" :message "[SIEVE] ${from}: ${subject}" "mailto:alm@example.com"; fileinto "INBOX.sieve"; } ``` #### Send Notification if we Receive Mail From Domain ``` require ["enotify", "fileinto", "variables", "envelope"]; if header :matches "from" "*@*.example.org" { # :matches is used to get the MAIL FROM address if envelope :all :matches "from" "*" { set "env_from" " [really: ${1}]"; } # :matches is used to get the value of the Subject header if header :matches "Subject" "*" { set "subject" "${1}"; } # :matches is used to get the address from the From header if address :matches :all "from" "*" { set "from_addr" "${1}"; } notify :message "${from_addr}${env_from}: ${subject}" "mailto:alm@example.com"; } ``` # Sieve: Extlists Extension The extlists extension ([[rfc,6134]]) enables Sieve scripts to check membership of a value in an external list or for redirecting messages to an external list of recipients. An "external list" is a list whose members are stored externally to the Sieve script. This extension adds a new ":list" match type to apply to supported tests and it can be be used to implement email whitelisting, blacklisting, addressbook lookups, and other sorts of list matching. For Dovecot, the external list is always implemented using a dict lookup. Redirecting messages to a list of recipients as described in the standard ([[rfc,6134]]) is currently not implemented in Dovecot and will always trigger an error if used. ## Configuration The extlists extension is not available by default and needs to be enabled explicitly by adding it to [[setting,sieve_extensions]]. ### Settings ### Example ```doveconf[dovecot.conf] # Use extlists sieve_extensions { extlists = yes } # No value looked up from a list may exceed 512 bytes, or it will forcibly not # match sieve_extlists_list_max_lookup_size = 512 # The default addressbook stored in a proxied dict sieve_extlists_list :addrbook:default { dict proxy { name = addressbook } } sieve_extlists_list tag:example.com,2025-02-26:BadFileExts { dict proxy { name = bad_file_extensions } # Limit lookups to 10 bytes max_lookup_size = 10B } ``` ## Sieve Example The following example excludes senders listed in the user's default address book from Spam filtering. The example demonstrates the use of the [[link,sieve_spamtest,spamtest extension]] as well. ``` require ["envelope", "extlists", "fileinto", "spamtest", "relational", "comparator-i;ascii-numeric"]; if allof( not envelope :list "from" ":addrbook:default", spamtest :value "ge" :comparator "i;ascii-numeric" "3" ) { fileinto "spam"; } ``` # Sieve: Include Extension The Sieve include extension ([[rfc,6609]]) permits users to include one Sieve script into another. This can make managing large scripts or multiple sets of scripts much easier, and allows a site and its users to build up libraries of scripts. Users are able to include their own personal scripts or site-wide scripts. Included scripts can include more scripts of their own, yielding a tree of included scripts with the main script (typically the user's personal script) at its root. ## Configuration The include extension is available by default. ### Settings # Sieve: Spamtest and Virustest Extensions Using the spamtest and virustest extensions ([[rfc,5235]]), the Sieve language provides a uniform and standardized command interface for evaluating spam and virus tests performed on the message. Users no longer need to know what headers need to be checked and how the scanner's verdict is represented in the header field value. They only need to know how to use the spamtest (spamtestplus) and virustest extensions. This also gives GUI-based Sieve editors the means to provide a portable and easy to install interface for spam and virus filter configuration. The burden of specifying which headers need to be checked and how the scanner output is represented falls onto the Sieve administrator. ## Configuration The spamtest, spamtestplus, and virustest extensions are not enabled by default and thus need to be enabled explicitly using [[setting,sieve_extensions]]. ### Settings: Spamtest ### Settings: Virustest ### Examples This section shows several configuration examples. Each example shows a specimen of valid virus/spam test headers that the given configuration will work on. ::: code-group ```[Spam Header] X-Spam-Score: No, score=-3.2 ``` ```doveconf[dovecot.conf] sieve_extensions { spamtest = yes spamtestplus = yes } sieve_spamtest_status_type = score sieve_spamtest_status_header = \ X-Spam-Score: [[:alnum:]]+, score=(-?[[:digit:]]+\.[[:digit:]]) sieve_spamtest_score_max_value = 5.0 ``` ::: ::: code-group ```[Spam Header] X-Spam-Status: Yes ``` ```doveconf[dovecot.conf] sieve_extensions { spamtest = yes spamtestplus = yes } sieve_spamtest_status_type = text sieve_spamtest_status_header = X-Spam-Status sieve_spamtest_text_value { 1 = No 10 = Yes } ``` ::: ::: code-group ```[Spam Header] X-Spam-Score: sssssss ``` ```doveconf[dovecot.conf] sieve_extensions { spamtest = yes spamtestplus = yes } sieve_spamtest_status_header = X-Spam-Score sieve_spamtest_status_type = strlen sieve_spamtest_score_max_value = 5 ``` ::: code-group ```[Spam Header] X-Spam-Score: status=3.2 required=5.0 ``` ```[Virus Header] X-Virus-Scan: Found to be clean. ``` ```doveconf[dovecot.conf] sieve_extensions { spamtest = yes spamtestplus = yes virustest = yes } sieve_spamtest_status_type = score sieve_spamtest_status_header = \ X-Spam-Score: score=(-?[[:digit:]]+\.[[:digit:]]).* sieve_spamtest_score_max_header = \ X-Spam-Score: score=-?[[:digit:]]+\.[[:digit:]] required=([[:digit:]]+\.[[:digit:]]) sieve_virustest_status_type = text sieve_virustest_status_header = X-Virus-Scan: Found to be (.+)\. sieve_virustest_text_value { 1 = clean 5 = infected } ``` ::: # Sieve: Vacation Extension The Sieve vacation extension ([[rfc,5230]]) defines a mechanism to generate automatic replies to incoming email messages. It takes various precautions to make sure replies are only sent when appropriate. Script authors can specify how often replies can be sent to a particular contact. In the original vacation extension, this interval is specified in days with a minimum of one day. When more granularity is necessary and particularly when replies must be sent more frequently than one day, the vacation-seconds extension ([[rfc,6131]]) can be used. This allows specifying the minimum reply interval in seconds with a minimum of zero (a reply is then always sent), depending on administrator configuration. ## Configuration The vacation extension is available by default. In contrast, the vacation-seconds extension - which implies the vacation extension when used - is not available by default and needs to be enabled explicitly by adding it to [[setting,sieve_extensions]]. The configuration also needs to be adjusted accordingly to allow a non-reply period of less than a day. ### Settings ### Auto-Reply The vacation extension uses envelope sender and envelope recipient. They're taken from: - **Envelope sender**: `-f` parameter to dovecot-lda if given, otherwise `Return-Path:` header in the message. - **Envelope recipient**: `-a` parameter to dovecot-lda if given, otherwise `-d` parameter to dovecot-lda. If neither is given (delivering to system users), the `$USER` environment is used. The vacation replies are sent to the envelope sender. List of autoreplied senders is stored in `.dovecot.lda-dupes` file in user's home directory. When you're testing the vacation feature, it's easy to forget that the reply is sent only once in the number of configured days. If you have problems getting the vacation reply, try deleting this file. If that didn't help, make sure the problem isn't related to sending mails in general by trying the "reject" Sieve command. The automatic replies aren't sent if any of the following is true: - The envelope sender is not available (equal to <>) - The envelope sender and envelope recipient are the same - The sender recently (within `:days` days; default `7`) got a reply from the same vacation command - The message contains at least one of the mailing list headers `list-id`, `list-owner`, `list-subscribe`, `list-post`, `list-unsubscribe`, `list-help`, or `list-archive` - Auto-Submitted: header exists with any value except `no` - Precedence: header exists with value `junk`, `bulk`, or `list` - The envelope sender is considered a system address, which either: - begins with `MAILER-DAEMON` (case-insensitive), - begins with `LISTSERV` (case-insensitive), - begins with `majordomo` (case-insensitive), - contains the string `-request` anywhere within it (case-sensitive), or - begins with `owner-` (case-sensitive) - The envelope recipient and alternative addresses specified with the vacation command's `:addresses` tag are not found in the message's `To:`, `Cc:`, `Bcc:`, `Resent-To:`, `Resent-Cc:`, or `Resent-Bcc:` fields. ### Example ```doveconf[dovecot.conf] # Use vacation-seconds sieve_extensions { vacation-seconds = yes } # One hour at minimum sieve_vacation_min_period = 1h # Ten days default sieve_vacation_default_period = 10d # Thirty days at maximum sieve_vacation_max_period = 30d ``` # Sieve: Variables Extension The Sieve variables extension ([[rfc,5229]]) adds the concept of variables to the Sieve language. ## Configuration The variables extension is available by default. ### Settings # ManageSieve Server The ManageSieve ([[rfc,5804]]) service is used to manage a user's [[link,sieve]] script collection. It has the following advantages over doing it directly via filesystem: * No need to let users log in via FTP/SFTP/etc, which could be difficult especially with virtual users. * ManageSieve is a standard protocol ([[rfc,5804]]), so users can manage their scripts using (hopefully) user-friendly ManageSieve clients. Many webmails already include a ManageSieve client. * Scripts are compiled before they are installed, which guarantees that the uploaded script is valid. This prevents a user from inadvertently installing a broken Sieve script. ## Configuration ::: warning If you have used the Sieve plugin before and you have `.dovecot.sieve` files in user directories, you are advised to **make a backup first**. Although the ManageSieve daemon takes care to move these files to the Sieve storage before it is substituted with a symbolic link, this is not a very well tested operation, meaning that there is a possibility that existing Sieve scripts get lost. ::: The ManageSieve configuration consists of ManageSieve protocol settings and [[link,sieve]]-related settings. The Sieve interpreter settings are shared with settings of the [[link,sieve]], for Dovecot's [[link,lda]] and [[link,lmtp]]. First, the ManageSieve protocol settings are outlined and then the relevant Sieve settings are described. ### Protocol Configuration Along with all other binaries that Dovecot uses, the `managesieve` and `managesieve-login` binaries are installed during `make install` of [[link,sieve_installation]]. The only thing you need to do to activate the ManageSieve protocol support in Dovecot is to add `sieve` to the [[link,service_protocol]]. The managesieve daemon will listen on port 4190 by default. ### Settings As the implementation of the managesieve daemon is largely based on the original IMAP implementation, it is very similar in terms of configuration. In addition to most mail daemon config settings, the managesieve daemon accepts a few more. The following settings can be configured in the `protocol sieve` section: ### Sieve Interpreter Configuration The part of the [[link,sieve]] configuration that is relevant for ManageSieve mainly consists of the configuration of the [[link,sieve_storage_type_personal,personal]] Sieve script storage type. Currently, only the [[link,sieve_storage_file,file driver]] Sieve script storage driver supports the management functions needed by Managesieve. For ManageSieve, the configuration of [[setting,sieve_script_active_path]] is required. ### Quota Support By default, users can manage an unlimited number of Sieve scripts on the server through ManageSieve. However, ManageSieve can be configured to enforce limits on the number of personal Sieve scripts per user and/or the amount of disk storage used by these scripts. The maximum size of individual uploaded scripts is dictated by the configuration of the [[link,sieve]]. The limits are configured in the `plugin` section of the Dovecot configuration: ### Examples The following provides example configurations for ManageSieve in `dovecot.conf`. Only sections relevant to ManageSieve and the Sieve plugin are shown. ```doveconf[dovecot.conf] ... service managesieve-login { #inet_listener sieve { # port = 4190 #} #inet_listener sieve_deprecated { # port = 2000 #} # Number of connections to handle before starting a new process. Typically # the only useful values are "unlimited" or 1. 1 is more secure, but # "unlimited" is faster. #restart_request_count = 1 # Number of processes to always keep waiting for more connections. #process_min_avail = 0 } service managesieve { # Max. number of ManageSieve processes (connections) #process_limit = 1024 } # Service configuration protocol sieve { # Maximum ManageSieve command line length in bytes. ManageSieve usually does # not involve overly long command lines, so this setting will not normally # need adjustment #managesieve_max_line_length = 65536 # Maximum number of ManageSieve connections allowed for a user from each # IP address. # NOTE: The username is compared case-sensitively. #mail_max_userip_connections = 10 # List of plugins to load (none known to be useful so far). # Do NOT try to load IMAP plugins here. #mail_plugins { #} # MANAGESIEVE logout format string: # %i - total number of bytes read from client # %o - total number of bytes sent to client #managesieve_logout_format = bytes=%i/%o # To fool ManageSieve clients that are focused on CMU's timesieved you can # specify the IMPLEMENTATION capability that the dovecot reports to clients. # For example: 'Cyrus timsieved v2.2.13' #managesieve_implementation_string = Dovecot Pigeonhole # Explicitly specify the SIEVE and NOTIFY capability reported by the server # before login. If left unassigned these will be reported dynamically # according to what the Sieve interpreter supports by default (after login # this may differ depending on the user). #managesieve_sieve_capability = #managesieve_notify_capability = # The maximum number of compile errors that are returned to the client # upon script upload or script verification. #managesieve_max_compile_errors = 5 } # Used by both the Sieve plugin and the ManageSieve protocol sieve_script personal { path = ~/sieve active_path = ~/.dovecot.sieve } ``` ### Proxy Like Dovecot's imap server, the ManageSieve login daemon supports proxying to multiple backend servers. The [[link,authentication_proxies]] page for POP3 and IMAP applies automatically to ManageSieve as well. ## Troubleshooting Like Dovecot itself, **the ManageSieve service always logs a detailed error message** if something goes wrong at the server (refer to [[link,logging]] for more details): the logs are the first place to look if you suspect something is wrong. To get additional debug messages in your log file, you should set [[setting,log_debug,category=sieve]] in `dovecot.conf` (inside `protocol sieve {...}` if you want to enable this for ManageSieve only). If the client commits protocol violations or sends invalid scripts, an error response is provided to the client which is not necessarily logged on the server. A good ManageSieve client presents such error messages to the user. Keep in mind that the ManageSieve service only provides the Sieve *protocol*, which may be somewhat confusing. This protocol can only be used to *upload* Sieve scripts and *activate* them for execution. Performing the steps below therefore only verifies that this functionality is working and **not** whether Sieve scripts are correctly being executed upon delivery. The execution of Sieve scripts is performed by the [[link,lda]] or [[link,lmtp]] using the [[plugin,sieve]]. If you have problems with Sieve script execution upon delivery, see [[link,sieve_troubleshooting]]. ### Manual Login and Script Upload If you fail to login or upload scripts to the server, it is not necessarily caused by Dovecot or your configuration. It is often best to test your ManageSieve server manually first. This also provides you with the direct error messages from the server without intermission of your client. If you do not use TLS, you can connect using a simple `telnet` or `netcat` connection to the configured port (typically 4190 or 2000 for older setups). Otherwise you must use a TLS-capable text protocol client like `gnutls-cli` as described below. Upon connection, the server presents the initial greeting with its capabilities: ``` "IMPLEMENTATION" "dovecot" "SASL" "PLAIN" "SIEVE" "comparator-i;ascii-numeric fileinto reject vacation imapflags notify include envelope body relational regex subaddress copy" "STARTTLS" OK "Dovecot ready." ``` Note that the reported `STARTTLS` capability means that the server accepts TLS, but, since you are using telnet/netcat, you cannot use this (refer to Manual TLS Login below). The `SASL` capability lists the available SASL authentication mechanisms. If this list is empty and `STARTTLS` is available, it probably means that the server forces you to initiate TLS first (as dictated by [[setting,auth_allow_cleartext,yes]] in `dovecot.conf`). Now you need to log in. Although potentially multiple SASL mechanisms are available, only `PLAIN` is described here. Authentication is performed using the ManageSieve `AUTHENTICATE` command. This command typically looks as follows when the `PLAIN` mechanism is used: ``` AUTHENTICATE "PLAIN" "" ``` The credentials are the base64-encoded version of the string `"\0\0 ``` The command is written to stdout and you can paste this to your protocol session, e.g.: ``` AUTHENTICATE "PLAIN" "" OK "Logged in." ``` Now that you are logged in, you can upload a script. This is done using the `PUTSCRIPT` command. Its first argument is the name for the script and its second argument is a string literal. A string literal starts with a length specification `'{+}'` followed by a newline. Thereafter the server expects `` bytes of script data. The following uploads a trivial 6 byte long sieve script that keeps every message (6th byte is the newline character): ``` PUTSCRIPT "example" {6+} keep; OK "Putscript completed." ``` Upon successful upload, you should find a file called `example.sieve` in your sieve directory. The script should also be listed by the server as follows when the `LISTSCRIPTS` command is issued: ``` LISTSCRIPTS "example" OK "Listscripts completed." ``` You can check whether your script is uploaded correctly by downloading it using the `GETSCRIPT` command. This command accepts the name of the downloaded script as its only parameter: ``` GETSCRIPT "example" {6} keep; OK "Getscript completed." ``` To let the Sieve plugin use your newly uploaded script, you must activate it using the `SETACTIVE` command (only one script can be active at any time). The active script is indicated `ACTIVE` in the `LISTSCRIPTS` output, e.g.: ``` SETACTIVE "example" OK "Setactive completed." LISTSCRIPTS "example" ACTIVE OK "Listscripts completed. ``` The symbolic link configured with the `sieve` setting should now point to the activated script in the sieve directory. If no script is active, this symbolic link is absent. #### Manual TLS Login ---------------- When TLS needs to be used during manual testing, `gnutls-cli` provides the means to do so. This command-line utility is part of the GNUTLS distribution and on most systems this should be easy to install. It is used to connect to ManageSieve as follows: ```sh gnutls-cli --starttls -p ``` This starts the client in plain text mode first. As shown in the previous section, the server presents a greeting with all capabilities of the server. If `STARTTLS` is listed, you can issue the `STARTTLS` command as follows: ``` STARTTLS OK "Begin TLS negotiation now." ``` If an OK response is given by the server you can press `Ctrl-D` to make `gnutls-cli` start the TLS negotiation. Upon pressing `Ctrl-D`, `gnutls-cli` will show information on the negotiated TLS session and finally the first response of the server is shown: ``` "IMPLEMENTATION" "dovecot" "SASL" "PLAIN" "SIEVE" "comparator-i;ascii-numeric fileinto reject vacation imapflags notify include envelope body relational regex subaddress copy" OK "TLS negotiation successful." ``` Hereafter, you can continue to authenticate and upload a script as described in the previous section. ### Client Problems See [[link,rawlog]] for details how to log client-server traffic. Refer to the [client issues](#client-issues) for information on known client problems. ### Known Server Issues and Protocol Deviations - The ANONYMOUS authentication mechanism is currently not supported and explicitly denied. ## Client Issues Although this ManageSieve server should comply with the RFC specification of the ManageSieve protocol, quite a few clients don't. This page lists the known client problems. ### The TLS problem The core of the TLS problem is that a ManageSieve server is required to send an unsolicited CAPABILITY response right after successful TLS negotiation. Older Cyrus servers did not do this and many clients incorporated this protocol error as the standard, meaning that these do not expect the CAPABILITY response and thus fail with subsequent commands. However, now that Cyrus' Timsieved has changed its behaviour towards protocol compliance, all those clients will follow eventually. ### Smartsieve, Websieve These clients are specifically written for Cyrus timsieved and fail on multiple stages of the protocol when connected to Pigeonhole ManageSieve. See: - https://sourceforge.net/projects/websieve/ - https://github.com/secnextechnologies/WebSieve - https://smartsieve.sourceforge.net/ ### Ruby/Managesieve Ruby command line client and library to managesieve works fine. See https://rubygems.org/gems/ruby-managesieve/versions/0.4.0 ### Ruby/Sieve-Parser Ruby library for sieve parsing, see https://rubygems.org/gems/sieve-parser/versions/0.0.4. # Sieve [Sieve](http://sieve.info/) support for Dovecot is provided by Pigeonhole, which allows users to filter incoming messages by writing scripts specified in the Sieve language ([[rfc,5228]]). Sieve support is provided as a plugin for Dovecot's [[link,lda]] and [[link,lmtp]] services. The plugin implements a Sieve interpreter, which filters incoming messages using a script specified in the Sieve language. The Sieve script is provided by the user and, using that Sieve script, the user can customize how incoming messages are handled. Messages can be delivered to specific folders, forwarded, rejected, discarded, etc. ## Supported Features The Sieve language has various extensions. You can find more information about the extensions from the Sieve Mail Filtering Language Charter or the [Sieve.info wiki page](http://sieve.info/). ::: info Standard Sieve does not support running external programs. However, Dovecot provides non-standard extensions that provide limited support for doing that. ::: ### Extensions The interpreter recognizes the following Sieve extensions: | Extension | Default Enabled | Purpose | | --------- | --------------- | ------- | | `body` ([[rfc,5173]]) | **yes** | Allows evaluating the body of a message | | `copy` ([[rfc,3894]]) | **yes** | Allows storing and forwarding messages without canceling the implicit keep | | `date` ([[rfc,5260,4]]) | **yes** | Adds the ability to test date and time values in various ways | | [[link,sieve_duplicate,duplicate]] ([[rfc,7352]]) | **yes** | Allows detecting duplicate message deliveries | | [[link,sieve_editheader,editheader]] ([[rfc,5293]]) | no | Adds the ability to add and remove message header fields | | `encoded-character` ([[rfc,5228,2.4.2.4]]) | **yes** | Allows encoding special characters numerically | | [[link,sieve_enotify,enotify]] ([[rfc,5435]]) | **yes** | Provides the ability to send notifications by various means (currently only mailto) | | `envelope` ([[rfc,5228,5.4]]) | **yes** | Allows evaluating envelope parts, i.e. sender and recipient | | `environment` ([[rfc,5183]]) | **yes** | Allows testing against various labeled values from the execution environment | | [[link,sieve_extlists,extlists]] ([[rfc,6134]]) | no | Allows looking up and matching values from external lists (dict lookup) | | `extracttext` ([[rfc,5703,7]]) | **yes** | Allows extracting text from individual message MIME parts | | `fileinto` ([[rfc,5228,4.1]]) | **yes** | Allows storing messages in folders other than INBOX | | `foreverypart` ([[rfc,5703,3]]) | **yes** | Allows iterating through the message's MIME parts | | `ihave` ([[rfc,5463]]) | **yes** | Adds the ability to test for support of Sieve extensions and dynamically invoke their use | | `imap4flags` ([[rfc,5232]]) | **yes** | Allows adding IMAP flags to stored messages | | `imapsieve` ([[rfc,6785]]) | no ([[plugin,imap-sieve]]) | Provides access to special environment items when executing at IMAP events | | [[link,sieve_include,include]] ([[rfc,6609]]) | **yes** | Allows including other Sieve scripts | | `index` ([[rfc,5260,6]])) | **yes** | Allows matching specific header field instances by index | | `mailbox` ([[rfc,5490,3]]) | **yes** | Provides a mailbox existence check and allows creating mailboxes upon fileinto | | `mboxmetadata` ([[rfc,5490]]) | no | Provides access to mailbox METADATA entries | | `mime` ([[rfc,5703,4]]) | **yes** | Allows testing parts of structured MIME header fields | | `regex` ([Draft](https://tools.ietf.org/html/draft-murchison-sieve-regex-08)) | **yes** | Provides regular expression match support | | `reject` ([[rfc,5429,2.2]]) | **yes** | Allows rejecting messages with a rejection bounce message | | `relational` ([[rfc,5231]]) | **yes** | Provides relational match support | | `servermetadata` ([[rfc,5490]]) | no | Provides access to server METADATA entries | | [[link,sieve_spamtest,spamtest]] ([[rfc,5235]]) | no | Implements a uniform way to test against headers added by spam filters | | `subaddress` ([[rfc,5233]]) | **yes** | Allows testing against delimited elements of the local part of addresses | | [[link,sieve_vacation,vacation]] ([[rfc,5230]]) | **yes** | Provides auto-responder functionality, e.g. for when the user is on vacation | | [[link,sieve_vacation,vacation-seconds]] ([[rfc,6131]]) | no | Extends vacation extension with the ability to send vacation responses with intervals of seconds rather than days | | [[link,sieve_variables,variables]] ([[rfc,5229]]) | yes | Adds variables support to the language | | [[link,sieve_virustest,virustest]] ([[rfc,5235]]) | no | Implements a uniform way to test against headers added by virus scanners | ### Extensions (Dovecot) The interpreter recognizes the following Dovecot-specific Sieve extensions: | Extension | Default Enabled | Purpose | | --------- | --------------- | ------- | | [`vnd.dovecot.debug`](https://raw.githubusercontent.com/dovecot/pigeonhole/main/doc/rfc/spec-bosch-sieve-debug.txt) | no | Allows logging debug messages | | [`vnd.dovecot.environment`](https://raw.githubusercontent.com/dovecot/pigeonhole/main/doc/rfc/spec-bosch-sieve-dovecot-environment.txt) | no | Extends the standard "environment" extension with extra items and a variables namespace for direct access | | [`vnd.dovecot.execute`](https://raw.githubusercontent.com/dovecot/pigeonhole/main/doc/rfc/spec-bosch-sieve-extprograms.txt) | no ([[plugin,sieve-extprograms]]) | Implements executing a pre-defined set of external programs with the option to process string data through the external program | | [`vnd.dovecot.filter`](https://raw.githubusercontent.com/dovecot/pigeonhole/main/doc/rfc/spec-bosch-sieve-extprograms.txt) | no ([[plugin,sieve-extprograms]]) | Implements filtering messages through a pre-defined set of external programs | | [`vnd.dovecot.pipe`](https://raw.githubusercontent.com/dovecot/pigeonhole/main/doc/rfc/spec-bosch-sieve-extprograms.txt) | no ([[plugin,sieve-extprograms]]) | Implements piping messages to a pre-defined set of external programs | | [`vnd.dovecot.report`](https://raw.githubusercontent.com/dovecot/pigeonhole/main/doc/rfc/spec-bosch-sieve-report.txt) | no | Implements sending Messaging Abuse Reporting Format (MARF) reports ([[rfc,5965]]) | ### Obsolete Extensions ::: warning These extensions are obsolete and have been removed. ::: | Extension | Status | Purpose | | --------- | ------ | ------- | | `imapflags` ([obsolete draft](https://tools.ietf.org/html/draft-melnikov-sieve-imapflags-03)) | [[removed,sieve_ext_imapflags]] | Old version of imap4flags (for backwards compatibility with CMU Sieve) | | `notify` ([obsolete draft](https://tools.ietf.org/html/draft-martin-sieve-notify-01)) | [[removed,sieve_ext_notify]] | Old version of enotify (for backwards compatibility with CMU Sieve) | ## Configuration Basic configuration of the Sieve plugin can be found at [[plugin,sieve]]. ## ManageSieve Server To give users the ability to upload their own Sieve scripts to your server, i.e. without the need for shell or FTP access, you can use the ManageSieve protocol. Dovecot provides a [[link,managesieve]] service to provide this protocol. ## Mailbox Names ### UTF7 vs. UTF8 Sieve uses UTF8 encoding for mailbox names, while IMAP uses modified UTF7. This means that non-ASCII characters contained in mailbox names are represented differently between IMAP and Sieve scripts. See [[link,sieve_troubleshooting]]. ### Separators and Prefixes Regarding separators, you need to specify mailbox names in Sieve scripts the same way as IMAP clients see them. For example if you want to deliver mail to the "Customers" mailbox which exists under "Work" mailbox: ### Maildir Default Namespace with [[setting,namespace_prefix,""]], [[setting,namespace_separator,.]]: ``` require "fileinto"; fileinto "Work.Customers"; ``` ### Courier Migration Namespace with [[setting,namespace_prefix,INBOX.]], [[setting,namespace_separator,.]]: ``` require "fileinto"; fileinto "INBOX.Work.Customers"; ``` ### mbox, dbox Default Namespace with [[setting,namespace_prefix,""]], [[setting,namespace_separator,/]]: ``` require "fileinto"; fileinto "Work/Customers"; ``` ## Manually Compiling Sieve Scripts When the Sieve plugin executes a script for the first time (or after it has been changed), it is compiled and stored in binary form (byte code) to avoid compiling the script again for each subsequent mail delivery. The Pigeonhole Sieve implementation uses the `.svbin` extension to store compiled Sieve scripts (e.g. `.dovecot.svbin`). To store the binary, the plugin needs write access in the directory in which the script is located. A problem occurs when a global script is encountered by the plugin. For security reasons, global script directories are not supposed to be writable by the user. Therefore, the plugin cannot store the binary when the script is first compiled. Note that this doesn't mean that the old compiled version of the script is used when the binary cannot be written: it compiles and uses the current script version. The only real problem is that the plugin will not be able to update the binary on disk, meaning that the global script needs to be recompiled each time it needs to be executed, i.e. for every incoming message, which is inefficient. To mitigate this problem, the administrator must manually pre-compile global scripts using the `sievec` command line tool. For example: ```sh sievec /var/lib/dovecot/sieve/global/ ``` This is necessary for script in storages with [[link,sieve_storage_type_after,after]], [[link,sieve_storage_type_before,before]], [[link,sieve_storage_type_default,default]], and [[link,sieve_storage_type_global,global]] storage type. For global scripts that are only included in other scripts using the Sieve include extension (from the [[link,sieve_storage_type_personal,personal]] and [[link,sieve_storage_type_global,global]] storage types), this step is not necessary since included scripts are incorporated into the binary produced for the main script. ## Compile and Runtime Logging Log messages produced during script compilation or during script execution are written to two locations by the LDA Sieve plugin: - If the user's personal storage is using the [[link,sieve_storage_file,file driver]], a log file is written in the same directory as the user's active personal script as defined by [[setting,sieve_script_active_path]]. This log file bears the name of that script file appended with ".log", e.g. `.dovecot.sieve.log`. Alternatively, e.g. when using another storage driver, [[setting,sieve_user_log_path]] can be used to configure the log file explicitly. If there are errors or warnings in the script, the messages are appended to that log file until it eventually grows too large (>10 kB currently). When that happens, the old log file is moved to a ".log.0" file and an empty log file is started. Informational messages are not written to this log file and the log file is not created until messages are actually logged, i.e. when an error or warning is produced. The log file name can be overridden with [[setting,sieve_user_log_path]]. - Messages that could be of interest to the system administrator are also written to the Dovecot logging facility (usually syslog). This includes informational messages that indicate what actions are executed on incoming messages. Compile errors encountered in the user's private script are not logged here. # Configuring Sieve & Submission ## `postmaster_address` `postmaster_address = postmaster@%{user | domain}` Email address to use in the From: field for outgoing email rejections. The `%{user | domain}` variable expands to the recipient domain. ### Domain (`%{user | domain}`) is Empty IMAP or POP3 protocol doesn't have explicit support for domains. The usernames are commonly in `user@domain` format, and that is also where Dovecot gets the domain from. If the username doesn't have `@domain`, then the domain is also usually empty (unless [[setting,auth_default_domain]] is used). If you login as `user@domain`, but the %{user | domain} is still empty, the problem is that your configuration lost the domain part by changing the username. Dovecot doesn't keep track of the domain separately from username, so if something changes username from `user@domain` to just plain `user`, the domain is lost and %{user | domain} returns nothing. If you have [[setting,auth_debug,yes]], this shows up in logs like: `Info: auth(user@domain.org): username changed user@domain.org -> user`. Below are some of the most common reasons for this. #### Settings [[setting,auth_username_format]] changes the username permanently when used globally. If used inside [[link,passdb,passdb]] or [[link,userdb,userdb]], it changes the username only for the duration of the lookup. See also [[link,virtual_users_system_users]]. #### SQL [[setting,passdb_sql_query]] gets often misconfigured to drop the domain if username and domain are stored separately. For example: ```doveconf[dovecot.conf] # BROKEN: passdb sql { query = SELECT username AS user, password \ FROM users \ WHERE username = '%{user | username}' AND domain = '%{user | domain}' } ``` The "username AS user" changes the username permanently and the domain is dropped. You can instead use: ```doveconf[dovecot.conf] # MySQL: passdb sql { query = SELECT concat(username, '@', domain) AS user, password \ FROM users \ WHERE username = '%{user | username}' AND domain = '%{user | domain}' } ``` Or you can return username and domain fields separately and Dovecot will merge them into a single user field: ```doveconf[dovecot.conf] passdb sql { query = SELECT username, domain, password \ FROM users \ WHERE username = '%{user | username}' AND domain = '%{user | domain}' } ``` ## `submission_host` `submission_host = smtp-out.example.com:25` SMTP server which is used for sending email rejects, Sieve forwards, vacations, etc. Alternatively, `sendmail_path` setting can be used to send mails using the sendmail binary. # Sieve Troubleshooting This page explains how to approach problems with Sieve. ## Common Problems Common configuration problems and their solutions are described here. ### Sieve Scripts are not Executed When Sieve scripts are not being executed, there are several possibilities: #### Your MTA is not using Dovecot LDA or LMTP Sieve scripts are executed by the Dovecot [[link,lda]] and/or the Dovecot [[link,lmtp]] service. Thus, you first need to check whether LDA or LMTP are actually being used. At least one of these is supposed to be called/accessed from your [[link,mta]] e.g. Exim or Postfix, for local message delivery. Most MTAs have their own local delivery agent, and without explicit configuration this is what is used. In that case, your Sieve scripts are simply ignored. When you set [[setting,log_debug,category=sieve]] in your configuration, your logs will show details of LDA and/or LMTP execution. The following is an example of the first few log lines of an LDA delivery: ``` dovecot: lda: Debug: Loading modules from directory: /usr/lib/dovecot/modules dovecot: lda: Debug: Module loaded: /usr/lib/dovecot/modules/lib90_sieve_plugin.so dovecot: lda(hendrik): Debug: Effective uid=1000, gid=1000, home=/home/hendrik dovecot: lda(hendrik): Debug: Namespace inbox: type=private, prefix=, sep=, inbox=yes, hidden=no, list=yes, subscriptions=yes location= ``` The first lines show that LDA has found and loaded the Sieve plugin module. Then it shows for what user it is delivering and where his INBOX is located. LMTP produces similar log lines. If you don't see lines such as the above, your MTA is probably not using Dovecot for local delivery. You can verify whether Dovecot is working correctly by executing `dovecot-lda` manually. #### The Sieve plugin is not Enabled The Dovecot [[link,lda]] and [[link,lmtp]] services do not provide Sieve support by default. Sieve support is provided as a separate plugin that needs to be enabled by adding it to [[setting,mail_plugins]] in the `protocol lda {...}` section for the LDA and the `protocol lmtp {...}` section for LMTP. If this is omitted, Sieve scripts are ignored. See [[plugin,sieve]]. Without actually running LDA, you can also check if executing `doveconf -f service=lda mail_plugins` includes "sieve". #### The Sieve plugin is misconfigured or the involved Sieve scripts contain errors If there is a configuration error or when a Sieve script cannot be compiled and executed, an error is always logged. ### Mailbox Names with non-ASCII Characters Cause Problems This problem most often manifests with the following error message: ``` error: msgid=<234234.234234@example.com>: failed to store into mailbox 'INBOX/Co&APY-rdineren' (INBOX/Co&-APY-rdineren): Mailbox doesn't exist: INBOX.Co&-APY-rdineren. ``` The Sieve script causing this error contained the following command: ``` fileinto "INBOX/Co&APY-rdineren"; ``` The specified mailbox contains the non-ASCII character 'ö'. Unfortunately, the author of this script used the wrong encoding. This is modified UTF-7 such as used by IMAP. However, Sieve expects UTF-8 for mailbox names. Depending on version and configuration, Dovecot uses modified UTF-7 internally. The Sieve interpreter expects UTF-8 and converts that to UTF-7 when necessary. When the mailbox is encoded in UTF-7 by the user, the '&' will just be escaped into '&-' during the UTF-7 conversion, yielding an erroneous mailbox name for Dovecot. That is what causes the error message presented above. Instead, the `fileinto` command should have looked as follows: ``` fileinto "INBOX/Coördineren"; ``` The old CMUSieve plugin did use UTF-7 for folder names. Therefore, this problem could have emerged after migrating from CMUSieve to Pigeonhole. # Spam Reporting ::: tip This page describes the recommended way of implementing spam/ham reporting within Dovecot. This is not the only possible solution, but matches the behavior of many clients and is entirely self-contained within the server. ::: Spam/not-spam reporting within Dovecot (IMAP) can be handled by the user action of moving a message into (or out of) a defined Spam mailbox. ## Configuration Spam reporting messages are handled via [[plugin,imap-sieve]]. A global configuration script is used to capture the event of moving messages in/out of the Spam mailbox. ::: warning **You cannot run shell scripts anywhere you want.** Sieve allows you to only run scripts under [[setting,sieve_pipe_bin_dir]]. You can't use `/usr/local/bin/my-sieve-filter.sh`, you have to put the script under `sieve_pipe_bin_dir` and use `my-sieve-filter.sh` in the script instead. ::: The Spam mailbox is defined and reported to the MUA via a Special-Use flag. ### External Reporting In this setup, the sieve scripts the script send the reported message using [[rfc,5965]] compliant spam reporting format to an external reporting e-mail address, using the [report extension](https://raw.githubusercontent.com/dovecot/pigeonhole/master/doc/rfc/spec-bosch-sieve-report.txt). #### Configuration ::: code-group ```doveconf[dovecot.conf] # Display \Junk special-flag for Spam mailbox namespace inbox { mailbox Spam { auto = create special_use = \Junk } } # Setup actions based on message movement protocol imap { mail_plugins { imap_sieve = yes } } sieve_plugins { sieve_imapsieve = yes } sieve_global_extensions { vnd.dovecot.report = yes } mailbox Spam { # From elsewhere to Spam folder sieve_script report-spam { type = before cause = copy path = /etc/dovecot/sieve/report-spam.sieve } } # From Spam folder to elsewhere imapsieve_from Spam { sieve_script report-ham { type = before cause = copy path = /etc/dovecot/sieve/report-ham.sieve } } # Needed to send message to external mail server submission_host = 127.0.0.1:587 ``` ```[/etc/dovecot/sieve/report-spam.sieve] require "vnd.dovecot.report"; report "abuse" "User added this message to the Spam folder." "spam-report@example.com"; ``` ```[/etc/dovecot/sieve/report-ham.sieve] require "vnd.dovecot.report"; require "environment"; require "imapsieve"; if environment "imap.mailbox" "Trash" { # Putting spam in Trash mailbox is not significant stop; } if environment "imap.mailbox" "Spam" { # Copying mail inside Spam mailbox is not significant stop; } report "not-spam" "User removed this message from the Spam folder." "ham-report@example.com"; ``` ::: ### Local Reporting In this setup, the sieve scripts pass the reported message to local binaries to do classification. #### Caveats and Possible Pitfalls - INBOX name is case-sensitive - [[plugin,imap-sieve]] will **only** apply to IMAP. It **will not** apply to LDA or LMTP. Use [[link,sieve]] normally for LDA/LMTP. - With this configuration, moving mails will slow down due to learn being done per email. If you want to avoid this, you need to think of something else. Probably piping things into a FIFO or perhaps using a socket based worker might work better. - Please read [[link,sieve]] and [[link,sieve_configuration]] to understand sieve configuration better. - Please read [[link,sieve_plugins]] for more information about sieve extensions. - If you run SpamAssassin trough Amavis and you use a virtual users setup, you should instead configure SpamAssassin to use MySQL/PostgreSQL as a backend, unless you want a headache with file permissions and lock files. See: https://docs.iredmail.org/store.spamassassin.bayes.in.sql.html. In this case, the `-u` parameter passed to `sa-learn` (and the relevant sieve variables) is obsolete and can be safely removed. - Reloading Dovecot doesn't activate changes in this configuration, you'll need to perform a full restart. #### Configuration ::: code-group ```doveconf[dovecot.conf] # Display \Junk special-flag for Spam mailbox namespace inbox { mailbox Spam { auto = create special_use = \Junk } } # Setup actions based on message movement protocol imap { mail_plugins { imap_sieve = yes } } sieve_plugins { sieve_imapsieve = yes sieve_extprograms = yes } sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.environment = yes } sieve_pipe_bin_dir = /usr/lib/dovecot/sieve mailbox Spam { # From elsewhere to Spam folder sieve_script report-spam { type = before cause = copy path = /etc/dovecot/sieve/report-spam.sieve } } # From Spam folder to elsewhere imapsieve_from Spam { sieve_script report-ham { type = before cause = copy path = /etc/dovecot/sieve/report-ham.sieve } } ``` ```[/etc/dovecot/sieve/report-spam.sieve] require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.user" "*" { set "username" "${1}"; } # "sa-learn-spam.sh" MUST live in /usr/lib/dovecot/sieve pipe :copy "sa-learn-spam.sh" [ "${username}" ]; ``` ```[/etc/dovecot/sieve/report-ham.sieve] require ["vnd.dovecot.pipe", "copy", "imapsieve", "environment", "variables"]; if environment :matches "imap.mailbox" "*" { set "mailbox" "${1}"; } if string "${mailbox}" "Trash" { stop; } if environment :matches "imap.user" "*" { set "username" "${1}"; } # "sa-learn-ham.sh" MUST live in /usr/lib/dovecot/sieve pipe :copy "sa-learn-ham.sh" [ "${username}" ]; ``` ::: ### Shell Scripts #### SpamAssassin ::: warning `spamc` interaction scripts are not tested yet. ::: ::: code-group ```sh[sa-learn-spam.sh] #!/bin/sh # you can also use tcp/ip here, consult spamc(1) exec /usr/bin/spamc -u "$1" -L spam ``` ```sh[sa-learn-ham.sh] #!/bin/sh # you can also use tcp/ip here, consult spamc(1) exec /usr/bin/spamc -u "$1" -L ham ``` ::: You can also use sa-learn. Note that using sa-learn often incurs significant start-up time for every message. This can cause "lockout" of the user until all the processes sequentially complete, potentially tens of seconds or minutes. If spamd is being used and the administrator is willing to accept the potential security issues of allowing unauthenticated learning of spam/ham, spamd can be invoked with the `--allow-tell` option and spamc with the `--learntype=` option. Please consult the man pages of spamd and spamc for further details. ::: code-group ```sh[sa-learn-spam.sh] #!/bin/sh exec /usr/bin/sa-learn -u "$1" --spam ``` ```sh[sa-learn-ham.sh] #!/bin/sh exec /usr/bin/sa-learn -u "$1" --ham ``` ::: #### dspam ::: code-group ```sh[sa-learn-spam.sh] #!/bin/sh exec /usr/bin/dspam --client --user "$1" --class=spam --source=error ``` ```sh[sa-learn-ham.sh] #!/bin/sh exec /usr/bin/dspam --client --user "$1" --class=innocent --source=error ``` ::: ::: warning **CRLF handling** dspam may fail to read the mail if it contains CRLF line endings. Add the **Broken lineStripping** option in dspam.conf if needed. ::: #### rspamd By default, rspamd does global learning. If you want per-user classification, or something more complex, see https://rspamd.com/doc/configuration/statistic.html Alternative scripts can be found from https://github.com/darix/dovecot-sieve-antispam-rspamd/ ::: code-group ```sh[sa-learn-spam.sh] #!/bin/sh exec /usr/bin/rspamc -h /run/rspamd/worker-controller.socket -P learn_spam ``` ```sh[sa-learn-ham.sh] #!/bin/sh exec /usr/bin/rspamc -h /run/rspamd/worker-controller.socket -P learn_ham ``` ::: Before running following commands, make sure `dovecot.conf` has all the sieve configuration you want. Then run following commands: ```sh sievec /etc/dovecot/sieve/report-spam.sieve sievec /etc/dovecot/sieve/report-ham.sieve chmod +x /etc/dovecot/sieve/sa-learn-ham.sh /etc/dovecot/sieve/sa-learn-spam.sh ``` Now your learn scripts should be invoked when you move mails between folders. ## Debugging To debug, you need to import "vnd.dovecot.debug" extension. Then you can put in your Sieve script, when required (variables supported): ``` debug_log "something" ``` # SQL Driver: Cassandra Driver name `cassandra`. Driver for Apache Cassandra CQL server. To compile support for this driver, you need to have [DataStax C/C++ driver](https://docs.datastax.com/en/developer/cpp-driver/index.html) and headers installed. ## Settings ## SSL/TLS Settings Not all of Dovecot SSL settings are supported by the Cassandra library. Below is the list of supported settings: ## Consistency Consistency levels in Cassandra can be configured to manage availability versus data accuracy. ### Read Consistency #### `any` ::: danger Not supported for reads. ::: #### `local-serial` Allows reading the current (and possibly uncommitted) state of data without proposing a new addition or update. If a `SERIAL` read finds an uncommitted transaction in progress, it will commit the transaction as part of the read. Local serial is confined to datacenter. #### `serial` Allows reading the current (and possibly uncommitted) state of data without proposing a new addition or update. If a `SERIAL` read finds an uncommitted transaction in progress, it will commit the transaction as part of the read. #### `one` Returns a response from the closest replica, as determined by the snitch. #### `two` Returns the most recent data from two of the closest replicas. #### `three` Returns the most recent data from three of the closest replicas. #### `local-quorum` Returns the record after a quorum of replicas in the current datacenter as the coordinator has reported. #### `quorum` Returns the record after a quorum of replicas from all datacenters has responded. #### `each-quorum` ::: danger Not supported for reads. ::: #### `all` Returns the record after all replicas have responded. The read operation will fail if a replica does not respond. ### Write/Delete Consistency #### `any` At least one node must succeed in the operation. #### `local-serial` ::: danger Not supported for writes. ::: #### `serial` ::: danger Not supported for writes. ::: #### `one` Operation must be at least in commit log and one memory table of one replica. #### `two` Operation must be at least in commit log and one memory table of two replicas. #### `three` Operation must be at least in commit log and one memory table of three replicas. #### `local-quorum` A write must be written to the commit log and memory table on a quorum of replica nodes in the same datacenter as the coordinator. #### `quorum` A write must be written to the commit log and memory table on a quorum of replica nodes across all datacenters. #### `each-quorum` A write must be written to the commit log and memory table on a quorum of replica nodes in each datacenter. #### `all` A write must be written to the commit log and memtable on all replica nodes in the cluster for that partition. ## Metrics This describes the format of the JSON output produced when the metrics configuration option is activated. Source: https://docs.datastax.com/en/developer/cpp-driver/latest/api/struct.CassMetrics/index.html ::: details ```json { "Requests": { # Minimum in microseconds "min": [Number: integer], # Maximum in microseconds "max": [Number: integer], # Mean in microseconds "mean": [Number: integer], # Standard deviation in microseconds "stddev": [Number: integer], # Median in microseconds "median": [Number: integer], # 75th percentile in microseconds "percentile_75th": [Number: integer], # 95th percentile in microseconds "percentile_95th": [Number: integer], # 98th percentile in microseconds "percentile_98th": [Number: integer], # 99th percentile in microseconds "percentile_99th": [Number: integer], # 99.9th percentile in microseconds "percentile_999th": [Number: integer], # Mean rate in requests per second "mean_rate": [Number: fraction], # 1 minute rate in requests per second "one_minute_rate": [Number: fraction], # 5 minute rate in requests per second "five_minute_rate": [Number: fraction], # 15 minute rate in requests per second "fifteen_minute_rate": [Number: fraction] }, "stats": { # The total number of connections "total_connections": [Number: integer], # The number of connections available to take requests "available_connections": [Number: integer], # Occurrences when requests exceeded a pool's water mark "exceeded_pending_requests_water_mark": [Number: integer], # Occurrences when number of bytes exceeded a connection's water mark "exceeded_write_bytes_water_mark": [Number: integer] }, "queries": { # Number of queries sent to Cassandra "sent": [Number: integer], # Number of successful responses "recv_ok": [Number: integer], # Number of requests that couldn’t be sent, because the local # Cassandra driver’s queue was full. "recv_err_queue_full": [Number: integer], # Number of requests that didn’t succeed because the Cassandra # driver couldn’t connect to the server. "recv_err_no_hosts": [Number: integer], # Number of requests that didn’t succeed because the Cassandra # driver timed out while waiting for response from server. "recv_err_client_timeout": [Number: integer], # Number of requests that didn’t succeed because the Cassandra # server reported a timeout communicating with other nodes. "recv_err_server_timeout": [Number: integer], # Number of requests which couldn’t succeed, because not enough # Cassandra nodes were available for the consistency level. "recv_err_server_unavailable": [Number: integer] # Number of requests which couldn’t succeed for other reasons. "recv_err_other": [Number: integer] }, "errors": { # Occurrences of a connection timeout "connection_timeouts": [Number: integer], # [No description provided] "pending_request_timeouts": [Number: integer], # Occurrences of requests that timed out waiting for a connection "request_timeouts": [Number: integer] } } ``` ::: # SQL Driver: MySQL/MariaDB Driver name `mysql`. The mysql driver works with both MySQL and MariaDB. MariaDB is the recommended choice, as a community-governed, fully open-source drop-in replacement. To compile support for this driver, you need to have the MySQL or MariaDB client library and development headers installed (for example `libmysqlclient-dev`, or `libmariadb-dev` for MariaDB). ## Example Configuration See [[link,auth_mysql]]. ## Settings ## SSL/TLS Settings Not all of Dovecot SSL settings are supported by the MySQL library. Below is the list of supported settings: # SQL Driver: PostgreSQL Driver name is `postgresql`. To compile support for this driver, you need PostgreSQL client library and headers. ## Example Configuration See [[link,auth_postgresql]]. ## Settings # SQL Driver: SQLite Driver name is `sqlite`. To compile support for this driver. you need sqlite library and headers. ## Example Configuration See [[link,auth_sqlite]]. ## Settings # SSL/TLS Configuration ## Configuration Overview The most important SSL settings are: ```doveconf[dovecot.conf] ssl = yes # Preferred permissions: root:root 0444 ssl_server_cert_file = /etc/ssl/certs/dovecot.pem # Preferred permissions: root:root 0400 ssl_server_key_file = /etc/ssl/private/dovecot.pem ``` The certificate file can be world-readable, since it doesn't contain anything sensitive (in fact it's sent to each connecting SSL client). The key file's permissions should be restricted to only root (and possibly ssl-certs group or similar if your OS uses such). Dovecot opens both of these files while still running as root, so you don't need to give Dovecot any special permissions to read them (in fact: **do not give dovecot user any permissions to the key file**). Settings for the SSL certificate and SSL secret key files: ```doveconf[dovecot.conf] ssl_server_cert_file = /etc/dovecot/dovecot.crt ssl_server_key_file = /etc/dovecot/dovecot.key ``` It's possible to keep the certificate and the key both in the same file: ```doveconf[dovecot.conf] # Preferred permissions: root:root 0400 ssl_server_cert_file = /etc/ssl/dovecot.pem ssl_server_key_file = /etc/ssl/dovecot.pem ``` For using multiple SSL certificates, see [[link,ssl_multiple_certs]]. ::: tip It's important to note that `ssl = yes` must be set globally if you require SSL for any protocol (or Dovecot will not listen on the SSL ports), which in turn requires that a certificate and key are specified globally even if you intend to specify certificates per protocol. ::: ## How to Specify When SSL/TLS is Required There are a couple of different ways to specify when SSL/TLS is required: * [[setting,ssl,no]]: SSL/TLS is completely disabled. * [[setting,ssl,yes]] and [[setting,auth_allow_cleartext,yes]]: SSL/TLS is offered to the client, but the client isn't required to use it. The client is allowed to login with cleartext authentication even when SSL/TLS isn't enabled on the connection. This is insecure, because the cleartext password is exposed to the internet. * [[setting,ssl,yes]] and [[setting,auth_allow_cleartext,no]]: SSL/TLS is offered to the client, but the client isn't required to use it. The client isn't allowed to use cleartext authentication, unless SSL/TLS is enabled first. However, if non-cleartext authentication mechanisms are enabled they are still allowed even without SSL/TLS. Depending on how secure they are, the authentication is either fully secure or it could have some ways for it to be attacked. * [[setting,ssl,required]]: SSL/TLS is always required, even if non-cleartext authentication mechanisms are used. Any attempt to authenticate before SSL/TLS is enabled will cause an authentication failure. Note that this setting is unrelated to the STARTTLS command - either implicit SSL/TLS or STARTTLS command is allowed. ::: tip If you have only cleartext mechanisms enabled (e.g. [[setting,auth_mechanisms,plain login]] and [[setting,auth_allow_cleartext,no]], [[setting,ssl,yes]] and [[setting,ssl,required]] are completely equivalent because in either case the authentication will fail unless SSL/TLS is enabled first. ::: ::: tip With both [[setting,ssl,yes]] and [[setting,ssl,required]], it's still possible that the client attempts to do a cleartext authentication before enabling SSL/TLS, which exposes the cleartext password to the internet. Dovecot attempts to indicate this to the IMAP clients via the LOGINDISABLED capability, but many clients still ignore it and send the password anyway. There is unfortunately no way for Dovecot to prevent this behavior. The POP3 standard doesn't have an equivalent capability at all, so the POP3 clients can't even know if the server would accept a cleartext authentication. ::: * The main difference between [[setting,ssl,required]] and [[setting,auth_allow_cleartext,no]] is that if [[setting,ssl,required]], it guarantees that the entire connection is protected against eavesdropping (SSL/TLS encrypts the rest of the connection), while [[setting,auth_allow_cleartext,no]] only guarantees that the password is protected against eavesdropping (SASL mechanism is encrypted, but no SSL/TLS is necessarily used). Nowadays you most likely should be using SSL/TLS anyway for the entire connection, since the cost of SSL/TLS is cheap enough. Using both SSL/TLS and non-cleartext authentication would be the ideal situation since it protects the cleartext password even against man-in-the-middle attacks. ::: tip The cleartext authentication mechanisms are always allowed (and SSL not required) for [secured connections](#secured-connections). ::: ## Secured Connections The value of [[setting,ssl]] influences whether a connection is considered "secure". * Dovecot-terminated TLS connections are always `secured`. * [[link,haproxy_tls_forward]] are always `secured`. * This is true even if HAProxy isn't running on the same server as Dovecot, and the connection between HAProxy and Dovecot isn't secured. The reasoning here is that this kind of a configuration is most likely intentional. If such connection wasn't treated `secured`, it would prevent using `ssl=required` to enforce end clients to use TLS. * Connections from a client to HAProxy running on localhost are always `secured`. * This is true even if HAProxy isn't running on the same server as Dovecot, and the connection between HAProxy and Dovecot isn't secured. The reasoning here is similar to above on why connections marked as TLS by HAProxy are treated as secured. * It doesn't matter whether a connection from HAProxy to Dovecot is on localhost. * Non-haproxy connections from localhost are always `secured`. * Other connections from [[setting,login_trusted_networks]] are `secured`, but only if `ssl` setting is not `required`. * Other connections from HAProxy are `secured`, but only if `ssl` setting is not `required`. Connections that are `secured` are always allowed to use plaintext authentication. Auth lookups will have the connection marked as `secured`, which also affects the `%{secured}` variable (see [[variable]]). ## Multiple SSL Certificates ### Different Certificates per Algorithm You can specify alternative SSL certificate that will be used if the algorithm differs from the primary certificate. This is useful when migrating to, e.g., ECDSA certificate. ```doveconf[dovecot.conf] ssl_server_alt_cert_file = /path/to/alternative/cert.pem ssl_server_alt_key_file = /path/to/alternative/key.pem ``` ### Different Certificates per IP and Protocol If you have multiple IPs available, this method is guaranteed to work with all clients. ```doveconf[dovecot.conf] # instead of IP you can also use hostname, which will be resolved local 192.0.2.10 { protocol imap { ssl_server_cert_file = /etc/ssl/dovecot/imap-01.example.com.cert.pem ssl_server_key_file = /etc/ssl/dovecot/imap-01.example.com.key.pem } protocol pop3 { ssl_server_cert_file = /etc/ssl/dovecot/pop-01.example.com.cert.pem ssl_server_key_file = /etc/ssl/dovecot/pop-01.example.com.key.pem } } local 192.0.2.20 { protocol imap { ssl_server_cert_file = /etc/ssl/dovecot/imap-02.example.com.cert.pem ssl_server_key_file = /etc/ssl/dovecot/imap-02.example.com.key.pem } protocol pop3 { ssl_server_cert_file = /etc/ssl/dovecot/pop-02.example.com.cert.pem ssl_server_key_file = /etc/ssl/dovecot/pop-02.example.com.key.pem } } ``` ::: warning You will still need a top-level default [[setting,ssl_server_key_file]] and [[setting,ssl_server_cert_file]], or you will receive errors. ::: ### With Client TLS SNI (Server Name Indication) Support The SNI mechanism allows a server to present different hosts via a common connection, that the client can request by name. These are set up using the [[link,settings_connection_filters,local_name]] filter. It is important to note that having multiple SSL certificates per IP will not be compatible with all clients, especially mobile ones. It is a TLS SNI limitation. When using wildcard certificates, keep in mind that the `*` applies only to a single label. This is a general limitation of TLS, not Dovecot specifically. For example, `*.example.org` will match `mail.example.org` but not `int.mail.example.org`. Also note that the ordering of [[link,settings_connection_filters,local_name]] is important. The wildcard certificate must be listed first, followed by more specific names. Note that the last matching [[link,settings_connection_filters,local_name]] filter will be used. ```doveconf[dovecot.conf] local_name imap.example.org { ssl_server_cert_file = /etc/ssl/certs/imap.example.org.crt ssl_server_key_file = /etc/ssl/private/imap.example.org.key } local_name imap.example2.org { ssl_server_cert_file = /etc/ssl/certs/imap.example2.org.crt ssl_server_key_file = /etc/ssl/private/imap.example2.org.key } # ..etc.. ``` [[added,ssl_sni_settings_reload_added]]: A server can reload different SSL certificates and other related settings using SNI (e.g. [[setting,login_greeting]] or [[setting,postmaster_address]]). The reloading of settings based on SNI is supported for IMAP, SMTP and LMTP. #### Client Support Clients confirmed working with TLS SNI: * Thunderbird (Linux) * [K-9 on Android][support-android-k9] * Apple Mail (according to [Mail SSL SNI - cPanel][support-apple-mail]) * [Mutt][support-mutt] * [NeoMutt][support-neomutt] Not working Clients: * Apple Mail (Mac OS X 10.10 and lower AND iOS 9.3 and lower) * Outlook for Mac version 15 (according to [Mail SSL SNI - cPanel][support-apple-mail]) * Kindle Fire HD 8 * Outlook 2013 ## Password Protected Key Files SSL key files may be password protected. There are two ways to provide Dovecot with the password: 1. Starting Dovecot with `dovecot -p` asks the password. It's not stored anywhere, so this method prevents Dovecot from starting automatically at startup. 2. [[setting,ssl_server_key_password]] setting. Note that `dovecot.conf` is by default world-readable, so you probably shouldn't place it there directly. Instead you could store it in a different file, such as `/etc/dovecot-private.conf` containing: ```doveconf[dovecot.conf] ssl_server_key_password = secret ``` and then use `!include_try /etc/dovecot-private.conf` in the main `dovecot.conf`. ## Chained SSL Certificates Put all the certificates in the [[setting,ssl_server_cert_file]] in this order: 1. Dovecot's public certificate 2. First Intermediate Certificate 3. Second Intermediate Certificate Most CA providers these days provide a "full chain" certificate file, which contains the required certificates in correct order. You should use this. ## SSL security settings You can specify path to DH parameters file using: ```doveconf[dovecot.conf] ssl_server_dh_file = /path/to/dh.pem ``` This is fully optional, and most modern clients do not need this. To generate new parameters file, you can use: ```sh # This might take a very long time. # Run it on a machine with sufficient entropy. openssl dhparam 4096 > dh.pem ``` By default Dovecot's allowed ciphers list contains: ```doveconf[dovecot.conf] ssl_cipher_list = ALL:!kRSA:!SRP:!kDHd:!DSS:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK:!RC4:!ADH:!LOW@STRENGTH ``` Disallowing more won't really gain any security for those using better ciphers, but it does prevent people from accidentally using insecure ciphers. See https://www.openssl.org/docs/manmaster/man1/ciphers.html for a list of the ciphers. For TLSv1.3 server ciphers should not longer be preferred: ```doveconf[dovecot.conf] ssl_server_prefer_ciphers = client ``` ## SSL verbosity To make Dovecot log all the problems it sees with SSL connections: ```doveconf[dovecot.conf] log_debug = category=ssl ``` Some errors might be caused by dropped connections, so it could be quite noisy. ## Client Certificate Verification/Authentication If you want to require clients to present a valid SSL certificate, you'll need these settings: ```doveconf[dovecot.conf] ssl_server_ca_file = /etc/ssl/ca.pem ssl_server_request_client_cert = yes auth_ssl_require_client_cert = yes # if you want to get username from certificate as well, enable this #auth_ssl_username_from_cert = yes ``` The CA file should contain the certificate(s) followed by the matching CRL(s). ::: tip The CRLs are required to exist. For a multi-level CA place the certificates in this order: 1. Issuing CA cert 2. Issuing CA CRL 3. Intermediate CA cert 4. Intermediate CA CRL 5. Root CA cert 6. Root CA CRL ::: The certificates and the CRLs have to be in PEM format. To convert a DER format CRL (e.g. http://crl.cacert.org/class3-revoke.crl) into PEM format, use: ```sh openssl crl -in class3-revoke.crl -inform DER -outform PEM > class3-revoke.pem ``` With the above settings, if a client connects which doesn't present a certificate signed by one of the CAs in the [setting,ssl_server_ca_file]], Dovecot won't let the user log in. This could present a problem if you're using Dovecot to provide SASL authentication for an MTA (such as Postfix) which is not capable of supplying client certificates for SASL authentication. If you need Dovecot to provide SASL authentication to an MTA without requiring client certificates and simultaneously provide IMAP service to clients while requiring client certificates, you can put [[setting,auth_ssl_require_client_cert,yes]] inside of a protocol block as shown below to make an exemption for SMTP SASL clients (such as Postfix). ```doveconf[dovecot.conf] protocol !smtp { auth_ssl_require_client_cert=yes } ``` You may also force the username to be taken from the certificate by setting [[setting,auth_ssl_username_from_cert,yes]]. * The text is looked up from subject DN's specified field using OpenSSL's `X509_NAME_get_text_by_NID()` function. * By default the `CommonName` field is used. * You can change the field with [[setting,ssl_server_cert_username_field,name]] setting (parsed using OpenSSL's `OBJ_txt2nid()` function). `x500UniqueIdentifier` is a common choice. You may also want to disable the password checking completely. Doing this currently circumvents Dovecot's security model so it's not recommended to use it, but it is possible by making the passdb allow logins using any password (typically requiring `nopassword` extra field to be returned). ## Testing Try out your new setup: ```sh openssl s_client -servername mail.sample.com -connect mail.sample.com:pop3s ``` You should see something like this: ``` CONNECTED(00000003) depth=2 /O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org verify error:num=19:self signed certificate in certificate chain verify return:0 --- Certificate chain 0 s:/CN=mail.example.com i:/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root 1 s:/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root i:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org 2 s:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org i:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org --- Server certificate -----BEGIN CERTIFICATE----- MIIE1DCCArygAwIBAgIDAMBPMA0GCSqGSIb3DQEBBAUAMFQxFDASBgNVBAoTC0NB Y2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5vcmcxHDAaBgNV BAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwHhcNMTAxMjIwMTM1NDQ1WhcNMTIxMjE5 MTM1NDQ1WjAmMSQwIgYDjksadnjkasndjksandjksandjksandj5YXJlYS5vcmcw ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC3jOX3FC8wVqnb2r65Sfvk cYUpJhlbhCfqPdN41c3WS0y1Jwwum1q4oMAJvdRnD5TMff1+fqTFy3lS1sYxIXiD kBRo478eNqzXHMpBOqbvKjYp/UZgWUNA9ebI1nQtwd7rnjmm/GrtyItjahCsgzDS qPAie+mXYzuT49ZoG+Glg7/R/jDcLMcJY0d5eJ7kufB1RLhvRitZD4FEbJVehqhY aevf5bLk1BNFhzRBfLXmv6u/kfvWf2HjGAf0aFhaQyiAldDgnZrvaZOFjkToJk27 p9MguvwGmbciao0DmMjcJhQ0smclFwy8Kj98Tz+nTkfAlU8jJdb1J/tIatJdpSRh AgMBAAGjgdwwgdkwDAYDVR0TAQH/BAIwADA0BgNVHSUELTArBggrBgEFBQcDAgYI KwYBBQUHAwEGCWCGSAGG+EIEAQYKKwYBBAGCNwoDAzALBgNVHQ8EBAMCBaAwMwYI KwYBBQUHAQEEJzAlMCMGCCsGAQUFBzABhadodHRwOi8vb2NzcC5jYWNlcnQub3Jn LzBRBgNVknsadkjasnjdksandjksandjsnNlY3VyaXR5YXJlYS5vcmegKQYIKwYB BQUHCAWgHQwbbWFpbC5qb2ludC5zZWN1cml0eWFyZWEub3JnMA0GCSqGSIb3DQEB BQUAA4ICAQAX8ceObvUZNKYTlNQ/cv0BiA1XweRsVNca1ILACNLdVPR9mvf+aXCh ODkHaZAmGngj1DfD4fJsTbaydGWSPeVH91Qi9F+Pi6szhsxylI83NKbuXihcenuG twnte8aIb5FelVHttLQPSKRR62E8YmDWk3KYivuFAuZqDaGnWc5yeneTBpsGter/ 4awqsgymBK2YEg1HIWMPaRBvwzCVN/yUyWhFH9Nj11f/xgZE87VXrjLHWT/73i2Z S4uIZ2KHQUYuxMGldgpXm+QxFM8DGA6z1T1oPCVfW85cezlfr8QVvX6SXZrAUNL0 3D5YPzQuevW+5CrqnGA+F5ff4mBMl8R8Sg0+0LoLqt5PbpGyTt9vS1INZCdfvtIA /d7Ae7Xp9W8FVRqd7tvNMIy3ZA0/wNMDUczkhC/YtvHfMELpjtMJAGF15OtO7Vik V+FZnBP1Yd7760dtEmd6bF8vjcXCvDdxwGtcAehAUpIgAWvkHHOt8+H56tkFENAP /ZpJ+Wr+K3lxkkG+BN1bucxMuAdVyTpFyZfKDHRXIO/5e0hpPOaTO+obD3kifzdh yy7KmdKvDclHTiPuonJBzEXeM3JQBjcDHbMSyA6+38yBcso27h9VqCQJB2cZmSlW ArS/9wt2X21KgeuGHlTZ/8z9gXAjQKXhDYECWWd6LkWl98ZDBihslQ== -----END CERTIFICATE----- subject=/CN=mail.example.com issuer=/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root --- No client certificate CA names sent --- SSL handshake has read 5497 bytes and written 293 bytes --- New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: zlib compression Expansion: zlib compression SSL-Session: Protocol : TLSv1 Cipher : DHE-RSA-AES256-SHA Session-ID: 114A22BE4625B33F6893124ACF640AE0628B48B5039E90B3B9A20ADF7FA691F3 Session-ID-ctx: Master-Key: B8A55EC91A060575CFB29503FBF7160C2DC8BCBFE02D20A7F704882F72D8D00272D8D002CE5CCC4B94A492F43ED8F Key-Arg : None TLS session ticket: 0000 - 86 c7 46 63 a5 b6 48 74-16 d8 e0 a7 e2 64 e8 89 ..Fc..Ht.....d.. 0010 - 97 90 59 4b 57 f3 e2 b3-e2 d2 88 90 a8 aa b4 44 ..YKW..........D 0020 - ea 24 08 5e b4 14 7f e1-2a 1a 1c 40 ca 85 e7 41 .$.^....*..@...A 0030 - 9d 0d a8 4c f7 e3 db 1e-ef da 53 9c fe 43 cc 62 ...L......S..C.b 0040 - 79 b6 ad ea 9d cf ca b2-37 41 b7 0f ea 7d 59 e8 y.......7A...}Y. 0050 - 10 01 a0 eb dc c2 63 66-56 54 6a e8 3a 4b 93 49 ......cfVTj.:K.I 0060 - 77 da e4 4b 21 e8 30 7e-bf 10 91 3a 2c f9 59 80 w..K!.0~...:,.Y. 0070 - 01 1f 36 0b 92 85 67 55-c8 86 1d 44 b1 6f 0d ae ..6...gU...D.o.. 0080 - 15 36 b6 49 3a ef 94 9a-ef 6d 27 f0 80 20 43 09 .6.I:....m'.. C. 0090 - be 70 c5 30 15 3b 93 c6-c1 4c e9 7f 5c 34 98 dd .p.0.;...L..\4.. Compression: 1 (zlib compression) Start Time: 1292857721 Timeout : 300 (sec) Verify return code: 19 (self signed certificate in certificate chain) --- +OK Dovecot ready. ``` ### Testing CA The above test procedure returns: ``` Verify return code: 19 (self signed certificate in certificate chain) ``` which is expected result since test command omits option to verify CA root certificate. The following commands will enable CA root certificate validation. #### Testing CA On Debian On Debian derived distributions try: ```sh openssl s_client -CApath /etc/ssl/certs -connect mail.sample.com:pop3s ``` #### Testing CA On RHEL On Red Hat Enterprise Linux derived distributions try: ```sh openssl s_client -CAfile /etc/pki/tls/cert.pem -connect mail.sample.com:pop3s ``` ### Testing CA Success Verify return code: 0 (ok) ### Client Connections By default Dovecot uses OpenSSL's default system CAs to verify SSL certificates for outgoing connections. This can be overridden by specifying either [[setting,ssl_client_ca_dir]] or [[setting,ssl_client_ca_file]]. ::: tip Using [[setting,ssl_client_ca_dir]] is preferred because it uses less memory. ::: ```doveconf[dovecot.conf] ssl_client_ca_dir = /path/to/pem/certificates ssl_client_ca_file = /path/to/pem/bundle ``` ## JA3 Identifier [[added,ja3_identifier]] Dovecot supports calculating [JA3 hash][ja3-hash] for checking client TLS implementation. This adds `ssl_ja3` and `ssl_ja3_hash` to [[variable,login]], to be used with [[setting,login_log_format_elements]] and `ssl_ja3_hash` for [[variable,auth]], to be used with, e.g., [[link,auth_policy]]. To get JA3 values, you will need to use OpenSSL 1.1 or newer. Common JA3 hash databases usually use values provided by HTTP clients. Since IMAP, POP3 etc. do not currently use some of these extensions, you should not use these. They will not match. Some examples for demonstration purposes only. ``` Mutt 2.2.9, TLS1.3, GnuTLS ja3=771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,5-10-11-13-22-23-35-51-43-65281-0-45,23-24-25-29-30-256-257-258-259-260,0 ja3_hash=b7e9d913d85c071f5b806d59601e9b96 OpenSSL 1.1.1n, TLS1.3 ja3=771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2 ja3_hash=c34a54599a1fbaf1786aa6d633545a60 Thunderbird 102.4.2+build2-0ubuntu0.22.04.1, TLS1.3 ja3=771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-5-51-43-13-45-21,29-23-24-25-256-257,0 ja3_hash=3ed71a458200f4af79031644408b8e58 ``` [ja3-hash]: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967 [support-apple-mail]: https://support.cpanel.net/hc/en-us/community/posts/19633051862807-Mail-SSL-SNI [support-android-k9]: https://github.com/k9mail/k-9/pull/718 [support-mutt]: https://gitlab.com/muttmua/trac-tickets/-/blob/master/tickets/closed/3923-mutt_may_need_to_support_TLSs_Server_Name_Indiciation_SNI_fo.txt?ref_type=heads [support-neomutt]: https://www.neomutt.org/feature/tls-sni # Statistics See [[link,summary_events]] for list of all events that can be used in statistics. Dovecot supports gathering statistics from events (see [[link,event_design]]). Currently there are no statistics logged by default, and therefore they must be explicitly added using the `metric` configuration blocks. The [`metric_filter`](#metric_filter) setting is the only required setting in a [`metric`](#metric) block. It specifies which events should be used when calculating the statistics for a given metric block. Event filtering is described in detail in [[link,event_filter]]. Note that Dovecot also has many unnamed events. These aren't generally useful for statistics, but in some situations they may become visible in statistics. To avoid surprises, it's a good idea to always specify `event=name` in the filter setting. You can also use `event=*` to match all named events. ## Settings ## Group By The [[setting,metric_group_by]] setting allows dynamic hierarchical metric generation based on event fields' values. Each listed [[setting,metric_group_by]] generates one level of "sub-metrics". These automatically generated metrics are indistinguishable from those statically defined in the config file. "sub-metric" names can be up to 256 bytes in total. ::: warning Do not group by high-cardinality fields. Each distinct value observed creates a new sub-metric that is kept in memory for the lifetime of the stats process, and there is no upper limit on how many sub-metrics can be retained. Grouping by fields such as usernames, email addresses, remote IPs, message IDs, or mailbox GUIDs will cause unbounded memory growth. Prefer low-cardinality fields (e.g., IMAP command name, reply status), or quantize numeric fields with the [[link,stats_group_by_exponential,exponential]] or [[link,stats_group_by_linear,linear]] aggregation method. For `discrete`, use [[setting,metric_group_by_method_discrete_modifier]] to reduce cardinality (e.g., `%{value | domain}` to group by domain instead of per-user). ::: Dovecot supports a number of aggregation methods that can be used to quantize a field's value before it is used to generate a metric. ### `discrete` The simplest aggregation method is to use the value as is. Because this is a very common use case, this is the default aggregation method. The value can be further modified by [[setting,metric_group_by_method_discrete_modifier]]. [[added,metric_group_by_discrete_modifiers_added]] An additional parameter can be added to provide modifiers to the discrete value. This is done as [[link,settings_variables,%variables]] and their modifiers. The following variables are provided: * `%{value}` - The original value * `%{user | domain}` - Text after the `@` character, or empty string if there is no `@`. Example: ```doveconf[dovecot.conf] metric imap_command { filter = event=imap_command_finished group_by cmd_name { } group_by tagged_reply_state { } } metric login_domains { filter = event=auth_request_finished fields = user group_by user { method discrete { modifier = %{value | domain | lower} } } } ``` This example configuration will generate statistics for each IMAP command. The first "sub-metric" level is based on the IMAP command name, and the second (and in this example final) level is based on the tagged reply. For example, a `SELECT` IMAP command that succeeded (in other words, it had an `OK` reply) will generate the metric `imap_command_SELECT_ok`. In addition to the final level metric, all intermediate level metrics are generated as well. For example, the same `SELECT` IMAP command will generate all of the following metrics: - `imap_command` - `imap_command_SELECT` - `imap_command_SELECT_ok` Note: While the top level metrics (e.g., `imap_command` above) are generated at start up, all `group_by` metrics are generated dynamically when first observed. ### `exponential` The field's integer value is quantized into exponentially sized ranges. The exponential aggregation method uses three settings: * [[setting,metric_group_by_method_exponential_min_magnitude]] * [[setting,metric_group_by_method_exponential_max_magnitude]] * [[setting,metric_group_by_method_exponential_base]] Note: Currently, only base 2 and base 10 are supported. The first range starts at negative infinity and ends at `pow(base, min_magnitude)`. The second range begins at `pow(base, min_magnitude) + 1` and ends at `pow(base, min_magnitude + 1)`, the next covers `pow(base, min_magnitude + 1) + 1` to `pow(base, min_magnitude + 2)`, and so on. The last range covers `pow(base, max_magnitude) + 1` to positive infinity. For example, given the settings [[setting,metric_group_by_method_exponential_min_magnitude,1]], [[setting,metric_group_by_method_exponential_max_magnitude,5]] and [[setting,metric_group_by_method_exponential_base,10]], the ranges would be: * (-inf, 10] * [11, 100] * [101, 1000] * [1001, 10000] * [10001, 100000] * [100001, +inf) Much like the metric names generated with the [discrete](#discrete) aggregation method, the ones generated by the `exponential` method include information about the value of the field. However, in this case it is the range the value belongs to. Specifically, it is the name of the field being quantized, and the lower and upper bounds for the range. Example: ```doveconf[dovecot.conf] metric imap_command { filter = event=imap_command_finished group_by cmd_name { } group_by duration { method exponential { min_magnitude = 1 max_magnitude = 5 base = 10 } } } ``` This will generate metric names of the format `imap_command_{cmd}_duration_{min}_{max}` where `{cmd}` is the IMAP command name, and `{min}` and `{max}` are the range bounds. Therefore, for a `SELECT` IMAP command, the possible generated metric names are: * `imap_command_SELECT_ninf_10` * `imap_command_SELECT_11_100` * `imap_command_SELECT_101_1000` * `imap_command_SELECT_1001_10000` * `imap_command_SELECT_10001_100000` * `imap_command_SELECT_100001_inf` Note: Since the metric names cannot contain `-`, the string `ninf` is used to denote negative infinity. Note: Much like in the [discrete](#discrete) case, the metrics are allocated only when first observed. Finally, because all intermediate level metrics are generated as well. The above example, will also generate all of the following metrics: - `imap_command` - `imap_command_SELECT` ### `linear` The field's integer value is quantized into linearly sized ranges. The linear aggregation method uses three settings: * [[setting,metric_group_by_method_linear_min]] * [[setting,metric_group_by_method_linear_max]] * [[setting,metric_group_by_method_linear_step]] The first range starts at negative infinity and ends at `min`. The second range begins at `min + 1` and ends at `min + step`, the next covers `min + step + 1` to `min + (2 * step)`, and so on. The last range covers `max + 1` to positive infinity. For example, given settings [[setting,metric_group_by_method_linear_min,0]], [[setting,metric_group_by_method_linear_max,5000]] and [[setting,metric_group_by_method_linear_step,1000]], the ranges would be: * (-inf, 0] * [1, 1000] * [1001, 2000] * [2001, 3000] * [3001, 4000] * [4001, 5000] * [5001, +inf) See the description of the [exponential](#exponential) aggregation method for how metric names are formed from these ranges. ## Listing Statistics The gathered statistics are available by running: ```sh doveadm stats dump ``` Each event has a `duration` field, which tracks in microseconds how long the event existed. For example with `imap_command_finished` field it could be: ``` metric_name field count sum min max avg median stddev %95 imap_commands duration 35 1190122 162 340477 34003 244 31215 188637 ``` The above means: | Field | Description | | ----- | ----------- | | `count` | There have been 35 IMAP commands | | `sum` | The IMAP commands were running in total for 1190122 microseconds (= 1.1 seconds) | | `min` | The fastest IMAP command took 162 microseconds | | `max` | The slowest IMAP command took 340477 microseconds | | `avg` | The average time spent on an IMAP commands was 34003 microseconds | | `median` | The median time spent on an IMAP command was 244 microseconds | | `stddev` | Standard deviation for the time spent on IMAP commands | | `%95` | 95% of the IMAP commands took 188637 microseconds or less | The other fields (than duration) track whatever that field represents. For example with imap_command_finished's `net_in_bytes` field could be tracking how many bytes were being used by the IMAP commands. Non-numeric fields can also be tracked, although only the `count` is relevant to those. The list of fields can be specified with the `-f` parameter. The default is: ```sh doveadm stats dump -f 'count sum min max avg median stddev %95' ``` It's also possible to specify other percentiles than just 95%, for example: ```sh doveadm stats dump -f 'count sum min max avg median stddev %95 %99 %99.9 %99.99' ``` The stats counters are reset whenever the stats process is started, which also means a dovecot reload will reset statistics. Using `doveadm stats -r` parameter will also reset the statistics atomically after they're dumped. ## Modifying Statistics Dynamically Metrics can be added or removed dynamically. The changes do not persist after configuration reload. Metrics can be added dynamically by running [[doveadm,stats add]]. * `exporter`: See [[setting,metric_exporter]]. * `exporter-include`: See [[setting,metric_exporter_include]]. * `fields`: See [[setting,metric_fields]]. * `group-by`: See [[link,stats_group_by]]. * ``: See [[setting,metric_filter]]. For example: ```sh doveadm stats add --description "IMAP SELECT commands" \ --exporter log-exporter --exporter-include "name timestamps" \ --fields "net_in_bytes net_out_bytes" \ --group-by "cmd_name tagged_reply_state" imap_cmd_select \ "event=imap_command_finished AND cmd_name=SELECT" ``` Metrics can be removed dynamically by running [[doveadm,stats remove]]. For example: ```sh doveadm stats remove imap_cmd_select ``` ## Examples ### IMAP Command Statistics ```doveconf[dovecot.conf] metric imap_select_no { filter = event=imap_command_finished AND cmd_name=SELECT AND \ tagged_reply_state=NO } metric imap_select_no_notfound { filter = event=imap_command_finished AND cmd_name=SELECT AND \ tagged_reply="NO*Mailbox doesn't exist:*" } metric storage_http_gets { filter = event=http_request_finished AND category=storage AND \ method=get } # generate per-command metrics on successful commands metric imap_command { filter = event=imap_command_finished AND tagged_reply_state=OK group_by cmd_name { } } ``` ### Push Notifications ```doveconf[dovecot.conf] metric push_notifications { filter = event=push_notification_finished } # for OX driver metric push_notification_http_finished { filter = event=http_request_finished AND category=push_notification } ``` ## OpenMetrics ### Basic Configuration Dovecot has support for [OpenMetrics](https://openmetrics.io/) exposition format for statistics. This can be enabled by adding following configuration: ```doveconf[dovecot.conf] service stats { inet_listener http { port = 9900 } } ``` This will enable Dovecot to expose all configured metrics in OpenMetrics format on `http://host:9900/metrics` using [text-based format](https://prometheus.io/docs/instrumenting/exposition_formats/#text-based-format). ### Statistics Format By default, Dovecot exposes all configured metrics. If the metric name does not conform with OpenMetrics requirements, it is not exported. All metric names are prefixed with `dovecot_` and each non-histogram metric is exported as `dovecot__total` and `dovecot__duration_seconds_total`. Dynamically generated statistics with [group_by](#group-by) will be exported too. The name of the base metric is used as above, and any dynamically generated sub-metrics are exported using labels. Quantized sub-metrics are exported as histograms. Histograms are exported as `dovecot__bucket` with corresponding labels. Each histogram will have an automatically generated `_sum` (specifying sum of all values in quantiles) and `_count` (total number of samples in the quantiles) metrics. Durations, including histogram ranges, are converted to seconds. Dovecot will also export version information and startup time as special metrics even if nothing is configured. These are called `dovecot_build_info` and `process_start_time_seconds`. ### Example An excerpt of an example Dovecot configuration that defines a set of metrics, and the sample exported data with such metrics configuration: ::: code-group ```doveconf[dovecot.conf] metric auth_success { filter = (event=auth_request_finished AND success=yes) } metric imap_command { filter = event=imap_command_finished group_by cmd_name { } group_by tagged_reply_state { } } metric smtp_command { filter = event=smtp_server_command_finished group_by cmd_name { } group_by status_code { } group_by duration { method exponential { min_magnitude = 1 max_magnitude = 5 } } } metric mail_delivery { filter = event=mail_delivery_finished group_by duration { method exponential { min_magnitude = 1 max_magnitude = 5 } } } ``` ```[OpenMetrics Data] # HELP process_start_time_seconds Timestamp of service start # TYPE process_start_time_seconds gauge process_start_time_seconds 1606393397 # HELP dovecot_build Dovecot build information # TYPE dovecot_build info dovecot_build_info{version="2.4.devel",revision="38ecc424a"} 1 # HELP dovecot_auth_success Total number of all events of this kind # TYPE dovecot_auth_success counter dovecot_auth_success_total 892 # HELP dovecot_auth_success_duration_seconds Total duration of all events of this kind # TYPE dovecot_auth_success_duration_seconds counter dovecot_auth_success_duration_seconds_total 0.085479 # HELP dovecot_imap_command Total number of all events of this kind # TYPE dovecot_imap_command counter dovecot_imap_command_total{cmd_name="LIST"} 423 dovecot_imap_command_total{cmd_name="LIST",tagged_reply_state="OK"} 423 dovecot_imap_command_total{cmd_name="STATUS"} 468 dovecot_imap_command_total{cmd_name="STATUS",tagged_reply_state="OK"} 468 dovecot_imap_command_total{cmd_name="SELECT"} 890 dovecot_imap_command_total{cmd_name="SELECT",tagged_reply_state="OK"} 890 dovecot_imap_command_total{cmd_name="APPEND"} 449 dovecot_imap_command_total{cmd_name="APPEND",tagged_reply_state="OK"} 449 dovecot_imap_command_total{cmd_name="LOGOUT"} 892 dovecot_imap_command_total{cmd_name="LOGOUT",tagged_reply_state="OK"} 892 dovecot_imap_command_total{cmd_name="UID FETCH"} 888 dovecot_imap_command_total{cmd_name="UID FETCH",tagged_reply_state="OK"} 888 dovecot_imap_command_total{cmd_name="FETCH"} 2148 dovecot_imap_command_total{cmd_name="FETCH",tagged_reply_state="OK"} 2148 dovecot_imap_command_total{cmd_name="STORE"} 794 dovecot_imap_command_total{cmd_name="STORE",tagged_reply_state="OK"} 794 dovecot_imap_command_total{cmd_name="EXPUNGE"} 888 dovecot_imap_command_total{cmd_name="EXPUNGE",tagged_reply_state="OK"} 888 dovecot_imap_command_count 7840 # HELP dovecot_imap_command_duration_seconds Total duration of all events of this kind # TYPE dovecot_imap_command_duration_seconds counter dovecot_imap_command_duration_seconds_total{cmd_name="LIST"} 0.099115 dovecot_imap_command_duration_seconds_total{cmd_name="LIST",tagged_reply_state="OK"} 0.099115 dovecot_imap_command_duration_seconds_total{cmd_name="STATUS"} 0.161195 dovecot_imap_command_duration_seconds_total{cmd_name="STATUS",tagged_reply_state="OK"} 0.161195 dovecot_imap_command_duration_seconds_total{cmd_name="SELECT"} 0.184907 dovecot_imap_command_duration_seconds_total{cmd_name="SELECT",tagged_reply_state="OK"} 0.184907 dovecot_imap_command_duration_seconds_total{cmd_name="APPEND"} 0.273893 dovecot_imap_command_duration_seconds_total{cmd_name="APPEND",tagged_reply_state="OK"} 0.273893 dovecot_imap_command_duration_seconds_total{cmd_name="LOGOUT"} 0.033494 dovecot_imap_command_duration_seconds_total{cmd_name="LOGOUT",tagged_reply_state="OK"} 0.033494 dovecot_imap_command_duration_seconds_total{cmd_name="UID FETCH"} 0.181319 dovecot_imap_command_duration_seconds_total{cmd_name="UID FETCH",tagged_reply_state="OK"} 0.181319 dovecot_imap_command_duration_seconds_total{cmd_name="FETCH"} 1.169456 dovecot_imap_command_duration_seconds_total{cmd_name="FETCH",tagged_reply_state="OK"} 1.169456 dovecot_imap_command_duration_seconds_total{cmd_name="STORE"} 0.368621 dovecot_imap_command_duration_seconds_total{cmd_name="STORE",tagged_reply_state="OK"} 0.368621 dovecot_imap_command_duration_seconds_total{cmd_name="EXPUNGE"} 0.247657 dovecot_imap_command_duration_seconds_total{cmd_name="EXPUNGE",tagged_reply_state="OK"} 0.247657 dovecot_imap_command_duration_seconds_sum 2.719657 # HELP dovecot_smtp_command Histogram # TYPE dovecot_smtp_command histogram dovecot_smtp_command_bucket{cmd_name="LHLO",status_code="250",le="0.000010"} 0 dovecot_smtp_command_bucket{cmd_name="LHLO",status_code="250",le="0.000100"} 1 dovecot_smtp_command_bucket{cmd_name="LHLO",status_code="250",le="0.001000"} 1 dovecot_smtp_command_bucket{cmd_name="LHLO",status_code="250",le="0.010000"} 1 dovecot_smtp_command_bucket{cmd_name="LHLO",status_code="250",le="0.100000"} 1 dovecot_smtp_command_bucket{cmd_name="LHLO",status_code="250",le="+Inf"} 1 dovecot_smtp_command_sum{cmd_name="LHLO",status_code="250"} 0.000020 dovecot_smtp_command_count{cmd_name="LHLO",status_code="250"} 1 dovecot_smtp_command_bucket{cmd_name="MAIL",status_code="250",le="0.000010"} 0 dovecot_smtp_command_bucket{cmd_name="MAIL",status_code="250",le="0.000100"} 1 dovecot_smtp_command_bucket{cmd_name="MAIL",status_code="250",le="0.001000"} 1 dovecot_smtp_command_bucket{cmd_name="MAIL",status_code="250",le="0.010000"} 1 dovecot_smtp_command_bucket{cmd_name="MAIL",status_code="250",le="0.100000"} 1 dovecot_smtp_command_bucket{cmd_name="MAIL",status_code="250",le="+Inf"} 1 dovecot_smtp_command_sum{cmd_name="MAIL",status_code="250"} 0.000021 dovecot_smtp_command_count{cmd_name="MAIL",status_code="250"} 1 dovecot_smtp_command_bucket{cmd_name="RCPT",status_code="250",le="0.000010"} 0 dovecot_smtp_command_bucket{cmd_name="RCPT",status_code="250",le="0.000100"} 0 dovecot_smtp_command_bucket{cmd_name="RCPT",status_code="250",le="0.001000"} 1 dovecot_smtp_command_bucket{cmd_name="RCPT",status_code="250",le="0.010000"} 1 dovecot_smtp_command_bucket{cmd_name="RCPT",status_code="250",le="0.100000"} 1 dovecot_smtp_command_bucket{cmd_name="RCPT",status_code="250",le="+Inf"} 1 dovecot_smtp_command_sum{cmd_name="RCPT",status_code="250"} 0.000195 dovecot_smtp_command_count{cmd_name="RCPT",status_code="250"} 1 dovecot_smtp_command_bucket{cmd_name="DATA",status_code="250",le="0.000010"} 0 dovecot_smtp_command_bucket{cmd_name="DATA",status_code="250",le="0.000100"} 0 dovecot_smtp_command_bucket{cmd_name="DATA",status_code="250",le="0.001000"} 0 dovecot_smtp_command_bucket{cmd_name="DATA",status_code="250",le="0.010000"} 1 dovecot_smtp_command_bucket{cmd_name="DATA",status_code="250",le="0.100000"} 1 dovecot_smtp_command_bucket{cmd_name="DATA",status_code="250",le="+Inf"} 1 dovecot_smtp_command_sum{cmd_name="DATA",status_code="250"} 0.001249 dovecot_smtp_command_count{cmd_name="DATA",status_code="250"} 1 dovecot_smtp_command_bucket{cmd_name="QUIT",status_code="221",le="0.000010"} 1 dovecot_smtp_command_bucket{cmd_name="QUIT",status_code="221",le="0.000100"} 1 dovecot_smtp_command_bucket{cmd_name="QUIT",status_code="221",le="0.001000"} 1 dovecot_smtp_command_bucket{cmd_name="QUIT",status_code="221",le="0.010000"} 1 dovecot_smtp_command_bucket{cmd_name="QUIT",status_code="221",le="0.100000"} 1 dovecot_smtp_command_bucket{cmd_name="QUIT",status_code="221",le="+Inf"} 1 dovecot_smtp_command_sum{cmd_name="QUIT",status_code="221"} 0.000010 dovecot_smtp_command_count{cmd_name="QUIT",status_code="221"} 1 # HELP dovecot_mail_delivery Histogram # TYPE dovecot_mail_delivery histogram dovecot_mail_delivery_bucket{le="0.000010"} 0 dovecot_mail_delivery_bucket{le="0.000100"} 0 dovecot_mail_delivery_bucket{le="0.001000"} 1 dovecot_mail_delivery_bucket{le="0.010000"} 1 dovecot_mail_delivery_bucket{le="0.100000"} 1 dovecot_mail_delivery_bucket{le="+Inf"} 1 dovecot_mail_delivery_sum 0.000656 dovecot_mail_delivery_count 1 # EOF ``` ::: # Submission Server Dovecot provides an SMTP submission service, also known as a Mail Submission Agent (MSA) ([[rfc,6409]]). ::: danger It is currently implemented as a proxy that acts as a front-end for any [[link,mta]], adding the necessary functionality required for a submission service: it adds the required AUTH ([[rfc,4954]]) support, avoiding the need to configure the MTA for [[link,sasl]]. ::: ::: danger Dovecot's submission server is NOT a full-featured SMTP server. It REQUIRES proxying to an external relay SMTP submission server to deliver non-local messages. ::: It is currently implemented as a [[link,login_proxy,proxy]] that acts as a front-end for any [[link,mta]], adding the necessary functionality required for a submission service: it adds the required AUTH ([[rfc,4954]]) support, avoiding the need to configure the MTA for [[link,sasl]]. Additionally, the client TLS layer is terminated at Dovecot (either with or without STARTTLS), so that all mail protocol certificates are handled solely by Dovecot and do not need to be configured in the MTA (although inter-server TLS encryption can be enabled if needed.) More SMTP capabilities like CHUNKING ([[rfc,3030]]) and SIZE ([[rfc,1870]]) are supported, without requiring the backend MTA supporting these extensions. Other capabilities like 8BITMIME ([[rfc,6152]]) and DSN ([[rfc,3461]]) currently require support from the backend/relay MTA. The most notable feature that the proxy adds is the BURL capability ([[rfc,4468]]). The main application of that capability, together with [[link,imap_server]] and URLAUTH ([[rfc,4467]]), is avoiding a duplicate upload of submitted e-mail messages. Normally the message is both sent through SMTP and uploaded to the `Sent` folder through IMAP. Using BURL, the client can first upload the message to IMAP and then use BURL to make the SMTP server fetch the message from IMAP for submission, thereby avoiding a second upload. Few clients currently support the BURL capability, but once it becomes available on the server side, client developers will at least have some incentive to provide support for this feature. ::: warning Currently, the submission proxy is still pretty basic. However, it will provide a basis for adding all kinds of functionality in the (not so distant) future. For the first time, it will be possible to act upon message submission, rather than only message retrieval; e.g. plugins can be devised that process outgoing messages somehow. Examples of the things that could be implemented are adding Sieve filtering support for outgoing messages, or implicitly storing submitted messages to the Sent folder. Once a plugin API is devised, you can create your own plugins. ::: The submission service, when protocol submission is enabled, will listen to 587/tcp (STARTTLS) by default. ## Features The following SMTP capabilities are supported by the Dovecot submission service: * **8BITMIME** ([[rfc,6152]]): Only if relay MTA provides support * **AUTH** ([[rfc,4954]]) * **BURL** ([[rfc,4468]]) * **CHUNKING** ([[rfc,3030]]) * **DSN** ([[rfc,3461]]): Only if relay MTA provides support * **ENHANCEDSTATUSCODES** ([[rfc,2034]]) * **PIPELINING** ([[rfc,2920]]) * **SIZE** ([[rfc,1870]]) * **STARTTLS** ([[rfc,3207]]) * **VRFY** ([[rfc,5321]]) * **XCLIENT**: See https://www.postfix.org/XCLIENT_README.html ## Flow Diagram ## Configuration ### Submission Service Add `submission` to the [[setting,protocols]] setting and configure the relay MTA server. The submission service is a login service, just like IMAP, POP3 and [[link,managesieve]], so clients are required to authenticate. The same [[link,authentication,authentication configuration]] will apply to the submission service, unless you're doing protocol-specific things, in which case you may need to amend your configuration for the new protocol. BURL support requires a working IMAP URLAUTH implementation. See [[setting,imap_urlauth_host]]. #### Settings ### Relay MTA The Dovecot SMTP submission service directly proxies the mail transaction to the SMTP relay. #### Settings ### Login Proxy Like IMAP and POP3, the Submission login service supports [[link,authentication_proxies,proxying]] to multiple backend Dovecot servers. ::: warning Please note that the login proxy described here is configured between two Dovecot servers (e.g. proxy frontend and mail storage backend). This is not the way to configure the relay connection between the Dovecot submission service and the MTA! That is configured using the relay settings described in the previous section. If you get this wrong, things will seem to work (at least to some extent), but the service provided by Dovecot will be effectively bypassed. ::: ### SMTPS To listen on SMTPS port (465/tcp), add this to `dovecot.conf`: ```doveconf[dovecot.conf] service submission-login { inet_listener submissions { port = 465 ssl = yes } } ``` ## Design The Dovecot submission service is structured very much like the imap and pop3 services, meaning that it has separate pre-login and post-login services called submission-login and submission respectively. The pre-login service can be chrooted and can be devoid of most privileges and only serves to operate the TLS layer and perform authentication. This serves to isolate the sensitive SMTP functionality from unauthorized access, also when the frontend were compromised. Once authenticated, the connection is handed over to the post-login service. The post-login service checks the validity of the SMTP transactions and forwards them on the fly to the backend MTA, while also translating or handling capabilities such as BURL and CHUNKING; e.g., when the backend MTA provides no support for these features. For the BURL capability, the post-login service has direct access to the user's mail storage. Proxying for the submission service works identical to the imap and pop3 services. This means that the submission-login service proxies to another Dovecot backend instance that handles the subsequent relay to the MTA infrastructure. In this case there is proxying between two Dovecot instances and a relay from the Dovecot backend instance to a non-Dovecot backend MTA. ::: danger IMPORTANT It is explicitly not supported to use submission-login to proxy directly to a backend MTA. This would mean that after authentication the connection is proxied directly to the external non-Dovecot MTA, which will then completely handle the SMTP protocol exchange. Although authentication and TLS can still operate this way, the other features and additional protocol verification that Dovecot submission adds will be broken. Additionally, the submission-login service is likely to lie to the client about which SMTP capabilities are supported by the service, since the announced capabilities and those provided by the MTA will likely differ. ::: # System Users Configuration Dovecot typically requires 3 or more system users: * `root`: Dovecot is started as root. * [`dovenull`](#dovenull-user): Dovecot uses an unprivileged user for untrusted login processes. * [`dovecot`](#dovecot-user): Dovecot uses an unprivileged user for internal processes. * [`mail user(s)`](#mail-users): Mails are accessed using yet another user. The mail user should NOT be `dovecot` user. * [`auth user`](#authentication-process-user): Password and user database lookups are done as auth user. Using multiple users allows privilege separation, which makes it harder for attackers to compromise the whole system if a security hole is found from one component. However, if you really want to run everything under a single user, it is possible. See [[link,rootless]]. ## `dovenull` user `dovenull` user is used internally for processing users' logins. It shouldn't have access to any files, authentication databases or anything else either. It should belong to its own private `dovenull` group where no one else belongs to, and which doesn't have access to any files either (other than what Dovecot internally creates). You can change the default `dovenull` user to something else via [[setting,default_login_user]]. ## `dovecot` user `dovecot` user is used internally for unprivileged Dovecot processes. It should belong to its own private `dovecot` group. Mail files are not accessed as dovecot user, so you shouldn't give it access to mails. You can change the default `dovecot` user to something else via [[setting,default_internal_user]]. ## Mail Users You can use one or more system users for accessing users' mails. Most configurations can be placed to two categories: 1. [[link,system_users]], where each Dovecot user has their own system user in `/etc/passwd`. For system user setups you generally don't have to worry about UIDs or GIDs, they are returned by [[link,auth_passwd]]. 2. [[link,virtual_users]], where all Dovecot users run under a single system user. Typically you'd set this with [[setting,mail_uid]] (e.g. `mail_uid=vmail`). Note that you most likely don't want the userdb lookup to return any UID/GID, as they override [[setting,mail_uid]]. However it's possible to use a setup that is anything between these two. For example use a separate system user for each domain. See below for more information about how UIDs can be used. ### UIDs Dovecot's [[link,userdb]] configuration calls system users UIDs. There are a few things you should know about them: * Although UID normally means a numeric ID (as specified by `/etc/passwd`), it's anyway possible to use names as UID values and let Dovecot do the lookup (eg. `uid=vmail`). However depending on where you used it, it may slow down the authentication. * The UIDs don't really have to exist in `/etc/passwd` (the kernel doesn't care about that). For example you could decide to use UIDs 10000-59999 for 50000 virtual Dovecot users. You'll then just have to be careful that the UIDs aren't used unintentionally elsewhere. * The important thing to consider with your UID allocation policy is that if Dovecot has a security hole in its IMAP or POP3 implementation, the attacker can read mails of other people who are using the same UID. So clearly the most secure way is to allocate a different UID for each user. It can however be a bit of a pain and OSes don't always support more than 65536 UIDs. * By default Dovecot allows users to log in only with UID numbers 500 and above. This check tries to make sure that no-one can ever log in as daemons or other system users. If you're using an UID lower than 500, you'll need to change [[setting,first_valid_uid]]. ### GIDs System groups (GIDs) work very much the same way as UIDs described above: You can use names instead of numbers for GID values, and the used GIDs don't have to exist in `/etc/group`. System groups are useful for sharing mailboxes between users that have different UIDs but belong to a same group. Currently Dovecot doesn't try to do anything special with the groups, so if you're not sure how you should create them, you might as well place all the users into a single group or create a separate group for each user. If you use multiple UIDs and you wish to create [[link,shared_mailboxes]], setting up the groups properly may make your configuration more secure. For example if you have two teams and their mailboxes are shared only to their team members, you could create a group for each team and set the shared mailbox's group to the team's group and permissions to `0660`, so neither team can even accidentally see each others' shared mailboxes. Currently Dovecot supports specifying only the primary group, but if your userdb returns `system_user` [[link,userdb_extra_fields]], the non-primary groups are taken from `/etc/group` for that user. In a future version the whole GID list will be configurable without help from `/etc/group`. It's also possible to give all the users access to extra groups with [[setting,mail_access_groups]]. ## Authentication Process User Depending on passdb and userdb configuration, the lookups are done either by auth process or auth worker process. They have different default users: ```doveconf[dovecot.conf] service auth { user = $SET:default_internal_user } service auth-worker { user = root } ``` The user must have access to your [[link,passdb]] and [[link,userdb]]. It's not used for anything else. The default is to use `root`, because it's guaranteed to have access to all the password databases. If you don't need this, you should change it to `$SET:default_internal_user`. [[link,auth_pam]] is usually configured to read `/etc/shadow` file. Even this doesn't need root access if the file is readable by shadow group: ```doveconf[dovecot.conf] service auth-worker { user = $SET:default_internal_user group = shadow } ``` # Time Synchronization Dovecot relies on accurate time on synchronization the local system. There are two choices for synchronizing your clock: 1. Use [ntpd](https://www.ntp.org/). It periodically checks the current time from NTP server and slows down or speeds up the clock if necessary. Unlike ntpdate, it doesn't just move the time forwards or backwards (unless the difference is large). - If the time difference is too large for ntpd and it "steps", then use "-x" as a command line option for ntpd or use "tinker step 0" in `/etc/ntp.conf`. - This shows up in logs as: `ntpd[17697]: time reset -2.075483 s` 2. If ntpd doesn't work well (e.g. a bad network connection), you can use [clockspeed](https://cr.yp.to/clockspeed.html) or [chrony](https://chrony.tuxfamily.org/) as well. In some systems ntpd/ntpdate is run at boot, but only after Dovecot has started. That can cause Dovecot to die immediately. If you have this problem, fix your init scripts to run ntpd/ntpdate first, before starting Dovecot. Also, seriously consider running ntp-wait before starting Dovecot. ## Server Startup Time Synchronization With systemd add `time-sync.target` to the `After` setting. This isn't enough though, because it only waits for time-sync to start, not finish. To do that, enable also `systemd-time-wait-sync.service`. ## What about Daylight Saving/Summer Time? On Unix-like systems, time is stored internally as the number of seconds since January 1, 1970, 00:00:00 UTC (see [UNIX time](https://en.wikipedia.org/wiki/Unix_time)); concepts such as time zones and daylight saving time are applied in user space by the C library, and will normally not have an impact on Dovecot's behavior. ## "But Dovecot Shouldn't Just Die!" Dovecot's behavior when time moves backwards is: - Existing imap and pop3 processes either sleep or die - Master process stops creating new processes until either the original time is reached, or after a maximum wait of 3 minutes. - Other processes log a warning, but do nothing else. - Timeouts are updated so that the timeout is executed approximately at the original intended time. Dovecot also notices when time unexpectedly jumps forwards. In that situation it logs a warning and also updates timeouts. The reason why imap/pop3 processes get killed and new ones can't be created for a while is to avoid problems related to timestamps. Some issues are: - Uniqueness of Maildir filenames and dbox global unique identifiers relies on a growing timestamp. - Dotlock files' staleness is detected by looking at its mtime. - Timestamps are stored internally all around in memory (as well as in index files) and compared to current time. Those checks may or may not be buggy if current time shrinks. While killing mail processes doesn't fully solve any of those issues, they're at least less likely to happen then. # doveadm-acl(1) - Manage Access Control List (ACL) ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **acl** *command* [*OPTIONS*] [*ARGUMENTS*] ## DESCRIPTION The **doveadm acl** *COMMANDS* can be used to execute various Access Control List related actions. This command uses by default the output formatter **table**. ## OPTIONS ## ARGUMENTS *id* : The id (identifier) is one of: * **group-override** = *group_name* * **user** = *user_name* * **owner** * **group** = *group_name* * **authenticated** * **anyone** * **anonymous**, which is an alias for anyone The ACLs are processed in the precedence given above, so for example if you have given read-access to a group, you can still remove that from specific users inside the group. Group-override identifier allows you to override users' ACLs. Probably the most useful reason to do this is to temporarily disable access for some users. For example: ``` user=timo rw group-override=tempdisabled ``` Now if timo is a member of the tempdisabled group, he has no access to the mailbox. This wouldn't be possible with a normal group identifier, because the **user=timo** would override it. *mailbox* : The name of the mailbox, for which the ACL manipulation should be done. It's also possible to use the wildcard characters "*****" and/or "**?**" in the mailbox name. *right* : Dovecot ACL right name. This isn't the same as the IMAP ACL letters, which aren't currently supported. Here is a mapping of the IMAP ACL letters to Dovecot ACL names: : **l -> lookup** : *Mailbox* is visible in mailbox list. *Mailbox* can be subscribed to. : **r -> read** : *Mailbox* can be opened for reading. : **w -> write** : Message flags and keywords can be changed, except **\Seen** and **\Deleted**. : **s -> write-seen** : **\Seen** flag can be changed. : **t -> write-deleted** : **\Deleted** flag can be changed. : **i -> insert** : Messages can be written or copied to the *mailbox*. : **p -> post** : Messages can be posted to the *mailbox* by **dovecot-lda**, e.g. from Sieve scripts. : **e -> expunge** : Messages can be expunged. : **k -> create** : Mailboxes can be created/renamed directly under this *mailbox* (but not necessarily under its children, see [[link,acl_inheritance]]. Note: Renaming also requires the delete right. : **x -> delete** : *Mailbox* can be deleted. : **a -> admin** : Administration rights to the *mailbox* (currently: ability to change ACLs for *mailbox*). ## COMMANDS ### acl add **doveadm** [*GLOBAL OPTIONS*] acl add [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox id* *right* [*right* ...] Add ACL rights to the *mailbox*/*id*. If the *id* already exists, the existing rights are preserved. ### acl debug **doveadm** [*GLOBAL OPTIONS*] acl debug [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox* This command can be used to debug why a shared mailbox isn't accessible to the user. It will list exactly what the problem is. ### acl delete **doveadm** [*GLOBAL OPTIONS*] acl delete [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox id* Remove the whole ACL entry for the *mailbox*/*id*. ### acl get **doveadm** [*GLOBAL OPTIONS*] acl get [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-m**] *mailbox* Show all the ACLs for the *mailbox*. **-m** : Only show ACLs that match the mailbox. ### acl recalc **doveadm** [*GLOBAL OPTIONS*] acl recalc [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] Make sure the *user*'s shared mailboxes exist correctly in the *acl_sharing_map*. ### acl remove **doveadm** [*GLOBAL OPTIONS*] acl remove [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox id* *right* [*right* ...] Remove the specified ACL rights from the *mailbox*/*id*. If all rights are removed, the entry still exists without any rights. ### acl rights **doveadm** [*GLOBAL OPTIONS*] acl rights [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox* Show the *user*'s current ACL rights for the *mailbox*. ### acl set **doveadm** [*GLOBAL OPTIONS*] acl set [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox id* *right* [*right* ...] Set ACL rights to the *mailbox*/*id*. If the *id* already exists, the existing rights are replaced. ## SEE ALSO [[man,doveadm]] Additional resources: - [[link,acl_inheritance]] # doveadm-altmove(1) - Move matching mails to the alternative storage (dbox-only) ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **altmove** [**-r**] [**-S** *socket_path*] **-A** *search_query* **doveadm** [*GLOBAL OPTIONS*] **altmove** [**-r**] [**-S** *socket_path*] **-F** *file search_query* **doveadm** [*GLOBAL OPTIONS*] **altmove** [**-r**] [**-S** *socket_path*] **\-\-no-userdb-lookup** *search_query* **doveadm** [*GLOBAL OPTIONS*] **altmove** [**-r**] [**-S** *socket_path*] **-u** *user search_query* ## DESCRIPTION This command can be used with sdbox or mdbox storage to move mails to alternative storage path when *mail_alt_path* is specified for the mail location. In the first form, [[man,doveadm]] will execute the **altmove** for all users. In the second form, the command will be performed for all users listed in the given *file*. In the third form, the command will be performed for the user contained in the *USER* environment variable. In the last form, only matching mails of the given *user*(s) will be moved to the alternative storage. ## OPTIONS **-r** : When the **-r** option is given this *command* works the other way round. Mails will be moved from the alternative storage back to the default mail location. ## ARGUMENTS *search_query* : Messages matching this search query will be moved to alt storage. See [[man,doveadm-search-query,,7]] for details. ## FILES */etc/dovecot/conf.d/10-mail.conf* : Mailbox locations and namespaces. ## EXAMPLE This example moves seen mails older than one week to alternative storage under /nfsmount: ```doveconf[dovecot.conf] mail_driver = mdbox mail_path = ~/mdbox mail_alt_path = /nfsmount/%{home}/mdbox ``` ```sh doveadm altmove -u johnd@example.com seen savedbefore 1w< ``` ## SEE ALSO [[man,doveadm]] # doveadm-auth(1) - Flush/lookup/test authentication data ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **auth** *command* [*OPTIONS*] [*ARGUMENTS*] ## DESCRIPTION The **doveadm auth** *COMMANDS* can be used to perform various authentication related actions. ## OPTIONS ## ARGUMENTS *user* : The *user*'s login name. Depending on the configuration, the login name may be for example **jane** or **john@example.com**. *password* : Optionally the user's password. [[man,doveadm]] will prompt for the password, if none was given. ## COMMANDS ### auth cache flush **doveadm** [*GLOBAL OPTIONS*] auth cache flush [**-a** *master_socket_path*] [*user-mask* ...] Flush the authentication cache. By default the cache is flushed for all the users. You can also flush the cache for one or more users by providing a user-mask matching their usernames. **-a** *master_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket. By default [[man,doveadm]] will use the socket */rundir/auth-master*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. ### auth cache status **doveadm** [*GLOBAL OPTIONS*] auth cache status [**-a** *master_socket_path*] [**--reset**] Show authentication cache statistics: number of hits, misses, hit ratio, number of positive/negative cache entries and the positive/negative/used/max cache sizes. This information can be used for tuning the cache size and TTL. **-a** *master_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket. By default [[man,doveadm]] will use the socket */rundir/auth-master*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **--reset** : Reset the hit/miss/insert counters after reading them. ### auth lookup **doveadm** [*GLOBAL OPTIONS*] auth lookup [**-a** *userdb_socket_path*] [**-x** *auth_info*] [**-f** *field*] *user* [...] Similar to [[man,doveadm-user]] command, except it performs a *passdb* lookup (without authentication) instead of a *userdb* lookup. **-a** *userdb_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket. By default [[man,doveadm]] will use the socket */rundir/auth-userdb*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **-f** *field* : When this option and the name of a userdb field is given, [[man,doveadm]] will show only the value of the specified field. ### auth test **doveadm** [*GLOBAL OPTIONS*] auth test [**-a** *auth_socket_path*] [**-A** *sasl_mech*] [**-x** *auth_info*] *user* [*password*] Test authentication for the given user. **-a** *auth_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket. By default [[man,doveadm]] will use the socket */rundir/auth-client*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **-A** *sasl_mech* : The SASL mechanism used for the authentication. By default PLAIN is used. ### auth login **doveadm** [*GLOBAL OPTIONS*] auth login [**-a** *auth_socket_path*] [**-m** *auth_master_socket_path*] [**-A** *sasl_mech*] [**-x** *auth_info*] *user* [*password*] Test full login for the given user; i.e. performing both passdb lookup (authentication) and userdb lookup (login). **-a** *auth_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket. By default [[man,doveadm]] will use the socket */rundir/auth-client*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **-m** *auth_master_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket for the master socket. By default [[man,doveadm]] will use the socket */rundir/auth-master*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **-A** *sasl_mech* : The SASL mechanism used for the authentication. By default PLAIN is used. ## EXAMPLE This example demonstrates an imap authentication test for user john, assuming the user is connected from the host with the IP address 192.0.2.143. ```sh doveadm auth test -x service=imap -x rip=192.0.2.143 john ``` ``` Password: passdb: john auth succeeded extra fields: user=john ``` ## SEE ALSO [[man,doveadm]] # doveadm-backup(1) - Dovecot's one-way mailbox synchronization feature # doveadm compress-connect(1) - Establish a compress-aware imap connection ## SYNOPSIS **doveadm compress-connect** *host* [*port*] ## DESCRIPTION Connects to a compression-enabled IMAP service at given *host:port*. **doveadm-compress-connect** takes care of the compression/decompression, and to switch it on at the appropriate moment when the client sends the IMAP command **COMPRESS DEFLATE** ## ARGUMENTS * *host* - the hostname/ip address to connect to * *port* - the port to connect to, 143 by default ## SEE ALSO [[man,doveadm]], [[rfc,4978]] # doveadm-copy(1) - Copy messages matching the given search query into another mailbox # doveadm-deduplicate(1) - Expunge duplicate messages ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **deduplicate** [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-m**] *search_query* ## DESCRIPTION This command is used to expunge duplicated messages in mailboxes. **doveadm deduplicate** is mainly useful to revert some (more or less) accidental duplication of messages, e.g. after **doveadm copy** or **doveadm import**. [[man,doveadm]] will delete the newest duplicated messages from the mailbox and keep the oldest. Deduplication across multiple mailboxes is not supported. ## OPTIONS **-m** : if the **-m** option is given, [[man,doveadm]] will deduplicate by Message-Id header. By default deduplication will be done by message GUIDs. ## ARGUMENTS *search_query* : expunge duplicates found from messages matching the given search query. Typically a search query like '**mailbox** *mailbox_name* **OR mailbox** *other_box*' will be sufficient. See [[man,doveadm-search-query,,7]] for details. ## EXAMPLE This example shows how to list and expunge duplicate messages from a mailbox. ```sh doveadm -f table fetch -u jane 'guid uid' mailbox a_Box | sort ``` ``` guid uid 8aad0f0a30169f4bea620000ca356bad 18751 8aad0f0a30169f4bea620000ca356bad 18756 923e301ab9219b4b4f440000ca356bad 18748 923e301ab9219b4b4f440000ca356bad 18753 ... ``` ```sh doveadm deduplicate -u jane mailbox a_Box doveadm -f table fetch -u jane 'guid uid' mailbox a_Box | sort ``` ``` guid uid 8aad0f0a30169f4bea620000ca356bad 18751 923e301ab9219b4b4f440000ca356bad 18748 a7999e1530739c4bd26d0000ca356bad 18749 ... ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-import]] # doveadm-dict(1) - Commands related to dictionary manipulation # doveadm-dump(1) - Dump the content of Dovecot's binary mailbox index/log ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **dump** [**-t** *type*] *path* [*type-specific args*] ## DESCRIPTION Dovecot uses several binary index and log files in order to improve performance for accessing mails. For some mailbox formats, such as sdbox and mdbox, the index files are part of the format itself. For details about index files, see [[link,design_index_format_main]. **doveadm dump** is used to show the contents of those mailbox index/log files, in human readable format. This is mainly useful for Dovecot developers when debugging some problem. ## OPTIONS **-t** *type* : the file type of the file to be dumped. If the *type* was omitted, [[man,doveadm]] tries to detect the type of *path*. *type* can be: : **dbox** : => m.*n* (sdbox or mdbox mailbox file) : **fts-expunge-log** : Dump the list of expunged mails in *dovecot-expunges.log*. : **fts-flatcurve** : Dump the keywords indexed in *fts-flatcurve* indexes directory and their frequencies. : **imap-compress** : Decompress an IMAP traffic log, which contains data compressed using the IMAP COMPRESSION extension. : **dcrypt-file** : Dump metadata of a dcrypt encrypted file. *type-specific args* : **private_key**=*/path* : to decrypt file contents. : **password**=*secret* : to decrypt private key. : **dcrypt-key** : Dump metadata of a dcrypt key. *type-specific args* : **private_key**=*/path* : to decrypt file contents. : **password**=*secret* : to decrypt private key. : **dump**=*pem|dovecot|jwk* : to specify format to dump in. : **index** : => dovecot.index, dovecot.map.index *type-specific args* : **uid**=*number* : Dump only message with UID : **log** : => dovecot.index.log, dovecot.map.index.log : **mailboxlog** : => dovecot.mailbox.log : **thread** : => dovecot.index.thread ## ARGUMENTS *path* : The path to the corresponding dbox storage, index or log file. If only a directory is specified, doveadm tries to detect the type of files under it and dumps them. ## EXAMPLE Look at the contents of a mailbox's index: ```sh doveadm dump ~/Maildir/.work/ ``` ## SEE ALSO [[man,doveadm]] # doveadm-exec(1) - Easily execute commands from Dovecot's libexec directory. ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **exec** *binary* [*binary arguments*] ## DESCRIPTION This command allows administrators and local users to simply execute commands from within */usr/libexec/dovecot*. So for example a logged in system user could start a pre-authenticated imap session, using the command: **doveadm exec imap**. An administrator would use the command **doveadm exec imap -u** *username*. ## ARGUMENTS *binary* : the name of an executable located in */usr/libexec/dovecot*. *binary arguments* : options and arguments, which will be passed through to the *binary*. ## EXAMPLE This example demonstrates how to deliver a message from a file to a user's mailbox. ```sh doveadm exec dovecot-lda -d user@example.net -f admin@example.net < ~/stuff/welcome.msg ``` SEE ALSO [[man,doveadm]] # doveadm-expunge(1) - Expunge messages matching given search query ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **expunge** [**-S** *socket_path*] [**-d**] **-A** *search_query* **doveadm** [*GLOBAL OPTIONS*] **expunge** [**-S** *socket_path*] [**-d**] **-F** *file* *search_query* **doveadm** [*GLOBAL OPTIONS*] **expunge** [**-S** *socket_path*] [**-d**] **\-\-no-userdb-lookup** *search_query* **doveadm** [*GLOBAL OPTIONS*] **expunge** [**-S** *socket_path*] [**-d**] **-u** *user* *search_query* ## DESCRIPTION This command can be used to expunge mails matching the given search query. It is typically used to expunge old mails from users' Trash and/or Spam mailboxes. To test which messages a given search query would match, you can use *doveadm fetch* or *doveadm search* commands. In the first form, the command will be performed for all users. In the second form, [[man,doveadm]] will expunge messages of the users listed in the given *file*. In the third form, the command will be performed for the user contained in the *USER* environment variable. In the final form, only matching mails of the given *user* (s) will be expunged. ## OPTIONS **-d** : Delete the mailbox if it is empty after expunging. ## ARGUMENTS *search_query* : Expunge messages matching this search query. See [[man,doveadm-search-query,,7]] for details. A mailbox parameter is REQUIRED. A message range limiter is REQUIRED. In other words, you must have at least one query parameter that limits the message range. If all messages are needed, the "all" query parameter can be used. ## EXAMPLE This example expunges messages from Spam mailbox that were saved/copied there more than two weeks ago: ```sh doveadm expunge -u jane.doe@example.org mailbox Spam savedbefore 2w ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-search]] # doveadm-fetch(1) - Fetch partial/full messages or message information ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **fetch** [**-S** *socket_path*] **-A** *fields* *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **fetch** [**-S** *socket_path*] **-F** *file* *fields* *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **fetch** [**-S** *socket_path*] **\-\-no-userdb-lookup** *fields* *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **fetch** [**-S** *socket_path*] **-u** *user* *fields* *search_query* ## DESCRIPTION **doveadm fetch** can be used to fetch messages' contents and metadata. This can be useful for scripts and for debugging. If you want to fetch messages one at a time, see [[man,doveadm-search]]. - Please respect your users' privacy. This command uses by default the output formatter **pager**. ## OPTIONS ## ARGUMENTS *fields* : One or more result field names to display, if the *search_query* matches any messages. In order to specify multiple fields, enclose them in single or double quotes. Supported *fields* are: : **binary** : Message body in decoded format. : **binary.\** : Part of the body decoded, e.g. binary.1 : **body** : The body of a message. : **body.\** : Part of the body, e.g. body.1 : **body.preview** : Short preview of the body. : **body.snippet** : Old alias for preview. : **date.received** : Date and time of final delivery, when the message was delivered to a user's mailbox for the first time. The internal date and time of the source message, when the message was copied by the IMAP COPY command. The date-time attribute when present, otherwise the current time, when the message was saved by the IMAP APPEND command. : **date.received.unixtime** : date.received as unix timestamp. : **date.saved** : Date and time when the message was saved to mailbox. : **date.saved.unixtime** : date.saved as unix timestamp. : **date.sent** : Date and time of the message's Date: header. : **date.sent.unixtime** : date.sent as unix timestamp. : **flags** : A message's IMAP flags, e.g. \\Seen : **guid** : A message's globally unique identifier. : **hdr** : The header of the message. : **hdr.\** : Named header from the message. : **imap.body** : IMAP BODY output of the message (see [[rfc,3501]]). : **imap.bodystructure** : IMAP BODYSTRUCTURE output of the message (see [[rfc,3501]]). : **imap.envelope** : IMAP ENVELOPE output of the message (see [[rfc,3501]]). : **mailbox** : Name of the mailbox, in which the message is stored. The name is in UTF-8. : **mailbox-guid** : The globally unique identifier of the mailbox, in which the message is located. : **modseq** : Modification sequence number for the mail. : **pop3.order** : A message's order number within a mailbox. : **pop3.uidl** : A message's unique (POP3) identifier within a mailbox. : **refcount** : Mail reference count, mdbox only. : **seq** : A message's sequence number in a mailbox. : **size.physical** : A message's physical size. : **size.virtual** : A message's virtual size, computed with CRLF line terminators. : **storageid** : Mailbox driver specific ID for the mail. : **text** : The entire message (header and body). : **text.utf8** : The entire message (header and body) — UTF-8 encoded. : **uid** : A message's unique (IMAP) identifier in a mailbox. : **user** : A message owner's login name. *search_query* : Fetch messages matching this search query. See [[man,doveadm-search-query,,7]] for details. ## EXAMPLE This example based on the first example from [[man,doveadm-search]]. We are fetching the fields **mailbox** and **date.sent** from user bob's mailbox with the guid "3a94c928d66ebe4bda04000015811c6a" for the messages with the UIDs **8**, **25** and **45**. ```sh doveadm fetch -u bob "mailbox date.sent" mailbox-guid 3a94c928d66ebe4bda04000015811c6a uid 8,25,45 ``` ``` mailbox: dovecot/pigeonhole/2.0 date.sent: 2010-01-19 01:17:41 (+0100) ^L mailbox: dovecot/pigeonhole/2.0 date.sent: 2010-01-28 09:38:49 (+0100) ^L mailbox: dovecot/pigeonhole/2.0 date.sent: 2010-03-28 18:41:14 (+0200) ``` ## SEE ALSO [[man,doveadm]] # doveadm-flags(1) - Add, remove or replace messages' flags ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **flags** [**-S** *socket_path*] **-A** *command flags* *search_query* **doveadm** [*GLOBAL OPTIONS*] **flags** [**-S** *socket_path*] **-F** *file* *command flags* *search_query* **doveadm** [*GLOBAL OPTIONS*] **flags** [**-S** *socket_path*] **\-\-no-userdb-lookup** *command flags* *search_query* **doveadm** [*GLOBAL OPTIONS*] **flags** [**-S** *socket_path*] **-u** *user* *command flags* *search_query* ## DESCRIPTION This command is used to manipulate flags of messages. ## OPTIONS ## ARGUMENTS *flags* : Message flags as described in [[rfc,3501]], section 2.3.2 (Flags Message Attribute): **\\Answered**, **\\Deleted**, **\\Draft**, **\\Flagged**, **\\Recent** and **\\Seen**. And the IMAP keywords **\$Forwarded**, **\$MDNSent**, **\$SubmitPending** and **\$Submitted** or user-defined keywords, e.g. **Junk**, **\$NonSpam** or **\$Label1**. One or multiple flags and/or keywords can be specified. *search_query* : Manipulate the flags of messages matching the given search query. See [[man,doveadm-search-query,,7]] for details. ## COMMANDS ### flags add **doveadm** [*GLOBAL OPTIONS*] flags add [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *flags search_query* This command is used to extend the current set of flags with the given *flags*. ### flags remove **doveadm** [*GLOBAL OPTIONS*] flags remove [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *flags search_query* In order to remove the given *flags* from the current set of flags, use this command. ### flags replace **doveadm** [*GLOBAL OPTIONS*] flags replace [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *flags search_query* This command is used to replace ALL current flags with the given *flags*. ## EXAMPLE List and manipulate the message flags of the message with uid 81563: ```sh doveadm fetch -u bob 'uid flags' mailbox dovecot uid 81563 ``` ``` uid: 81563 flags: \Answered \Seen NonJunk ``` ```sh doveadm flags remove -u bob NonJunk mailbox dovecot uid 81563 doveadm flags add -u bob '\Flagged $Forwarded' mailbox dovecot uid 81563 ``` ## SEE ALSO [[man,doveadm]] # doveadm-force-resync(1) - Repair broken mailboxes ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **force-resync** [**-S** *socket_path*] **-A** *mailbox* **doveadm** [*GLOBAL OPTIONS*] **force-resync** [**-S** *socket_path*] **-F** *file* *mailbox* **doveadm** [*GLOBAL OPTIONS*] **force-resync** [**-S** *socket_path*] **\-\-no-userdb-lookup** *mailbox* **doveadm** [*GLOBAL OPTIONS*] **force-resync** [**-S** *socket_path*] **-u** *user* *mailbox* ## DESCRIPTION Under certain circumstances it may happen, that [[man,dovecot]] is unable to automatically solve problems with mailboxes. In such situations the **force-resync** command may be helpful. It tries to fix all problems. For sdbox and mdbox mailboxes the storage files will be also checked. ## OPTIONS ## ARGUMENTS *mailbox* : The name of the mailbox to fix. With mdbox all of the mailboxes are fixed, so you can use for example INBOX as the name. ## EXAMPLE Fix bob's INBOX: ```sh doveadm force-resync -u bob INBOX ``` ## SEE ALSO [[man,doveadm]] # doveadm-fs(1) - Interact with the abstract mail storage filesystem # doveadm-fts(1) - Manipulate the Full Text Search (FTS) index ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **fts** *command* [*OPTIONS*] [*ARGUMENTS*] ## DESCRIPTION The doveadm fts *COMMANDS* can be used to manipulate the Full Text Search (FTS) index. This command uses by default the output formatter **flow** (without the *key*=prefix). ## OPTIONS ## ARGUMENTS *namespace* : The name of a namespace, e.g. the name of the shared namespace. When no namespace was given, the user's private namespace will be used. ## COMMANDS ### fts optimize **doveadm** [*GLOBAL OPTIONS*] fts optimize [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [*namespace*] Optimize the full text search index. This is also done automatically by the full text search engines, but this enforces it to happen. ### fts rescan **doveadm** [*GLOBAL OPTIONS*] fts rescan [**-u** *user* | **-A** | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [*namespace*] Scan what mails exist in the full text search index and compare those to what actually exist in mailboxes. This removes mails from the index that have already been expunged and makes sure that the next **doveadm index** will index all the missing mails (if any). Note that currently most FTS drivers do not implement this properly, but instead they delete all the FTS indexes. This may change in the future versions. ## SEE ALSO [[man,doveadm]], [[man,doveadm-search-query,,7]] Additional resources: - [[plugin,fts]] # doveadm-help(1) - Show information about doveadm commands ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **help** [*command*] ## DESCRIPTION With no *command* argument given, **doveadm help** will print: * the synopsis for the most of the [[man,doveadm]] commands, * groups of commands, e.g. **log** or **mailbox**. When the name of a *command* (or a group) was given, it will show the man page for that command. ## SEE ALSO [[man,doveadm]] # doveadm-import(1) - Import messages matching given search query ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **import** [**-S** *socket_path*] [**-U** *source_user*] [**-s**] **-A** *source_mail_driver*:*source_mail_path* *dest_parent* *search_query* **doveadm** [*GLOBAL OPTIONS*] **import** [**-S** *socket_path*] [**-U** *source_user*] [**-s**] **-F** *file* *source_mail_driver*:*source_mail_path* *dest_parent* *search_query* **doveadm** [*GLOBAL OPTIONS*] **import** [**-S** *socket_path*] [**-U** *source_user*] [**-s**] **-u** *user* *source_mail_driver*:*source_mail_path* *dest_parent* *search_query* ## DESCRIPTION This command can be used to import mails from another mail storage specified by *source_mail_driver*, *source_mail_path*, and other settings specified via **-p** parameters to one or more user's mailboxes. All the mailboxes are imported under the given *dest_parent* mailbox, or to root level if *dest_parent* is empty (""). The *search_query* can be used to restrict which mailboxes or messages are imported. By default the import is done in destination user's context, you can use -U to change this. In the first form, the mails will be imported for all users. In the second form, the mails will be imported for all users listed in the given *file*. In the final form, the mails will be imported only for given *user* (s). ## OPTIONS **-s** : When the **-s** option is present, *dest_parent* and all new mailboxes under it will be subscribed to. **-U username** : When the **-U** option is present, the source box is opened with given username. ## ARGUMENTS *dest_parent* : The name of the destination mailbox, under which the mails should be imported. [[man,doveadm]] will create the *dest_parent* mailbox if it doesn't exist. *search_query* : Copy messages matching this search query. See [[man,doveadm-search-query,,7]] for details. *source_mail_driver*:*source_mail_path* : This argument specifies the *mail_driver* and *mail_path* settings for the source location. The **-p** parameter can optionally be used to specify additional settings. For example: **maildir:/backup/20101126/jane.doe/Maildir** or **-p mail_alt_path=/nfsmount/john.doe/mdbox mdbox:/srv/mail/john.doe/mdbox** ## EXAMPLE This example imports all mails from a backup under a *backup-20101026* mailbox: ```sh doveadm import -u jane.doe@example.org \ mdbox:/backup/20101026/jane.doe/mdbox backup-20101026 all ``` Another example that imports only messages from foo@example.org in the backup mdbox's INBOX to jane's INBOX: ```sh doveadm import -u jane.doe@example.org \ mdbox:~/mdbox-backup "" mailbox INBOX from foo@example.org ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-search-query,,7]] # doveadm-index(1) - Index mailboxes ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **index** [**-S** *socket_path*] **-A** [**-q**] [**-n** *max_recent*] *mailbox* **doveadm** [*GLOBAL OPTIONS*] **index** [**-S** *socket_path*] **-F** *file* [**-q**] [**-n** *max_recent*] *mailbox* **doveadm** [*GLOBAL OPTIONS*] **index** [**-S** *socket_path*] **\-\-no-userdb-lookup** [**-q**] [**-n** *max_recent*] *mailbox* **doveadm** [*GLOBAL OPTIONS*] **index** [**-S** *socket_path*] **-u** *user* [**-q**] [**-n** *max_recent*] *mailbox* ## DESCRIPTION Add unindexed messages in a mailbox into index/cache file. If full text search is enabled, also add unindexed messages to the fts database. The caching adds only the fields that were previously added to the mailbox's caching decisions, so it won't do anything useful for mailboxes that user's client hasn't accessed yet. You can use **doveadm dump** command to show a specific mailbox's current caching decisions. Messages can also be added automatically to full text search index using: ::: code-group ```[/etc/dovecot/conf.d/90-plugin.conf] fts_autoindex = yes ``` ::: ## OPTIONS **-n** *max_recent* : An integer value, which specifies the maximum number of \\Recent messages in mailboxes. If the mailbox contains more than *max_recent* messages with \\Recent flag set, the mailbox will not be indexed. This may be useful to avoid unnecessary indexing for large mailboxes that are never opened. **-q** : Queues the indexing to be run by indexer process. Without -q the indexing is done directly by the [[man,doveadm]] process. Some drivers can't handle multiple processes updating the indexes simultaneously, so -q should usually be used on production. ## ARGUMENTS *mailbox* : The name of the mailbox to index. ## EXAMPLE Index bob's INBOX: ```sh doveadm index -u bob INBOX ``` ## SEE ALSO [[man,doveadm]] # doveadm-indexer(1) - Commands related to managing the indexer process ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **indexer** *command* [*OPTIONS*] [*ARGUMENTS*] ## DESCRIPTION **doveadm indexer** can be used to manage the indexer process. ## COMMANDS ### indexer add **doveadm** [*GLOBAL OPTIONS*] indexer add [**-h**] [**-n** *max_recent*] *user* *mailbox* Add indexing request for the given *user* and the *mailbox* to the indexer queue. It works the same as the **doveadm index -q** command. **-h** : Add the indexing request to the head of the queue. By default the request is added to the tail of the queue. **-n** *max_recent* : An integer value, which specifies the maximum number of \\Recent messages in mailboxes. If the mailbox contains more than *max_recent* messages with \\Recent flag set, the mailbox will not be indexed. This may be useful to avoid unnecessary indexing for large mailboxes that are never opened. ### indexer remove **doveadm** [*GLOBAL OPTIONS*] indexer remove *user_mask* [*mailbox_mask*] Remove all indexer requests for the matching *user_mask* (and *mailbox_mask*). It's possible to use wildcards. Requests that are currently processed by indexer-worker are not listed; use **doveadm kick** instead to kick them. ### indexer list **doveadm** [*GLOBAL OPTIONS*] indexer list *user_mask* List all the queued indexing requests matching *user_mask*. It's possible to use wildcards. Requests that are currently processed by indexer-worker are not listed; use **doveadm who** instead to see them. ## SEE ALSO [[man,doveadm]] # doveadm-instance(1) - Manage the list of running Dovecot instances ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **instance list** [**-c**] [*name*] **doveadm** [*GLOBAL OPTIONS*] **instance remove** *name* ## DESCRIPTION The **doveadm instance** commands are used to manage the list of Dovecot instances running on the server. In most installations there is only one Dovecot instance, but in some cases is may be useful to have more (e.g. running proxy and backend in the same server). Instances are added to the list automatically when Dovecot is started. Each instance is uniquely identified by its *base_dir* setting. Instances can be named by setting *instance_name* in each instance's *dovecot.conf*. When an instance is named, it can be accessed easily by giving **-i** *instance_name* command line parameter for Dovecot binaries (e.g. doveadm). ## ARGUMENTS *name* : The value of an instance's *instance_name* setting. Each instance can also be uniquely identified by its *base_dir* setting. ## COMMANDS ### instance list **doveadm** [*GLOBAL OPTIONS*] instance list [**-c**] [*name*] This command lists the seen Dovecot instances. **-c** : Output the config path instead of instance information. ### instance remove **doveadm** [*GLOBAL OPTIONS*] instance remove *name* This command removes the specified instance. ## SEE ALSO [[man,doveadm]] # doveadm-kick(1) - Disconnect users by user name and/or IP address ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **kick** [**-a** *anvil_socket_path*] [**-f** *passdb_field*] [**-h** *dest_host*] *user_mask* **doveadm** [*GLOBAL OPTIONS*] **kick** [**-a** *anvil_socket_path*] [**-f** *passdb_field*] [**-h** *dest_host*] *ip* [**/** *bits*] **doveadm** [*GLOBAL OPTIONS*] **kick** [**-a** *anvil_socket_path*] [**-f** *passdb_field*] [**-h** *dest_host*] *user_mask* *ip* [**/** *bits*] **doveadm** [*GLOBAL OPTIONS*] **kick** [**-a** *anvil_socket_path*] [**-f** *passdb_field*] **-h** *dest_host* ## DESCRIPTION **doveadm**'s **kick** command is used to disconnect users by *user_mask* and/or the *ip* address, from which they are connected. In the first form, all users, whose login name matches the *user_mask* argument, will be disconnected. In the second form, all users, connected from the given IP address or network range, will be disconnected. In the third form, only users connected from the given IP address or networks range and a matching login name will be disconnected. In the last form, all proxy connections to the given destination host are disconnected. ## OPTIONS **-a** *anvil_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket. By default [[man,doveadm]] will use the socket */rundir/anvil*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **-f** *passdb_field* : Alternative username field to use for kicking, as returned by passdb. Only the passdb fields beginning with the *user\_* prefix are tracked. **-h** *dest_host* : Disconnect proxy connections to the given *dest_host*. ## ARGUMENTS *ip* [/*bits*] : *ip* or *ip* **/** *bits* is the host or network, from which the users are connected. *user_mask* : Is a user's login name, or the alternative username (user\_\* field) if the **-f** parameter is used. Depending on the configuration, a login name may be for example **jane** or **john@example.com**. It's also possible to use '*****' and '**?**' wildcards (e.g. -u \*@example.org). ## EXAMPLE If you don't want to disconnect all users at once, you can check who's currently logged in. The first example demonstrates how to disconnect all users whose login name is 3 characters long and begins with **ba**: ```sh doveadm who -1 ja\* ``` ``` username service pid ip jane imap 8192 ::1 jano imap 8196 ::2 james imap 8203 2001:db8:543:2::1 ``` ```sh doveadm kick jan? # The connections for jane and jano are kicked. ``` The next example shows how to kick user foo's connections from 192.0.2.\*: ```sh doveadm who -1 foo ``` ``` username service pid ip foo imap 8135 fd95:4eed:38ba::25 foo imap 9112 192.0.2.53 foo imap 8216 192.0.2.111 ``` ```sh doveadm kick foo 192.0.2.0/24 doveadm who f\* ``` ``` username # service (pids) (ips) foo 1 imap (8135) (fd95:4eed:38ba::25) ``` ## SEE ALSO [[man,doveadm]] # doveadm-log(1) - Locate, test or reopen Dovecot's log files ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **log errors** [**-s** *min_timestamp*] **doveadm** [*GLOBAL OPTIONS*] **log find** [*directory*] **doveadm** [*GLOBAL OPTIONS*] **log reopen** **doveadm** [*GLOBAL OPTIONS*] **log test** ## DESCRIPTION The **doveadm log** *commands* are used to locate and reopen the log files of [[man,dovecot]]. It's also possible to test the configured targets of the *log_path* settings. ## COMMANDS ### log errors **doveadm** [*GLOBAL OPTIONS*] log errors [**-s** *min_timestamp*] The **log errors** command is used to show the last - up to 1,000 - errors and warnings. If no output is generated, no errors have occurred since the last start. **-s** *min_timestamp* : An integer value, representing seconds since the epoch - also known as Unix timestamp. When a min_timestamp was given, [[man,doveadm]] will only show errors occurred since that point in time. ### log find **doveadm** [*GLOBAL OPTIONS*] log find [*directory*] The **log find** command is used to show the location of the log files, to which [[man,dovecot]] logs its messages through **syslogd** (8) and [[man,doveadm]] could not find any log files, you can specify the *directory* where your syslogd writes its log files. ### log reopen **doveadm** [*GLOBAL OPTIONS*] log reopen This command causes **doveadm** to send a SIGUSR1 signal to master process, which causes it to reopen all log files configured in the *log_path*, *info_log_path* and *debug_log_path* settings. These settings are configured in */etc/dovecot/conf.d/10-logging.conf*. The master process also signals the log process to do the same. This is mainly useful after manually rotating the log files. ### log test **doveadm** [*GLOBAL OPTIONS*] log test This command causes **doveadm** to write the message "This is Dovecot's *priority* log (*timestamp*)" to the configured log files. The used priorities are: **debug**, **info**, **warning**, **error** and **fatal**. ## EXAMPLE This example shows how to locate the log files used by [[man,dovecot]]: ```sh doveadm log find ``` ``` Looking for log files from /var/log Debug: /var/log/dovecot.debug Info: /var/log/mail.log Warning: /var/log/mail.log Error: /var/log/mail.log Fatal: /var/log/mail.log ``` ## SEE ALSO [[man,doveadm]] # doveadm-dict(1) - Commands related to dictionary manipulation in user context # doveadm-mail-fs(1) - Interact with the abstract mail storage filesystem in user context # doveadm-mailbox-cryptokey(1) - Mail crypt plugin management ## SYNOPSIS **doveadm** [**-o** *crypt_user_key_password=password*] [*GLOBAL OPTIONS*] *mailbox cryptokey export|generate|list|password* [*options*] [*arguments*] ## DESCRIPTION Generate new keypair for user or folder. The new keypair is marked as active. ## OPTIONS **doveadm mailbox cryptokey** can be used to manage user's cryptographic keys. **-o** *crypt_user_key_password=password* : Dovecot option, needed if you use password protected keys ## OPTIONS ## SUBCOMMANDS **export** [**-U**] | *mailbox-mask* **-U** : Operate on user keypair only Exports user's or folder's keypair(s) in PEM format. If the keys are password protected, -o is needed. **generate** [**-Rf** [**-U**] | *mailbox-mask*] **-U** : Operate on user keypair only **-R** : Re-encrypt all folder keys with current active user key **-f** : Force keypair creation, normally keypair is only created if none found Generates new keypair for user or folder. If you want to generate new user key and use it to secure your folder keys, use generate -u username -UR. If you want to password-protect your key here, use -o. **list** [**-U**] | *mailbox-mask* **-U** : Operate on user keypair only List all keys for user or folder. No password is required. **password** [**-N** | **-n** *password*] [**-O**|**-o** *password*] [**-C**] **-O** : Ask for old password **-o old-password** : Provide old password **-N** : Ask for new password **-n new-password** : Provide new password **-C** : Clear (unset/remove) password. Your key will not be protected by password. Set, change or clear password from your user key. ## SEE ALSO [[man,doveadm]], [[man,doveadm-mailbox]] # doveadm-mailbox(1) - Commands related to handling mailboxes ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] *mailbox_cmd* [*OPTIONS*] [*ARGUMENTS*] ## DESCRIPTION **doveadm mailbox** can be used to query and modify mailboxes. ## OPTIONS ## ARGUMENTS *mailbox* : Is the name of a *mailbox*, as visible to IMAP clients, except in UTF-8 format. The hierarchy separator between a parent and child mailbox is commonly '**/**' or '**.**', but this depends on your selected mailbox storage format and namespace configuration. The mailbox names may also require a namespace prefix. ## COMMANDS ### mailbox create **doveadm** [*GLOBAL OPTIONS*] mailbox create [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-g** *guid*] [**-s**] *mailbox*... This command is used to create one or more mailboxes. The mailbox format of the created mailboxes depends on the *mail_driver* setting, or the user's *mail* field, returned by the userdb. **-g** *guid* : Create the mailbox with the specified GUID. **-s** : When this option was given, the created mailboxes will be also added to the user's subscriptions. ### mailbox cryptokey **doveadm** [*GLOBAL OPTIONS*] mailbox cryptokey **export|generate|list|password** This command is used to manage mail crypt plugin cryptographic keys. Please see [[man,doveadm-mailbox-cryptokey]] for more details. ### mailbox delete **doveadm** [*GLOBAL OPTIONS*] mailbox delete [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] [**-r**] [**-e**] [**-Z**] *mailbox*... This command deletes a mailbox and expunges all the messages it contains. If the mailbox has any children, they won't be deleted, unless **-r** is given. **-r** : Delete mailboxes recursively **-s** : Unsubscribe deleted mailboxes. **-e** : Require mailboxes to be empty before deleting. **-Z** : Delete the mailbox as efficiently as possible, but the user may not be in fully consistent state afterwards. For example quota may be wrong. This option is mainly useful when deleting the entire user. ### mailbox list **doveadm** [*GLOBAL OPTIONS*] mailbox list [**-7** | **-8**] [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] [*mailbox* ...] To get an overview of existing mailboxes use this command. It's also possible to use wildcards in the *mailbox* name. When the **-s** option is present, only subscribed mailboxes will be listed. Listed subscriptions may also contain mailboxes that are already deleted. **-7** : Lists the mailboxes with mUTF-7 encoding. **-8** : Lists the mailboxes with UTF-8 encoding. ### mailbox metadata list **doveadm** [*GLOBAL OPTIONS*] mailbox metadata list [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] [**-p**] *mailbox* [*key-prefix*] **-s** : Allows to specify *mailbox* "", which points to the server metadata instead of mailboxes' matadata. It has no effect if mailbox is anything else than an empty string. **-p** : Prepend prefix. *mailbox* : The target mailbox (mandatory). If **-s** is specified, the empty string "" can be used to indicate access to server metadata. *key-prefix* : The key prefix to look for. All keys will be listed if not provided. ### mailbox metadata get **doveadm** [*GLOBAL OPTIONS*] mailbox metadata get [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] *mailbox* *key* **-s** : Allows to specify *mailbox* "", which points to the server metadata instead of mailboxes' matadata. It has no effect if mailbox is anything else than an empty string. *mailbox* : The target mailbox (mandatory). If **-s** is specified, the empty string "" can be used to indicate access to server metadata. *key* : The key to retrieve. ### mailbox metadata set **doveadm** [*GLOBAL OPTIONS*] mailbox metadata set [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] *mailbox* *key* *value* **-s** : Allows to specify *mailbox* "", which points to the server metadata instead of mailboxes' matadata. It has no effect if mailbox is anything else than an empty string. *mailbox* : The target mailbox (mandatory). If **-s** is specified, the empty string "" can be used to indicate access to server metadata. *key* : The key to set. *value* : The value to set. ### mailbox metadata unset **doveadm** [*GLOBAL OPTIONS*] mailbox metadata unset [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] *mailbox* *key* **-s** : Allows to specify *mailbox* "", which points to the server metadata instead of mailboxes' matadata. It has no effect if mailbox is anything else than an empty string. *mailbox* : The target mailbox (mandatory). If **-s** is specified, the empty string "" can be used to indicate access to server metadata. *key* : The key to unset. ### mailbox mutf7 **doveadm** [*GLOBAL OPTIONS*] mailbox mutf7 [**-7** | **-8**] *name*... The **mailbox mutf7** command may be used to convert the international mailbox *name* into a modified version of the UTF-7 encoding and vice versa. See [[rfc,3501,5.1.3]] (Mailbox International Naming Convention). **-7** : Indicates that the *name*'s string representation is mUTF-7 encoded and it should be converted to UTF-8. **-8** : Indicates that the *name*'s is UTF-8 encoded and should be converted to mUTF-7 (default). *name* : One or more mailbox names that should be converted. ### mailbox path **doveadm** [*GLOBAL OPTIONS*] mailbox path [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] [**-t** *type*] *mailbox* The **mailbox path** command returns the filesystem path for the given mailbox. By default, this is the path to the "index" directory. **-t** *type* : Output the path to this mailbox location type. One of: - **alt-dir** - **alt-mailbox** - **control** - **dir** - **index** (DEFAULT) - **index-cache** - **index-private** - **list-index** - **mailbox** *mailbox* : The mailbox to query (mandatory). ### mailbox rename **doveadm** [*GLOBAL OPTIONS*] mailbox rename [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-s**] *old_name* *new_name* The **mailbox rename** command is used to rename the mailbox *old_name* to *new_name*. When the **-s** option is given, *old_name* will be unsubscribed and *new_name* will be subscribed. ### mailbox status **doveadm** [*GLOBAL OPTIONS*] mailbox status [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-t**] *fields* *mailbox*... Show the **status** of one or more mailboxes. The *mailbox* name may also contain wildcards. This command uses by default the output *formatter* **flow**. **-t** : Summarize the values of the status *fields* **messages**, **recent**, **unseen** and/or **vsize** of multiple mailboxes to a sum (total). **fields** : Specify the status *fields* which should be shown. In order to specify multiple status *fields*, enclosed them in quotes. : **all** : This is a special status field name. It means show all of the following *fields*. When the **-t** option is present, it means show only the **messages**, **recent**, **unseen** and **vsize** *fields*. : **guid** : The *mailbox*'s globally unique identifier. : **highestmodseq** : The highest mod-sequence value of all messages in the *mailbox*. : **messages** : The number of messages in the *mailbox*. : **deleted** : The number of messages with the \\Deleted flag set. : **recent** : The number of messages with the \\Recent flag set. : **uidnext** : The next unique identifier value. : **uidvalidity** : The unique identifier validity value. : **unseen** : The message sequence number of the first unseen message in the *mailbox*. : **vsize** : The *mailbox*'s virtual size, computed with CRLF line terminators. : **firstsaved** : Saved time of the first mail in the mailbox. ### mailbox subscribe **doveadm** [*GLOBAL OPTIONS*] mailbox subscribe [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox* *...* This command is used to subscribe one or more mailboxes. ### mailbox unsubscribe **doveadm** [*GLOBAL OPTIONS*] mailbox unsubscribe [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox* *...* This command is used to unsubscribe one or more mailboxes. ### mailbox update **doveadm** [*GLOBAL OPTIONS*] mailbox update [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-\-mailbox-guid** *guid*] [**-\-uid-validity** *uid*] [**-\-min-next-uid** *uid*] [**-\-min-first-recent-uid** *uid*] [**-\-min-highest-modseq** *seq*] [**-\-min-highest-pvt-modseq** *seq*] *mailbox* *...* This command is used to set UID validity, next UID, first recent UID and modification sequence values. Usually this is only ever to be used during migration, or restoring mailbox after disaster. Settings these values is highly discouraged, and is not supported for all mail backends. ### mailbox cache purge **doveadm** [*GLOBAL OPTIONS*] mailbox cache purge [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *mailbox* *...* Purge the dovecot.index.cache file. Most importantly this frees up disk space from mails that were already deleted. Normally there i no need to run this command manually, because the compression is also run automatically. ### mailbox cache decision **doveadm** [*GLOBAL OPTIONS*] mailbox cache decision [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-\-all**] [**-\-fields** *list of fields*] [**-\-last-used** *unix timestamp*] [**-\-decision** *no|temp|yes*] *mailbox* *...* This command is used to list or change caching decisions for field(s) in mailbox(es). You can list decisions by leaving out decision and last-used parameters. **-\-all** : List or change all fields. **-\-fields** : List or change these comma/space separated fields. **-\-decision** : Set field caching decision. Yes means it's always cached. Temp means it's provisionally cached. No means the field is not cached. **-\-last-used** : Set field's last used timestamp. NOTE: This command cannot be used to add new fields to cache! You need to first add them to configuration. Setting caching to no will not immediately drop field from cache, it will stop adding the field to cache. ### mailbox cache remove **doveadm** [*GLOBAL OPTIONS*] mailbox cache remove [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *search query* Remove any matching mail(s) from cache. WARNING! This command can erase ALL cached data, causing system slowness. See [[man,doveadm-search-query,,7]] for the search query syntax. ## EXAMPLE List subscribed mailboxes, beginning with 'dovecot', of user bob: ```sh doveadm mailbox list -s -u bob dovecot\* ``` ``` dovecot dovecot/pigeonhole dovecot/pigeonhole/2.0 ``` Now have a look at the status of user bob's dovecot mailboxes: ```sh doveadm -f table mailbox status -u bob "messages vsize" dovecot\* ``` ``` mailbox messages vsize dovecot 20501 93968492 dovecot/pigeonhole 0 0 dovecot/pigeonhole/2.0 47 323474 ``` Converting an internationalized mailbox name from mUTF-7 to UTF-8 and vice versa: ```sh doveadm mailbox mutf7 -7 "~peter/mail/&U,BTFw-/&ZeVnLIqe-" ``` ``` ~peter/mail/台北/日本語 ``` ```sh doveadm mailbox mutf7 ~peter/mail/台北/日本語 ``` ``` ~peter/mail/&U,BTFw-/&ZeVnLIqe- ``` ## SEE ALSO [[man,doveadm]] # doveadm-move(1) - Move messages matching the given search query into another mailbox # doveadm-penalty(1) - Show current penalties ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **penalty** [**-a** *anvil_socket_path*] [*ip* [**/** *mask*]] ## DESCRIPTION The **doveadm penalty** command can be used to see the current penalties. ## OPTIONS **-a** *anvil_socket_path* : This option is used to specify an alternative socket. The option's argument is either an absolute path to a local UNIX domain socket, or a hostname and port (*hostname*:*port*), in order to connect a remote host via a TCP socket. By default [[man,doveadm]] will use the socket */rundir/anvil*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. ## ARGUMENTS *ip* [/*mask*] : To reduce/filter the output supply an IP address or a network range in CIDR notation (ip/mask). ## EXAMPLE ```sh doveadm penalty ``` ``` IP penalty last_penalty last_update 192.0.2.222 3 2010-06-15 15:19:27 15:19:27 192.0.2.53 3 2010-06-15 15:19:34 15:19:34 ``` ## SEE ALSO [[man,doveadm]] # doveadm-process-status(1) - Show information about dovecot processes ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **process status** [*service* [...]] ## DESCRIPTION **doveadm process status** produces a table with a line for each process, containing the following details: *name* : the name of the process *pid* : the pid of the process *available_count* : the number of further clients that can connect to the process *total_count* : the number of connected clients *idle_start* : timestamp when the process entered the idle status, 0 if active *last_status_update* : timestamp of the latest update from the process *last_kill_sent* : timestamp of the latest SIGINT signal sent to the process ## ARGUMENTS *service* (optional) : Filters the processes according to the specified service or services. By default, all dovecot processes are listed. ## EXAMPLES ```sh doveadm process status ``` ``` name pid available_count total_count idle_start last_status_update last_kill_sent stats 132400 999 5 0 1685365436 0 log 132356 971 29 0 1685352909 0 config 132357 999 6 0 1685365436 0 anvil 132355 1000 0 1685352908 1685352908 0 ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-service-status]] # doveadm-proxy(1) - Handle Dovecot proxy connections (obsolete) ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **proxy** *kick*|*list* [*OPTIONS*] [*ARGUMENTS*] ## DESCRIPTION These commands are aliases to the [[man,doveadm-kick]] and [[man,doveadm-who]] commands. ## SEE ALSO [[man,doveadm]] # doveadm-purge(1) - Remove messages with refcount=0 from mdbox files ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **purge** [**-S** *socket_path*] **-A** **doveadm** [*GLOBAL OPTIONS*] **purge** [**-S** *socket_path*] **-F** *file* **doveadm** [*GLOBAL OPTIONS*] **purge** [**-S** *socket_path*] **\-\-no-userdb-lookup** **doveadm** [*GLOBAL OPTIONS*] **purge** [**-S** *socket_path*] **-u** *user* ## DESCRIPTION The **doveadm purge** command is used to remove all messages with refcount=0 from a user's mail storage. The refcount of a message is decreased to 0 when the user (or some administration utility) has expunged all instances of a message from all mailboxes. In the first form, the command will be executed for all users. In the second form, the command will be executed for all users listed in the given *file*. In the third form, the command will be performed for the user contained in the *USER* environment variable. In the last form, only messages of the given *user* (s) will be purged. ## OPTIONS ## SEE ALSO [[man,doveadm]] Additional resources: - [[link,dbox]] # doveadm-pw(1) - Dovecot's password hash generator and validator ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **pw -l** **doveadm** [*GLOBAL OPTIONS*] **pw** [**-p** *password*] [**-r** *rounds*] [**-s** *scheme*] [**-u** *user*] [**-V**] **doveadm** [*GLOBAL OPTIONS*] **pw** **-t** *hash* [**-p** *password*] [**-u** *user*] ## DESCRIPTION **doveadm pw** is used to generate password hashes for different password *scheme* s and optionally verify the generated hash. All generated password hashes have a {*scheme*} prefix, for example {**SHA512-CRYPT.HEX**}. All passdbs have a default scheme for passwords stored without the {*scheme*} prefix. The default scheme can be overridden by storing the password with the scheme prefix. If you want to use this feature to verify or generate passwords without configuring Dovecot first, you can use `doveadm -O pw` to do so. ## OPTIONS **-l** : List all supported password *scheme* s and exit successfully. There are up to three optional password *scheme*s: **BLF-CRYPT** (Blowfish crypt), **SHA256-CRYPT** and **SHA512-CRYPT**. Their availability depends on the system's currently used libc. **-p** *password* : The plain text *password* for which the hash should be generated. If no *password* was given [[man,doveadm]] will prompt interactively for one. (Beware that using this option means the plain text password will be in your shell history!) **-r** *rounds* : The password *scheme* s **BLF-CRYPT**, **SHA256-CRYPT** and **SHA512-CRYPT** supports a variable number of encryption *rounds*. The following table shows the minimum/maximum number of encryption *rounds* per scheme. When the **-r** option was omitted the default number of encryption rounds will be applied. | Scheme | Minimum | Maximum | Default | | ------ | ------- | ------- | ------- | | BLF-CRYPT | 4 | 31 | 5 | | SHA256-CRYPT | 1000 | 999999999 | 5000 | | SHA512-CRYPT | 1000 | 999999999 | 5000 | **-s** *scheme* : The password *scheme* which should be used to generate the hashed password. By default the **CRYPT** *scheme* will be used (with the $2y$ bcrypt format). It is also possible to append an encoding suffix to the *scheme*. Supported encoding suffixes are: **.b64**, **.base64** and **.hex**. See also [[link,password_schemes]] for more details about password schemes. **-t** *hash* : Test if the given password *hash* matches a given plain text password. You should enclose the password *hash* in single quotes, if it contains one or more dollar signs (**$**). The plain text password may be passed using the **-p** option. When no password was specified, [[man,doveadm]] will prompt interactively for one. **-u** *user* : When the **DIGEST-MD5** *scheme* is used, the *user* name must also be given, because the user name is a part of the generated hash. For more information about Digest-MD5 please read also [[link,auth_digest_md5]]. For other schemes, this is not required. **-V** : When this option is given, the hashed password will be internally verified. The result of the verification will be shown after the hashed password, enclosed in parenthesis. ## EXAMPLE An ARGON2ID hash (best security at time of this writing, though can be heavy on a busy server): ```sh # doveadm pw -s ARGON2ID Enter new password: Retype new password: {ARGON2ID}$argon2id$v=19$m=65536,t=3,p=1$AOrrkaFmGxCFtX+NCSHFkg$N3rlzYFqyNkCwrOingnDJ/qDQ09yGHgQa8PQfbu7rIE ``` Alternatively, a SHA512-CRYPT hash: ```sh # doveadm pw -s SHA512-CRYPT Enter new password: Retype new password: {SHA512-CRYPT}$6$qAvxfQ2UbA1QTXSg$SB2aMEK76DBObt.KqTjF5.yDMceaD3dkG2UvrKQD0rZ9PKii/VAn.VS0nBsDqJX18kXieMi8AWJr0f7Ae9dAp/ ``` ## SEE ALSO [[man,doveadm]] # doveadm-quota(1) - Initialize/recalculate or show current quota usage ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **quota** [**-S** *socket_path*] *command* **-A** **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **quota** [**-S** *socket_path*] *command* **-F** *file* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **quota** [**-S** *socket_path*] *command* **\-\-no-userdb-lookup** **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **quota** [**-S** *socket_path*] *command* **-u** *user* ## DESCRIPTION In the first form, the command will be performed for all users. In the second form, the command will be performed for all users listed in the given *file*. In the third form, the command will be performed for the user contained in the *USER* environment variable. In the last form, the command will affect only the matching *user*(s). - The **quota get** and **quota recalc** commands are only available when the global *mail_plugins* setting contains the **quota** plugin. ## OPTIONS ## COMMANDS ### quota get **doveadm** [*GLOBAL OPTIONS*] **quota get** [**-A** | **-u** *user* | **-F** *file*] The **quota get** command is used to display the current quota usage. The storage values are reported in kilobytes. This command uses by default the output formatter **table**. ### quota recalc **doveadm** [*GLOBAL OPTIONS*] quota recalc [**-A** | **-u** *user* | **-F** *file*] The **quota recalc** command is used to recalculate the current quota usage. ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file, including the *dict* section. */etc/dovecot/conf.d/10-mail.conf* : Mailbox locations and namespaces. */etc/dovecot/conf.d/90-quota.conf* : Quota configuration. ## EXAMPLE Get the current quota usage of user jane: ```sh doveadm quota get -u jane ``` ``` Quota name Type Value Limit % user STORAGE 90099 102400 87 user MESSAGE 20548 30000 68 ``` ## SEE ALSO [[man,doveadm]] # doveadm-rebuild(1) - Commands related to rebuilding various aspects of mails matching given search query. ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **rebuild** \ [**-S** *socket_path*] **-A** *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **rebuild** \ [**-S** *socket_path*] **-F** *file* *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **rebuild** \ [**-S** *socket_path*] **\-\-no-userdb-lookup** *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **rebuild** \ [**-S** *socket_path*] **-u** *user* *search_query* ## DESCRIPTION The **rebuild attachments** command is used to rebuilds attachment presence. [[man,doveadm]] will print the message's uid for each match. When used with the **-A** or **-u** *wildcard* options, [[man,doveadm]] will print the fields **username** and **uid** for each matching message. In the first form, [[man,doveadm]] will execute the **rebuild** action for all users. In the second form, the command will be performed for all users listed in the given *file*. In the third form, the command will be performed for the user contained in the *USER* environment variable. In the last form, only matching mails of the given *user* (s) will be rebuilt This command uses by default the output formatter **flow** (without the *key* = prefix). ## OPTIONS ## ARGUMENTS *search_query* : Resets attachment indicator for messages matching this search query. See [[man,doveadm-search-query,,7]] for details. ## EXAMPLE Rebuild user bob's attachment status: ```sh doveadm rebuild attachments -u bob ALL ``` ``` 1 2 3 ``` ## SEE ALSO [[man,doveadm]] # doveadm-save(1) - Save email to a user's mailbox ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **save** [**-S** *socket_path*] **-A** [*-m* *mailbox*] [*-U* *uid*] [*-g* *guid*] [*-r* *received-date*] [*mail-file*] **doveadm** [*GLOBAL OPTIONS*] **save** [**-S** *socket_path*] **-F** *file* [*-m* *mailbox*] [*-U* *uid*] [*-g* *guid*] [*-r* *received-date*] [*mail-file*] **doveadm** [*GLOBAL OPTIONS*] **save** [**-S** *socket_path*] **\-\-no-userdb-lookup** [*-m* *mailbox*] [*-U* *uid*] [*-g* *guid*] [*-r* *received-date*] [*mail-file*] **doveadm** [*GLOBAL OPTIONS*] **save** [**-S** *socket_path*] **-u** *user* [*-m* *mailbox*] [*-U* *uid*] [*-g* *guid*] [*-r* *received-date*] [*mail-file*] ## DESCRIPTION **doveadm save** can be used to save messages. This can be useful for scripts and for debugging. Sieve is not invoked for saved messages, but quota is enforced. ## OPTIONS **-m** *mailbox* : Store mail to specified mailbox instead of INBOX. **-U** *uid* : Save the mail using the given UID, if possible. **-g** *guid* : Save the mail using the given GUID. **-r** *received-date* : Save the mail using the given received-date timestamp. This is in the "human timestamp" format as described by [[man,doveadm-search-query,,7]]. ## ARGUMENTS *mail-file* : The message data to save. - If *mail-file* is `-`, the message is read from stdin (default). - Otherwise, *mail-file* resolves as a file path. ## EXAMPLE ```sh echo "hello, world" | doveadm save -u testuser@testdomain ``` ## SEE ALSO [[man,doveadm]] # doveadm-search-query(7) - Overview of search queries for doveadm mailbox commands ## DESCRIPTION Several [[man,doveadm]] commands use a *search_query* in order to act only on matching messages. This manual page describes all *SEARCH KEYS*, which can be used in a *search_query*. The query is mostly compatible with the IMAP SEARCH command parameters, although there are some differences. Each *search_query* consists at least of one *SEARCH KEY*. Most of the *SEARCH KEYS* require an argument. All *SEARCH KEYS* are case-insensitive. The shortest valid *search_query* is **ALL**. For example: ```sh doveadm search ALL ``` Multiple search query expressions will be combined with the **AND** operator by default. To find all messages that are new and greater than 50 kilobyte, one can use: ```sh doveadm search NEW LARGER 50k ``` **OR**-ed *SEARCH KEYS* have to be written in parenthesis, when mixing ANDs and ORs. Shells commonly require escaping for parentheses. To find messages that were saved on the "13th of April 2007" AND have the \\Seen and/or \\Flagged flag set, one can use for example: ```sh doveadm search SAVEDON 2007-04-13 \( SEEN OR FLAGGED \) ``` It's also possible to specify the mailbox, in which should be searched. Use either the keyword **mailbox** and the name of the mailbox or the keyword **mailbox-guid** and the mailbox's globally unique identifier in the *search_query*. To find all messages in the mailbox with the GUID "44f68b13ce97044b837f000035ca9452" use: ```sh doveadm search mailbox-guid 44f68b13ce97044b837f000035ca9452 ALL ``` To list all deleted messages in the "Trash" folder use: ```sh doveadm search mailbox Trash DELETED ``` ## SEARCH KEYS The following search keys from the specification of IMAP version 4 revision 1 (see: [[rfc,3501,6.4.4]]) are supported: *sequence-set* : Matches messages with the given sequence numbers. The *sequence-set* may be a single sequence number. Can be a sequence range, written as *from*:*to*, e.g. **100**:**125**. As comma separated list of sequences, e.g. **11,50,4**. It's also possible to combine multiple sequences, e.g. **1,3,5,7,10:20**. Using \* selects the last mail in the mailbox. For example 1:100 matches the first 100 mails and 101:200 the next second hundred mails. 1,5,* matches the first, the fifth and the last email. Use `UID` (see below) to search by unique ID. **ALL** : Matches all messages. **ANSWERED** : Matches messages with the IMAP flag \\Answered set. **BCC** *string* : Matches messages, which contain *string* in the BCC field of the message's IMAP envelope structure. **BEFORE** *date specification* : Matches messages with an internal date before *date specification*. **BODY** *string* : Matches messages, which contain *string* in the body part. **CC** *string* : Matches messages, which contain *string* in the CC field of the message's IMAP envelope structure. **DELETED** : Matches messages with the IMAP flag \\Deleted set. **DRAFT** : Matches messages with the IMAP flag \\Draft set. **FLAGGED** : Matches messages with the IMAP flag \\Flagged set. **FROM** *string* : Matches messages, which contain *string* in the FROM field of the message's IMAP envelope structure. **HEADER** *field* *string* : Matches messages, which either have the named header *field*, when empty *string* was given. Or messages, where the given header *field*'s value contains the specified *string*. **KEYWORD** *keyword* : Matches messages with the given IMAP *keyword* (e.g. $Forwarded) flag set. **LARGER** *size* : Matches messages that are larger than the specified *size*. **MAILBOX** *name* : Matches messages in the mailbox with the specified *name*. **MAILBOX-GUID** *guid* : Matches messages in the mailbox with the specified *guid*. **NEW** : Matches messages, which have the IMAP flag \\Recent set **but not** the IMAP flag \\Seen. **NOT** *search key* : Inverse matching - matches massages, where the search doesn't match the specified *search key* or its value. **OLD** : Matches messages, which do not have the IMAP flag \\Recent set. **ON** *date specification* : Matches messages whose internal date matches the given *date specification*. *search key* **OR** *search key* : Matches messages where one of the OR-ed search keys matches. Note: IMAP4rev1 uses the syntax: **OR** *search key search key* **RECENT** : Matches messages with the IMAP flag \\Recent set. **SEEN** : Matches messages with the IMAP flag \\Seen set. **SENTBEFORE** *date specification* : Matches messages with a Date: header before *date specification*. **SENTON** *date specification* : Matches messages with a Date: header matching the given *date specification*. **SENTSINCE** *date specification* : Matches messages with a Date: header matching or after the given *date specification*. **SINCE** *date specification* : Matches messages whose internal date is within or after the given *date specification*. **SMALLER** *size* : Matches messages with a size smaller than the given *size*. **SUBJECT** *string* : Matches messages, which contain *string* in the SUBJECT field of the message's IMAP envelope structure. **TEXT** *string* : Matches messages, which contain *string* in the message headers or body. **TO** *string* : Matches messages, which contain *string* in the TO field of the message's IMAP envelope structure. **UID** *sequence-set* : Matches messages with the given IMAP UID(s). See the **sequence-set** description for details on it. For example **1:10,100:200,*** matches the UIDs from 1 to 10, 100 to 200 and also the last mail. **UNANSWERED** : Matches messages, which do not have the IMAP flag \\Answered set. **UNDELETED** : Matches messages, which do not have the IMAP flag \\Deleted set. **UNDRAFT** : Matches messages, which do not have the IMAP flag \\Draft set. **UNFLAGGED** : Matches messages, which do not have the IMAP flag \\Flagged set. **UNKEYWORD** *keyword* : Matches messages, which do not have the given IMAP *keyword* flag set **UNSEEN** : Matches messages, which do not have the IMAP flag \\Seen set. ## DOVEADM SEARCH KEYS Additional search keys, provided by [[man,doveadm]]. **SAVEDBEFORE** *date specification* : Matches messages, which were saved before *date specification*. **SAVEDON** *date specification* : Matches messages whose save date matches the given *date specification*. **SAVEDSINCE** *date specification* : Matches messages with a save date matching or after the given *date specification*. ## DATE SPECIFICATION [[man,doveadm]] supports a few additional *date specification* formats. They can be used anywhere, where a *date specification* value is obligatory. *dd-mon-yyyy* : Default IMAP4rev1 date format. Date components: : *day* : the day of month: **1**-**31**. : *month* : the abbreviated month name: **Jan**, **Feb**, **Mar**, **Apr**, **May**, **Jun**, **Jul**, **Aug**, **Sep**, **Oct**, **Nov**, or **Dec**. : *year* : four digits of year, e.g. **2007**. For example the "13th of April 2007" will be represented as **13-Apr-2007**. *dd-mon-yyyy hh:mm:ss [+-]zzzz* : Default IMAP4rev1 date-time format. See *dd-mon-yyyy* above for the date format. Time format components: : *hh* : the hour : *mm* : the minute : *ss* : the second : *[+-]zzzz* : the timezone as hhmm, e.g. **+0530**, **-0700** *interval* : Combination of a positive integer *number* and a *time unit*. Available *time units* are: : **weeks** : abbreviated: **w** : **days** : abbreviated: **d** : **hours** : abbreviated: **h** : **mins** : abbreviated: **m** : **secs** : abbreviated: **s** To match messages from last week, you may specify for example: **since 1w**, **since 1weeks** or **since 7days**. *Unix timestamp* : A 10 digit Unix timestamp, seconds since the 1st of January 1970, 00:00:00 UTC. For example the "13th of April 2007" will be represented as **1176418800**. *YYYY-MM-DD* : Extended ISO-8601 calendar date format. For example the "13th of April 2007" will be represented as **2007-04-13**. ## SIZE [[man,doveadm]] provides also an additional *size* representation format. The following formats can be used anywhere, where a *size* value is obligatory. *octets* : The message size in octets, as specified in the IMAP4rev1 specification. *size* : The message size in **B** (byte), **k** (kilobyte), **M** (megabyte), **G** (gigabyte) or **T** (terabyte). To match messages, bigger than 1 megabyte, you may specify for example: **larger 1M** or **larger 1024k**. ## SEE ALSO [[man,doveadm]] # doveadm-search(1) - Show a list of mailbox GUIDs and message UIDs matching given search query. ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **search** [**-S** *socket_path*] **-A** *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **search** [**-S** *socket_path*] **-F** *file* *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **search** [**-S** *socket_path*] **\-\-no-userdb-lookup** *search_query* **doveadm** [*GLOBAL OPTIONS*] [**-f** *formatter*] **search** [**-S** *socket_path*] **-u** *user* *search_query* ## DESCRIPTION The **search** command is used to find matching messages. [[man,doveadm]] will print the mailbox's guid and the message's uid for each match. When used with the **-A** or **-u** *wildcard* options, [[man,doveadm]] will print the fields **username**, **mailbox-guid** and **uid** for each matching message. In the first form, [[man,doveadm]] will executed the **search** action will be performed for all users. In the second form, the command will be performed for all users listed in the given *file*. In the third form, the command will be performed for the user contained in the *USER* environment variable. In the last form, only matching mails of the given *user*(s) will be searched. This command uses by default the output formatter **flow** (without the *key*=prefix). ## OPTIONS ## ARGUMENTS *search_query* : Show messages matching this search query. See [[man,doveadm-search-query,,7]] for details. ## EXAMPLE Search in user bob's dovecot mailboxes all messages which contains the word "todo" in the Subject: header: ```sh doveadm search -u bob mailbox dovecot\* subject todo ``` ``` 3a94c928d66ebe4bda04000015811c6a 8 3a94c928d66ebe4bda04000015811c6a 25 3a94c928d66ebe4bda04000015811c6a 45 ``` The search command is mainly useful when used together with [[man,doveadm-fetch]] command. For example to save message bodies of all messages from INBOX that have "todo" in subject, use: ```sh doveadm search -u bob mailbox INBOX subject todo while read guid uid; do doveadm fetch -u bob body mailbox-guid $guid uid $uid > msg.$uid done ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-search-query,,7]] # doveadm-service-status(1) - Show information about dovecot services ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **service status** [*service* [...]] ## DESCRIPTION **doveadm service status** produces a table with a line for each service, containing the following details: *name* : the name of the service *process_count* : the number of processes actually running for the service *process_avail* : the number of additional processes that can be spawned for the service *process_limit* : the maximum number of processes that can be active for the service *client_limit* : the maximum number of connections that the service will handle simultaneously *throttle_secs* : seconds to wait before launching another process when processes are dying unexpectedly early for the service *exit_failure_last* : timestamp when the last process was terminated abnormally for the service *exit_failures_in_sec* : number of abnormally terminated processes for the service in the last second *last_drop_warning* : timestamp when the last time a "dropping client connections" warning was logged *listen_pending* : if the master process is queuing connections that need to be dispatched *listening* : if service is listening *doveadm_stop* : if the service has been stopped by [[man,doveadm,stop]] *process_total* : the total number of processes forked for the service since the service start. ## ARGUMENTS *service* (optional) : Filters the list according to the specified service or services. By default, all dovecot services are listed. ## EXAMPLES ```sh doveadm service status ``` ``` name: imap-login process_count: 0 process_avail: 0 process_limit: 1 client_limit: 1000 throttle_secs: 0 exit_failure_last: 0 exit_failures_in_sec: 0 last_drop_warning: 0 listen_pending: n listening: y doveadm_stop: n process_total: 0 ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-process-status]] # doveadm-service-stop(1) - Stop Dovecot Services ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **service stop** *service* [*service* [...]] ## DESCRIPTION **doveadm service stop** stops the listed Dovecot service processes. ## ARGUMENTS *service* : The list of services to stop. ## EXAMPLES ```console $ doveadm service stop stats ``` ## SEE ALSO [[man,doveadm]] # doveadm-sieve(1) - Commands related to handling Sieve scripts ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] *sieve_cmd* [*options*] [*arguments*] ## DESCRIPTION The **doveadm sieve** commands are part of Pigeonhole ([[man,pigeonhole,,7]]), which adds Sieve ([[rfc,5228]]) and ManageSieve ([[rfc,5804]]) support to Dovecot ([[man,dovecot]]). The **doveadm sieve** commands can be used to manage Sieve filtering. ## OPTIONS ## ARGUMENTS *scriptname* : Is the name of a *Sieve script*, as visible to ManageSieve clients. ::: tip For Sieve scripts that are stored on disk, this is the filename without the ".sieve" extension. ::: ## COMMANDS ### sieve put **doveadm** [*GLOBAL OPTIONS*] sieve put [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-a**] *scriptname* This command puts one new Sieve script in the script storage. The script is read from standard input. If the script compiles successfully, it is stored under the provided *scriptname .* If the **-a** option is present, the Sieve script is subsequently marked as the active script for execution at delivery. ### sieve get **doveadm** [*GLOBAL OPTIONS*] sieve get [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *scriptname* This command retrieves the Sieve script named *scriptname*. ### sieve delete **doveadm** [*GLOBAL OPTIONS*] sieve delete [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] [**-a**] *scriptname* ... This command deletes one or more Sieve scripts. The deleted script may not be the active script, unless the **-a** option is present. ### sieve list **doveadm** [*GLOBAL OPTIONS*] sieve list [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] List existing Sieve scripts, and their active state. ### sieve rename **doveadm** [*GLOBAL OPTIONS*] sieve rename [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *old_name* *new_name* The **sieve rename** command is used to rename the Sieve script *old_name* to *new_name*. ### sieve activate **doveadm** [*GLOBAL OPTIONS*] sieve activate [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *scriptname* This command marks the Sieve script named *scriptname* as the active script for execution at delivery. ### sieve deactivate **doveadm** [*GLOBAL OPTIONS*] sieve deactivate [**-A** | **-u** *user* | **-F** *file* | **\-\-no-userdb-lookup**] [**-S** *socket_path*] *scriptname* This command deactivates Sieve processing. ## SEE ALSO [[man,doveadm]], [[man,dovecot-lda]], [[man,pigeonhole,,7]] # doveadm-stats(1) - Inspect or reset stats ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **stats add** [ **-\-description** *\* ] [ **-\-exporter** *\* ] [ **-\-exporter-include** *\* ] [ **-\-fields** *\* ] [**-\-group_by** *\* ] *name* *\* **doveadm** [*GLOBAL OPTIONS*] **stats dump** [ **-s** *\* ] [ **-r** ] [ **-f** *\* ] **doveadm** [*GLOBAL OPTIONS*] **stats top** [**-s \**] [**-b**] [**sort** *\*] **doveadm** [*GLOBAL OPTIONS*] **stats remove** [ *\* ] **doveadm** [*GLOBAL OPTIONS*] **stats reopen** ## DESCRIPTION Commands to inspect and edit Dovecot stats/metrics generation. ## COMMANDS ### stats add **doveadm** [*GLOBAL OPTIONS*] **stats add** [ **-\-description** *\* ] [ **-\-exporter** *\* ] [ **-\-exporter-include** *\* ] [ **-\-fields** *\* ] [**-\-group_by** *\* ] *name* *\* **doveadm stats add** is used to add metrics to statistics. #### OPTIONS **--description** *\* : Human-readable description of the metric. This is included in the HELP text sent to OpenMetrics. **--exporter** *\* : Export events matching the filter with this event exporter. If empty, the events are used only for statistics, and no exporting is done. **--exporter-include** *\* : Specifies which parts of the event are exported to the serialized event. The fields are space-separated. **--fields** *\* : A list of fields included in the metric. All events have a default `duration` field that does not need to be listed explicitly. **--group-by** *\* : Creates a new group_by for dynamically generating sub-metrics based on the specified field's values. #### ARGUMENTS *name* : Metric name. *filter* : Filter options: - **user=\** : Match user. - **domain=\** : Match DNS domain name. - **session=\** : Match session identifier. - **ip=\[/\]** : Match local or remote IP. - **since=\** : Match session start time. - **connected** : Show only connected sessions. ### stats dump **doveadm** [*GLOBAL OPTIONS*] **stats dump** [ **-s** *\* ] [ **-r** ] [ **-f** *\* ] **doveadm stats dump** is used to output statistics. #### OPTIONS **-f** : TODO **-r** : Resets statistics after dumping. **-s** *socketpath* : Stats socket path. ### stats remove **doveadm** [*GLOBAL OPTIONS*] **stats remove** [ *\* ] **doveadm stats remove** is used to remove metrics from statistics. #### ARGUMENTS *name* : The metric name to remove. ### stats reopen **doveadm** [*GLOBAL OPTIONS*] **stats reopen** **doveadm stats reopen** is used to reopen any file exporter files. ## SEE ALSO [[man,doveadm]] # doveadm-sync(1) - Dovecot's two-way mailbox synchronization feature # doveadm-user(1) - Perform a user lookup in Dovecot's userdbs ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **user** [**-a** *userdb_socket_path*] [**-e** *template*] [**-f** *field*] [**-u**] [**-x** *auth_info*] *user*... ## DESCRIPTION The **user** command is used to perform a user lookup - to show what information Dovecot sees about the *user* (s), or if it exists at all in the configured *userdb* (s). The *auth_info* may be useful when the userdb is for example a SQL database and you are using %variables, like **%{protocol}** or **%{local_ip}**, in the *userdb_sql_query* setting. Or when you have configured the userdb in a way like this: ```doveconf[dovecot.conf] userdb passwd-file { passwd_file_path = /etc/%{protocol}.passwd } ``` ## OPTIONS **-a** *userdb_socket_path* : This option is used to specify an absolute path to an alternative UNIX domain socket. By default [[man,doveadm]] will use the socket */rundir/auth-userdb*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **-e** *template* : When this option and a string with %variables is given, [[man,doveadm]] will show the expanded string for the user. This option can't be used together with the `-f` or `-u` options. **-f** *field* : When this option and the name of a userdb field is given, [[man,doveadm]] will show only the value of the specified field. This option can't be used together with the `-e` or `-u` options. **-u** : When this option is given, [[man,doveadm]] will only show values from the *userdb*. Without `-u` parameter if any of the *uid*, *gid*, *home* or *mail_path* fields are missing, their defaults are taken from configuration file. This option can't be used together with the `-e` or `-f` options. ## ARGUMENTS *user* : Is a *user*'s login name. Depending on the configuration, a login name may be for example **jane** or **john@example.com**. It's also possible to use '**\***' and '**?**' wildcards (e.g. `-u \*@example.org`). ## EXAMPLE Perform a user lookup for the users jane and john@example.com: ```sh doveadm user jane john@example.com ``` ``` userdb: jane uid : 8001 gid : 8001 home : /home/jane mail_path : ~/sdbox plugins : sieve quota_storage_size: 150M userdb: john@example.com home : /srv/mail/8/70312/79832 uid : 79832 gid : 70312 mail_path : ~/mdbox ``` User lookup, using wildcards: ```sh doveadm user \*.?oe@example.net ``` ``` jane.doe@example.net judy.roe@example.net john.doe@example.net ``` ## SEE ALSO [[man,doveadm]] # doveadm-who(1) - Show who is logged into the Dovecot server ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] **who** [**-1**] [**-f** *passdb_field*] [**-a** *anvil_socket_path*] [*user_mask*] [*ip* [**/** *bits*]] ## DESCRIPTION The **who** command is used to show which users from which hosts are currently connected to which service. This command uses by default the output formatter **table**. ## OPTIONS **-1** : Print one line per user and connection. Otherwise the connections are grouped by the username. **-a** *anvil_socket_path* : This option is used to specify an alternative socket. The option's argument is either an absolute path to a local UNIX domain socket, or a hostname and port (*hostname*:*port*), in order to connect a remote host via a TCP socket. By default [[man,doveadm]] will use the socket */rundir/anvil*. The socket may be located in another directory, when the default *base_dir* setting was overridden in */etc/dovecot/dovecot.conf*. **-f** *passdb_field* : Alternative username field to use for querying, as returned by passdb. Only the passdb fields beginning with the *user_* prefix are tracked. ## ARGUMENTS *ip* [**/** *bits*] : Specify an *ip* address or network range, in CIDR notation, to reduce the result to matching connections. *user_mask* : List only users whose login name matches the *user_mask*, or the alternative username (user_* field) if the **-f** parameter is used. It's also possible to use wildcards in the *user* name. ## EXAMPLE Show authenticated sessions, filtered by the client's IP address: ```sh doveadm who ::1 ``` ``` username # proto (pids) (ips) jane 2 imap (30155 30412) (::1) $ doveadm who 192.0.2.0/24 username # proto (pids) (ips) john@example.com 1 imap (30257) (192.0.2.34) ``` Show authenticated sessions, filtered by username: ```sh doveadm who pvo ``` ``` username # proto (pids) (ips) pvo 1 sieve (30343) (fd95:4eed:38ba::25) pvo 4 imap (25693 25686 25679 25669) (fd95:4eed:38ba::25) $ doveadm who ja\* username # proto (pids) (ips) james 1 imap (30091) (127.0.0.1) jane 2 imap (30155 30412) (::1) ``` ## SEE ALSO [[man,doveadm]] # doveadm(1) - Dovecot's administration utility ## SYNOPSIS **doveadm** [**-DOkv**] [**-i** *instance-name*] [**-c** *config-file*] [**-o** *key***=***value* [ .. ]] [**-f** *formatter*] *command* [*command_options*] [*command_arguments*] ## DESCRIPTION **doveadm** is the Dovecot administration tool. It can be used to manage various parts of Dovecot, as well as access users' mailboxes. Execute **doveadm help**, for a command usage listing. ## COMMANDS These commands work directly with Dovecot's master process. ### doveadm reload Force [[man,dovecot]] to reload the configuration. ### doveadm stop Stop [[man,dovecot]] and all its child processes. ## ADDITIONAL MASTER COMMANDS ### doveadm config [[man,doveconf]], Dump Dovecot configuration. ### doveadm exec [[man,doveadm-exec]], Easily execute commands from Dovecot's libexec_dir. ### doveadm instance [[man,doveadm-instance]], Manage the list of running Dovecot instances. ### doveadm kick [[man,doveadm-kick]], Disconnect users by user name and/or IP address. ### doveadm log [[man,doveadm-log]], Locate, test or reopen Dovecot's log files. ### doveadm penalty [[man,doveadm-penalty]], Show current penalties. ### doveadm proxy [[man,doveadm-proxy]], Handle Dovecot proxy connections. ### doveadm who [[man,doveadm-who]], Show who is logged into the Dovecot server. ## AUTHENTICATION COMMANDS ### doveadm auth [[man,doveadm-auth]], Test authentication for a user. ### doveadm pw [[man,doveadm-pw]], Dovecot's password hash generator. ### doveadm user [[man,doveadm-user]], Perform a user lookup in Dovecot's userdbs ## MAILBOX COMMANDS ### doveadm acl [[man,doveadm-acl]], Manage Access Control List (ACL). ### doveadm altmove [[man,doveadm-altmove]], Move matching mails to the alternative storage. ### doveadm backup [[man,doveadm-sync]], Dovecot's one-way mailbox synchronization utility. ### doveadm copy [[man,doveadm-move]], Copy/move messages matching the given search query into another mailbox. ### doveadm deduplicate [[man,doveadm-deduplicate]], Expunge duplicate messages. ### doveadm dump [[man,doveadm-dump]], Dump the content of Dovecot's binary mailbox index/log. ### doveadm expunge [[man,doveadm-expunge]], Expunge messages matching given search query. ### doveadm fetch [[man,doveadm-fetch]], Fetch messages matching given search query. ### doveadm flags [[man,doveadm-flags]], Add, remove or replace messages' flags. ### doveadm force-resync [[man,doveadm-force-resync]], Repair broken mailboxes, in case Dovecot doesn't automatically do that. ### doveadm fs [[man,doveadm-fs]], Interact with the abstract mail storage filesystem. ### doveadm fts [[man,doveadm-fts]], Manipulate the Full Text Search (FTS) index. ### doveadm import [[man,doveadm-import]], Import messages matching given search query. ### doveadm index [[man,doveadm-index]], Index messages in a given mailbox. ### doveadm mail fs [[man,doveadm-mail-fs]], Interact with the abstract mail storage filesystem in a user context. ### doveadm mailbox [[man,doveadm-mailbox]], Various commands related to handling mailboxes. ### doveadm mailbox cryptokey [[man,doveadm-mailbox-cryptokey]], Mail crypt plugin management. ### doveadm move [[man,doveadm-move]], Move messages matching the given search query into another mailbox. ### doveadm purge [[man,doveadm-purge]], Remove messages with refcount=0 from mdbox files. ### doveadm quota [[man,doveadm-quota]], Initialize/recalculate or show current quota usage. ### doveadm rebuild [[man,doveadm-rebuild]], Rebuild index metadata from message data. ### doveadm save [[man,doveadm-save]], Save email to users' mailboxes. ### doveadm search [[man,doveadm-search]], Show a list of mailbox GUIDs and message UIDs matching given search query. ### doveadm stats [[man,doveadm-stats]], Inspect or reset stats. ### doveadm sync [[man,doveadm-sync]], Dovecot's two-way mailbox synchronization utility. ## EXIT STATUS **doveadm** will exit with one of the following values: **0** : Selected command was executed successful. **64** : Command line usage error. **65** : Data format error or operation is not possible. **67** : User does not exist. **68** : Input file, address or other resource does not exist. **73** : Cannot create output file. **75** : There was some temporary error, check logs. **76** : Protocol error during remote host connection. **77** : Permission error. **78** : Configuration error. **127** : Unknown error. ## ENVIRONMENT **USER** : This environment variable is used to determine the *user* if a command accepts a *user* but none was specified. ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file. */etc/dovecot/conf.d/10-mail.conf* : Mailbox locations and namespaces. */etc/dovecot/conf.d/90-plugin.conf* : Plugin specific settings. ## SEE ALSO [[man,doveadm-help]] # doveconf(1) - Dovecot's configuration dumping utility ## SYNOPSIS **doveconf** [**-aCdFInPNUwx**] [**-c** *config-file*] [**-f** *filter*] **doveconf** [**-n**] [**-c** *config-file*] *section_name* ... **doveconf** [**-h**] [**-c** *config-file*] [**-f** *filter*] *setting_name* ... ## DESCRIPTION **doveconf** reads and parses Dovecot's configuration files and converts them into a simpler format used by the rest of Dovecot. All standalone programs, such as [[man,dovecot]], will first get their settings by executing doveconf, unless they can get the settings by connecting to the config UNIX socket. For system administrators, **doveconf** is mainly useful for inspecting the current configuration in an easy human readable format, checking individual settings, and comparing configured values against their defaults. It can also be used to inspect configuration @groups by querying them directly. ## OPTIONS **-a** : Show all settings with their currently configured values. **-C** : TODO (check full config). **-c** *config-file* : Read configuration from the given *config-file*. By default */etc/dovecot/dovecot.conf* will be used. **-d** : Show the setting's default value instead of the one currently configured. This can also be used to show the contents of default setting groups by querying the group name directly, for example: `doveconf -d @mailbox_defaults/english` **-F** : Show the configuration in a filter-based format, which is how Dovecot internally accesses it. This can be useful for debugging why configuration is not working as expected. The settings are grouped into different "structs", which are all accessed independently. A new struct is started in the output as `# struct_name`. Next is the list of filters, which begin with `:FILTER` followed by the filter in the event filter syntax. An empty filter matches everything. The filters are processed from end to beginning. The settings are taken from the first matching filter (i.e. the last in the output). Since not all filters have all settings defined, the processing continues until all settings have been found. Named list filter such as `protocols = imap pop3` are shown as `protocol/imap=yes` and `protocol/pop3=yes # stop list`. The "stop list" means that the value is not modified by any following filters that match. If the setting was defined as `protocols { imap=yes, pop3=yes }`, the "stop list" would be missing, because this setting is only adding the protocols, not replacing the list. Settings groups are included in `:INCLUDE` lines. The includes are processed last, after all filters have been applied, so all settings inside the groups can be overridden. **-f** *filter* : Show the matching configuration for the specified *filter* condition. The *filter* option string has to be given as *name* **=** *value* pair. For multiple filter conditions the **-f** option can be supplied multiple times. Possible names for the *filter* are: : **protocol** : The protocol, e.g. imap or pop3 : **local_name** : The local hostname for TLS SNI matching, e.g. mail.example.com. This matches filters which were configured like: : **local_name mail.example.com { # special settings }** : **local** : The local hostname or IP address. This matches filters which were configured like: : **local 1.2.3.0/24 { # special settings }** : **remote** : The client's hostname or IP address. This matches filters which were configured like: : **remote 1.2.3.0/24 { # special settings }** **-h** : Hide the setting's name, show only the setting's value. **-I** : TODO (dump config import). **-n** : Show only settings with non-default values. This is the default behavior when no other parameters are given. **-N** : Show settings with non-default values and explicitly set default values. **-s** : Show also hidden settings. The hidden settings should not be changed normally. **-P** : Show passwords and other sensitive values. **-U** : Ignore all unknown settings in config file. **-w** : TODO (hide obsolete warnings). **-x** : Expand configuration variables (e.g. `$ENV:foo`) and show file contents (from e.g. `ssl_server_key_password = ## SEE ALSO [[man,doveadm]] # dovecot-lda - Dovecot's local mail delivery agent ## SYNOPSIS **dovecot-lda** [**-ek**] [**-a** *address*] [**-c** *config_file*] [**-d** *username*] [**-f** *envelope_sender*] [**-m** *mailbox*] [**-o** *setting=value*] [**-p** *path*] [**-r** *address*] ## DESCRIPTION The **dovecot-lda** is a local mail delivery agent which takes mail from an MTA and delivers it to a user's mailbox, while keeping Dovecot index files up to date. Main features of the **dovecot-lda** are: * Mailbox indexing during mail delivery, providing faster mailbox access later * Quota enforcing by the quota plugin * Sieve language support by the Pigeonhole sieve plugin ## OPTIONS Options accepted by **dovecot-lda**: **-a** *address* : Destination address (e.g. user+ext@domain). If not specified, default is based on the [[setting,lda_original_recipient_header]] setting. **-c** *config_file* : Alternative configuration file path. **-d** *username* : Destination *username*. If given, the user information is looked up from userdb. Typically used with virtual users, but not necessarily with system users. **-e** : If mail gets rejected, write the rejection reason to stderr and exit with status 77 (EX_NOPERM). The default is to send a rejection mail ourself. **-f** *envelope_sender* : Envelope sender address. If not specified and message data begins with a valid mbox-style `"From "` line, the address is taken from it. **-k** : Don't clear all environment at startup. **-m** *mailbox* : Destination mailbox (default is **INBOX**). If the mailbox doesn't exist, it will not be created (unless [[setting,lda_mailbox_autocreate,yes]]). If a message couldn't be saved to the *mailbox* for any reason, it's delivered to **INBOX** instead. - If Sieve plugin is used, this mailbox is used as the `keep` action's mailbox. It's also used if there is no Sieve script or if the script fails for some reason. - Deliveries to namespace prefix will result in saving the mail to INBOX instead. For example if you have `Mail/` namespace, this allows you to specify `dovecot-lda -m Mail/$mailbox` where mail is stored to `Mail/$mailbox` or to INBOX if `$mailbox` is empty. - The mailbox name is specified the same as it's visible in IMAP client. For example if you've a Maildir with `.box.sub/` directory, your namespace configuration is [[setting,namespace_prefix,INBOX/]] and [[setting,namespace_separator,/]], the correct way to deliver mail there is to use `-m INBOX/box/sub` **-o** *setting***=***value* : Overrides the configuration *setting* from */etc/dovecot/dovecot.conf* and from the userdb with the given *value*. In order to override multiple settings, the **-o** option may be specified multiple times. **-p** *path* : Path to the mail to be delivered instead of reading from stdin. If using maildir the file is hard linked to the destination if possible. This allows a single mail to be delivered to multiple users using hard links, but currently it also prevents deliver from updating cache file so it shouldn't be used unless really necessary. **-r** *address* : Final envelope recipient address. Defaults to `-a` address, but may differ if, e.g., aliases are used or when dropping the `+detail` part. ## EXIT STATUS **dovecot-lda** will exit with one of the following values: **0** : Delivery was successful. (EX_OK) **64** : Invalid parameter given. (EX_USAGE) **67** : Recipient user not known. (EX_NOUSER) **77** : **-e** option was used and mail was rejected. Typically this happens when user is over quota and **quota_full_tempfail = no** is configured. (EX_NOPERM) **75** : A temporary failure. This is returned for almost all failures. See the log file for details. (EX_TEMPFAIL) ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file. */etc/dovecot/conf.d/10-mail.conf* : Mailbox locations and namespaces. */etc/dovecot/conf.d/15-lda.conf* : LDA specific settings. */etc/dovecot/conf.d/90-plugin.conf* : Plugin specific settings. */etc/dovecot/conf.d/90-quota.conf* : Quota configuration. ## SEE ALSO [[man,doveadm]] Related MTA specific documentation: - Postfix: - **postconf**(5), **transport**(5), **pipe**(8) - Exim: - https://exim.org/exim-html-current/doc/html/spec_html/ch16.html - https://exim.org/exim-html-current/doc/html/spec_html/ch24.html - https://exim.org/exim-html-current/doc/html/spec_html/ch29.html # dovecot-sysreport(1) - Dovecot's system report utility ## SYNOPSIS **dovecot-sysreport** [**-h|-\-help**] [**-c|-\-core** [*binary*] *core* [...]] [**-d|-\-destination** *dest*] [**-k|-\-keeptemp**] ## DESCRIPTION **dovecot-sysreport** is a utility that should be used to gather information from the current system to be reported for dovecot bug fixes. It will collect dovecot's ps output, service status, process status, uptime command's output, error log, stats dump and if given, a core file along with its binary dependencies. ## OPTIONS **-h|-\-help** : Prints a help message. **-c|-\-config** *root_config_file* : Sets the root file of the dovecot's configuration. If not set, it will be assumed to be in the default configuration path. **-o|-\-core** [ *binary* ] *core* *[...]* : Includes core files along with their dependencies extracted from the specified binary file. **-d|-\-destination** *dest* : Sets the file location which the report archive should be put to. The default value is dovecot-sysreport-\-\.tar.gz in the current path. **-k|-\-keeptemp** : If set, temp files would not be deleted at the end. # dovecot(1) - A secure and highly configurable IMAP and POP3 server ## SYNOPSIS **dovecot** [**-Fp**] [**-c** *config-file*] **dovecot -a** [**-c** *config-file*] **dovecot -n** [**-c** *config-file*] **dovecot -\-build-options** **dovecot -\-help** **dovecot -\-hostdomain** **dovecot -\-version** **dovecot reload** **dovecot stop** ## DESCRIPTION Dovecot is an open source IMAP and POP3 server for Linux/UNIX-like systems, written with security primarily in mind. Dovecot is an excellent choice for both small and large installations. It's fast, simple to set up, requires no special administration and it uses very little memory. ## OPTIONS **-a** : Dump all configuration settings to stdout and exit successfully. The same as *doveconf -a*. **-c** *config-file* : Start **dovecot** with an alternative configuration. **-F** : Run **dovecot** in foreground, do not daemonize. **-n** : Dump non-default settings to stdout and exit successfully. The same as *doveconf -n*. **-p** : Prompt for the ssl key password for the configured *ssl_server_key* on startup. **-\-build-options** : Show Dovecot's build options and exit successfully. **-\-help** : Print a usage message to stdout and exit successfully. **-\-hostdomain** : Shows the current *host*.*domain* name of the system. If the domain lookup should fail for some reason, only the hostname will be shown. **-\-version** : Show Dovecot's version and exit successfully. ## COMMANDS **reload** : Force **dovecot** to reload its configuration. **stop** : Shutdown **dovecot** and all its child processes. When *shutdown_clients* is set to **no**, existing sessions will continue to use the old settings, after a **dovecot reload**. Also all sessions will keep alive after a **dovecot stop**. By default all active sessions will be shut down. ## SIGNALS Dovecot handles the following *signals* as described: **HUP** : Force **dovecot** to reload its configuration. **INT** : Shutdown **dovecot** and all its child processes. **TERM** : Shutdown **dovecot** and all its child processes. **USR1** : Force **dovecot** to reopen all configured log files (*log_path*, *info_log_path* and *debug_log_path*). The *signals* **ALARM** and **PIPE** are ignored. ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file. */etc/dovecot/conf.d/*.conf* : Configuration files of different services and settings. ## SEE ALSO [[man,doveadm]] # pigeonhole(7) - Overview of the Pigeonhole Sieve support for Dovecot ## DESCRIPTION Pigeonhole adds support for the Sieve language ([[rfc,5228]]) and the ManageSieve protocol ([[rfc,5804]]) to Dovecot ([[man,dovecot]]). In the literal sense, a pigeonhole is a a hole or recess inside a dovecot for pigeons to nest in. It is, however, also the name for one of a series of small, open compartments in a cabinet used for filing or sorting mail. As a verb, it describes the act of putting an item into one of those pigeonholes. The name "Pigeonhole" therefore well describes an important part of the functionality that it adds to Dovecot: sorting and filing e-mail messages. The Sieve language is used to specify how e-mail needs to be processed. By writing Sieve scripts, users can customize how messages are delivered, e.g. whether they are forwarded or stored in special folders. Unwanted messages can be discarded or rejected, and, when the user is not available, the Sieve interpreter can send an automated reply. Above all, the Sieve language is meant to be simple, extensible and system independent. And, unlike most other mail filtering script languages, it does not allow users to execute arbitrary programs. This is particularly useful to prevent virtual users from having full access to the mail store. The intention of the language is to make it impossible for users to do anything more complex (and dangerous) than write simple mail filters. Using the ManageSieve protocol, users can upload their Sieve scripts remotely, without needing direct filesystem access through FTP or SCP. Additionally, a ManageSieve server always makes sure that uploaded scripts are valid, preventing compile failures at mail delivery. Pigeonhole provides the following items: - The LDA Sieve plugin for Dovecot's Local Delivery Agent (LDA) ([[man,dovecot-lda]]) that facilitates the actual Sieve filtering upon delivery. - The ManageSieve service that implements the ManageSieve protocol through which users can remotely manage Sieve scripts on the server. - A plugin for Dovecot's [[man,doveadm]] command line tool that adds new [[man,doveadm-sieve]] commands for management of Sieve filtering. - The [[plugin,imap-sieve]] plugin, which provides the ability to attach Sieve scripts that are run for IMAP events in their mailboxes. - The [[plugin,imap-filter-sieve,FILTER=SIEVE IMAP capability]] that allows refiltering mails in a mailbox using Sieve scripts. The functionality and configuration of the LDA Sieve plugin and the ManageSieve service is described in detail in the README and INSTALL files contained in the Pigeonhole package and in [[link,sieve]]. The following command line tools are available outside of **doveadm**: [[man,sievec]] : Compiles Sieve scripts into a binary representation for later execution. [[man,sieve-test]] : The universal Sieve test tool for testing the effect of a Sieve script on a particular message. [[man,sieve-filter]] : Filters all messages in a particular source mailbox through a Sieve script. [[man,sieve-dump]] : Dumps the content of a Sieve binary file for (development) debugging purposes. ## SEE ALSO [[man,dovecot]], [[man,dovecot-lda]], [[man,doveadm]], [[man,doveadm-sieve]], [[man,sieve-dump]], [[man,sieve-test]], [[man,sieve-filter]], [[man,sievec]] Additional resources: - [[link,sieve]] # sieve-dump(1) - Pigeonhole's Sieve script binary dump tool ## SYNOPSIS **sieve-dump** [*options*] *sieve-binary* [*out-file*] ## DESCRIPTION The **sieve-dump** command is part of Pigeonhole ([[man,pigeonhole,,7]]), which adds Sieve ([[rfc,5228]]) and ManageSieve ([[rfc,5804]]) support to Dovecot ([[man,dovecot]]). Using the **sieve-dump** command, Sieve binaries, which are produced for instance by [[man,sievec]], can be transformed into a human-readable textual representation. This can provide valuable insight in how the Sieve script is executed. This is also particularly useful to view corrupt binaries that can result from bugs in the Sieve implementation. This tool is intended mainly for development purposes, so normally system administrators and users will not need to use this tool. The format of the output is not explained here in detail, but it should be relatively easy to understand. The Sieve binaries comprise a set of data blocks, each of which can contain arbitrary data. For the base language implementation two blocks are used: the first containing a specification of all required language extensions and the second containing the main Sieve program. Compiled Sieve programs are represented as flat byte code and therefore the dump of the main program is a disassembly listing of the interpreter operations. Extensions can define new operations and use additional blocks. Therefore, the output of **sieve-dump** depends greatly on the language extensions used when compiling the binary. ## OPTIONS **-c** *config-file* : Alternative Dovecot configuration file path. **-D** : Enable Sieve debugging. **-h** : Produce per-block hexdump output of the whole binary instead of the normal human-readable output. ## ARGUMENTS *sieve-binary* : Specifies the Sieve binary file that needs to be dumped. *out-file* : Specifies where the output must be written. This argument is optional. If omitted, the output is written to **stdout**. ## EXIT STATUS **sieve-dump** will exit with one of the following values: **0** : Dump was successful. (EX_OK, EXIT_SUCCESS) **1** : Operation failed. This is returned for almost all failures. (EXIT_FAILURE) **64** : Invalid parameter given. (EX_USAGE) ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file. */etc/dovecot/conf.d/90-sieve.conf* : Sieve interpreter settings (included from Dovecot's main : configuration file) ## SEE ALSO [[man,dovecot]], [[man,dovecot-lda]], [[man,sieve-filter]], [[man,sieve-test]], [[man,sievec]], [[man,pigeonhole,,7]] # sieve-filter(1) - Pigeonhole's Sieve mailbox filter tool ::: warning This tool is still experimental. Read this manual carefully, and backup any important mail before using this tool. Also note that some of the features documented here are not actually implemented yet; this is clearly indicated where applicable. ::: ## SYNOPSIS **sieve-filter** [*options*] *script-file* *source-mailbox* [*discard-action*] ## DESCRIPTION The **sieve-filter** command is part of Pigeonhole ([[man,pigeonhole,,7]]), which adds Sieve ([[rfc,5228]]) and ManageSieve ([[rfc,5804]]) support to Dovecot ([[man,dovecot]]). The Sieve language was originally meant for filtering messages upon delivery. However, there are occasions when it is desirable to filter messages that are already stored in a mailbox, for instance when a bug in a Sieve script caused many messages to be delivered incorrectly. Using the sieve-filter tool it is possible to apply a Sieve script on all messages in a particular *source-mailbox*, making it possible to delete messages, to store them in a different mailbox, to change their content, and to change the assigned IMAP flags and keywords. Attempts to send messages to the outside world are ignored by default for obvious reasons, but, using the proper command line options, it is possible to capture and handle outgoing mail as well. If no options are specified, the sieve-filter command runs in a simulation mode in which it only prints what would be performed, without actually doing anything. Use the **-e** option to activate true script execution. Also, the *source-mailbox* is opened read-only by default, meaning that it normally always remains unchanged. Use the **-W** option to allow changes in the *source-mailbox*. Even with the **-W** option enabled, messages in the *source-mailbox* are only potentially modified or moved to a different folder. Messages are never lost unless a *discard-action* argument other than **keep** (the default) is specified. If the Sieve filter decides to store the message in the *source-mailbox*, where it obviously already exists, it is never duplicated there. In that case, the IMAP flags of the original message can be modified by the Sieve interpreter using the *imap4flags* extension, provided that **-W** is specified. If the message itself is modified by the Sieve interpreter (e.g. using the *editheader* extension), a new message is stored and the old one is expunged. However, if **-W** is omitted, the original message is left untouched and the modifications are discarded. ## CAUTION Although this is a very useful tool, it can also be very destructive when used improperly. A small bug in your Sieve script in combination with the wrong command line options could cause it to discard the wrong e-mails. And, even if the *source-mailbox* is opened in read-only mode to prevent such mishaps, it can still litter other mailboxes with spurious copies of your e-mails if your Sieve script decides to do so. Therefore, users are advised to read this manual carefully and to use the simulation mode first to check what the script will do. And, of course: **MAKING A BACKUP IS IMPERATIVE FOR ANY IMPORTANT MAIL!** ## OPTIONS **-c** *config-file* : Alternative Dovecot configuration file path. **-C** : Force compilation. By default, the compiled binary is stored on disk. When this binary is found during the next execution of **sieve-filter** and its modification time is more recent than the script file, it is used and the script is not compiled again. This option forces the script to be compiled, thus ignoring any present binary. Refer to [[man,sievec]] for more information about Sieve compilation. **-D** : Enable Sieve debugging. **-e** : Turns on execution mode. By default, the sieve-filter command runs in simulation mode in which it changes nothing, meaning that no mailbox is altered in any way and no actions are performed. It only prints what would be done. Using this option, the sieve-filter command becomes active and performs the requested actions. **-m** *default-mailbox* : The mailbox where the (implicit) **keep** Sieve action stores messages. This is equal to the *source-mailbox* by default. Specifying a different folder will have the effect of moving (or copying if **-W** is omitted) all kept messages to the indicated folder, instead of just leaving them in the *source-mailbox*. Refer to the explanation of the *source-mailbox* argument for more information on mailbox naming. **-q** *output-mailbox* **[not implemented yet]** : Store outgoing e-mail into the indicated *output-mailbox*. By default, the sieve-filter command ignores Sieve actions such as redirect, reject, vacation and notify, but using this option outgoing messages can be appended to the indicated mailbox. This option has no effect in simulation mode. Flags of redirected messages are not preserved. **-Q** *mail-command* **[not implemented yet]** : Send outgoing e-mail (e.g. as produced by redirect, reject and vacation) through the specified program. By default, the sieve-filter command ignores Sieve actions such as redirect, reject, vacation and notify, but using this option outgoing messages can be fed to the **stdin** of an external shell command. This option has no effect in simulation mode. Unless you really know what you are doing, **DO NOT USE THIS TO FEED MAIL TO SENDMAIL!**. **-s** *script-file* **[not implemented yet]** : Specify additional scripts to be executed before the main script. Multiple **-s** arguments are allowed and the specified scripts are executed sequentially in the order specified at the command line. **-v** : Produce verbose output during filtering. **-W** : Enables write access to the *source-mailbox*. This allows (re)moving the messages from the *source-mailbox*, changing their contents, and changing the assigned IMAP flags and keywords. ## ARGUMENTS *script-file* : Specifies the Sieve script to (compile and) execute. Note that this tool looks for a pre-compiled binary file with a *.svbin* extension and with basename and path identical to the specified script. Use the **-C** option to disable this behavior by forcing the script to be compiled into a new binary. *source-mailbox* : Specifies the source mailbox containing the messages that the Sieve filter will act upon. This is the name of a mailbox, as visible to IMAP clients, except in UTF-8 format. The hierarchy separator between a parent and child mailbox is commonly '**/**' or '**.**', but this depends on your selected mailbox storage format and namespace configuration. The mailbox names may also require a namespace prefix. This mailbox is not modified unless the **-W** option is specified. *discard-action* : Specifies what is done with messages in the *source-mailbox* that where not kept or otherwise stored by the Sieve script; i.e. those messages that would normally be discarded if the Sieve script were executed at delivery. The *discard-action* parameter accepts one of the following values: : **keep** (default) : Keep discarded messages in source mailbox. : **move** *mailbox* : Move discarded messages to the indicated *mailbox*. This is for instance useful to move messages to a Trash mailbox. Refer to the explanation of the *source-mailbox* argument for more information on mailbox naming. : **delete** : Flag discarded messages as \\DELETED. : **expunge** : Expunge discarded messages, meaning that these are removed irreversibly when the tool finishes filtering. When the **-W** option is not specified, the *source-mailbox* is immutable and the specified *discard-action* has no effect. This means that messages are at most *copied* to a new location. In contrast, when the **-W** is specified, messages that are successfully stored somewhere else by the Sieve script are **always** expunged from the *source-mailbox*, with the effect that these are thus *moved* to the new location. This happens irrespective of the specified *discard-action*. Remember: only discarded messages are affected by the specified *discard-action*. ## EXIT STATUS **sieve-filter** will exit with one of the following values: **0** : Sieve filter applied successfully. (EX_OK, EXIT_SUCCESS) **64** : Command line usage error. **65** : Data format error or operation is not possible. **67** : User does not exist. **68** : Input file, address or other resource does not exist. **73** : Cannot create output file. **75** : There was some temporary error, check logs. **76** : Protocol error during remote host connection. **77** : Permission error. **78** : Configuration error. **127** : Unknown error. ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file. */etc/dovecot/conf.d/90-sieve.conf* : Sieve interpreter settings (included from Dovecot's main configuration file) ## SEE ALSO [[man,dovecot]], [[man,dovecot-lda]], [[man,sieve-dump]], [[man,sieve-test]], [[man,sievec]], [[man,pigeonhole,,7]] # sieve-test(1) - Pigeonhole's Sieve script tester ## SYNOPSIS **sieve-test** [*options*] *script-file* *mail-file* ## DESCRIPTION The **sieve-test** command is part of Pigeonhole ([[man,pigeonhole,,7]]), which adds Sieve ([[rfc,5228]]) and ManageSieve ([[rfc,5804]]) support to Dovecot ([[man,dovecot]]). Using the **sieve-test** command, the execution of Sieve scripts can be tested. This evaluates the script for the provided message, yielding a set of Sieve actions. Unless the **-e** option is specified, it does not actually execute these actions, meaning that it does not store or forward the message anywhere. Instead, it prints a detailed list of what actions would normally take place. Note that, even when **-e** is specified, no messages are ever transmitted to remote SMTP recipients. The outgoing messages are always printed to **stdout** instead. This is a very useful tool to debug the execution of Sieve scripts. It can be used to verify newly installed scripts for the intended behaviour and it can provide more detailed information about script execution problems that are reported by the Sieve plugin, for example by tracing the execution and evaluation of commands and tests respectively. ## OPTIONS **-a** *orig-recipient-address* : The original envelope recipient address. This is what Sieve's envelope test will compare to when the "to" envelope part is requested. Some tests and actions will also use this as the script owner's e-mail address. If this option is omitted, the recipient address is retrieved from the "Envelope-To:", or "To:" message headers. If none of these headers is present either, the recipient address defaults to *recipient@example.com*. **-c** *config-file* : Alternative Dovecot configuration file path. **-C** : Force compilation. By default, the compiled binary is stored on disk. When this binary is found during the next execution of **sieve-test** and its modification time is more recent than the script file, it is used and the script is not compiled again. This option forces the script to be compiled, thus ignoring any present binary. Refer to [[man,sievec]] for more information about Sieve compilation. **-D** : Enable Sieve debugging. **-e** : Enables true execution of the set of actions that results from running the script. Use he **-o** parameter to specify the mail_driver, mail_path and other necessary storage settings. This allows actual delivery of messages can be tested. Note that this will not transmit any messages to remote SMTP recipients. Such actions only print the outgoing message to **stdout**. **-f** *envelope-sender* : The envelope sender address (return path). This is what Sieve's envelope test will compare to when the "from" envelope part is requested. Also, this is where response messages are 'sent' to. If this option is omitted, the sender address is retrieved from the "Return-Path:", "Sender:" or "From:" message headers. If none of these headers is present either, the sender envelope address defaults to *sender@example.com*. **-m** *default-mailbox* : The mailbox where the keep action stores the message. This is "INBOX" by default. **-r** *recipient-address* : The final envelope recipient address. Some tests and actions will use this as the script owner's e-mail address. For example, this is what is used by the vacation action to check whether a reply is appropriate. If the **-r** option is omitted, the original envelope recipient address will be used instead (see **-a** option for more info). **-s** *script-file* : Specify additional scripts to be executed before the main script. Multiple **-s** arguments are allowed and the specified scripts are executed sequentially in the order specified at the command line. **-t** *trace-file* : Enables runtime trace debugging. Trace debugging provides detailed insight in the operations performed by the Sieve script. Refer to the runtime trace debugging section below. The trace information is written to the specified file. Using '-' as filename causes the trace data to be written to **stdout**. **-T** *trace-option* : Configures runtime trace debugging, which is enabled with the **-t** option. Refer to the runtime trace debugging section below. ## ARGUMENTS *script-file* : Specifies the script to (compile and) execute. Note that this tool looks for a pre-compiled binary file with a *.svbin* extension and with basename and path identical to the specified script. Use the **-C** option to disable this behavior by forcing the script to be compiled into a new binary. *mail-file* : Specifies the file containing the e-mail message to test with. ## USAGE ### RUNTIME TRACE DEBUGGING Using the **-t** option, the **sieve-test** tool can be configured to print detailed trace information on the Sieve script execution to a file or standard output. For example, the encountered commands, the performed tests and the matched values can be printed. The runtime trace can be configured using the **-T** option, which can be specified multiple times. It can be used as follows: **-T level=...** : Set the detail level of the trace debugging. One of the following values can be supplied: : *actions* (default) : Only print executed action commands, like keep, fileinto, reject and redirect. : *commands* : Print any executed command, excluding test commands. : *tests* : Print all executed commands and performed tests. : *matching* : Print all executed commands, performed tests and the values matched in those tests. **-T debug** : Print debug messages as well. This is usually only useful for developers and is likely to produce messy output. **-T addresses** : Print byte code addresses for the current trace output. Normally, only the current Sieve source code position (line number) is printed. The byte code addresses are equal to those listed in a binary dump produced using the **-d** option or by the [[man,sieve-dump]] command. ### DEBUG SIEVE EXTENSION To improve script debugging, this Sieve implementation supports a custom Sieve language extension called 'vnd.dovecot.debug'. It adds the **debug_log** command that allows logging debug messages. Example: ``` require "vnd.dovecot.debug"; if header :contains "subject" "hello" { debug_log "Subject header contains hello!"; } ``` Tools such as **sieve-test**, [[man,sievec]] and [[man,sieve-dump]] have support for the vnd.dovecot.debug extension enabled by default and it is not necessary to enable nor possible to disable the availability of the debug extension with the **-x** option. The logged messages are written to **stdout** in this case. In contrast, for the actual Sieve plugin for the Dovecot LDA ([[man,dovecot-lda]]) the vnd.dovecot.debug extension needs to be enabled explicitly using the [[setting,sieve_extensions]] or [[setting,sieve_global_extensions]] setting. The messages are then logged to the user's private script log file. If used in a global script, the messages are logged through the default Dovecot logging facility. ## EXIT STATUS **sieve-test** will exit with one of the following values: **0** : Execution was successful. (EX_OK, EXIT_SUCCESS) **1** : Operation failed. This is returned for almost all failures. (EXIT_FAILURE) **64** : Invalid parameter given. (EX_USAGE) ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file. */etc/dovecot/conf.d/90-sieve.conf* : Sieve interpreter settings (included from Dovecot's main configuration file) ## SEE ALSO [[man,dovecot]], [[man,dovecot-lda]], [[man,sieve-dump]], [[man,sieve-filter]], [[man,sievec]], [[man,pigeonhole,,7]] # sievec(1) - Pigeonhole's Sieve script compiler ## SYNOPSIS **sievec** [*options*] *script-file* [*out-file*] ## DESCRIPTION The **sievec** command is part of Pigeonhole ([[man,pigeonhole,,7]]), which adds Sieve ([[rfc,5228]]) and ManageSieve ([[rfc,5804]]) support to Dovecot ([[man,dovecot]]). Using the **sievec** command, Sieve scripts can be compiled into a binary representation. The resulting binary can be used directly to process e-mail messages during the delivery process. The delivery of mail messages and - by means of the LDA Sieve plugin - also the execution of Sieve scripts is performed by Dovecot's local delivery agent (LDA) called [[man,dovecot-lda]]. Usually, it is not necessary to compile the Sieve script manually using **sievec**, because [[man,dovecot-lda]] will do this automatically if the binary is missing. However, in some cases [[man,dovecot-lda]] does not have permission to write the compiled binary to disk, forcing it to recompile the script every time it is executed. Using the **sievec** tool, this can be performed manually by an authorized user to increase performance. The Pigeonhole Sieve implementation recognizes files with a **.sieve** extension as Sieve scripts and corresponding files with a **.svbin** extension as the associated compiled binary. This means for example that Dovecot's LDA process will first look for a binary file "dovecot.svbin" when it needs to execute "dovecot.sieve". It will compile a new binary when it is missing or outdated. The **sievec** command is also useful to verify Sieve scripts before using. Additionally, with the **-d** option it can output a textual (and thus human-readable) dump of the generated Sieve code to the specified file. The output is then identical to what the [[man,sieve-dump]] command produces for a stored binary file. This output is mainly useful to find bugs in the compiler that yield corrupt binaries. ## OPTIONS **-c** *config-file* : Alternative Dovecot configuration file path. **-d** : Don't write the binary to *out-file*, but write a textual dump of the binary instead. In this context, the *out-file* value '-' has special meaning: it causes the textual dump to be written to **stdout**. The *out-file* argument may also be omitted, which has the same effect as '-'. The output is identical to what the [[man,sieve-dump]] command produces for a compiled Sieve binary file. Note that this option is not allowed when the *out-file* argument is a directory. **-D** : Enable Sieve debugging. ## ARGUMENTS *script-file* : Specifies the script to be compiled. If the *script-file* argument is a directory, all files in that directory with a *.sieve* extension are compiled into a corresponding *.svbin* binary file. The compilation is not halted upon errors; it attempts to compile as many scripts in the directory as possible. Note that the **-d** option and the *out-file* argument are not allowed when the *script-file* argument is a directory. *out-file* : Specifies where the (binary) output is to be written. This argument is optional. If this argument is omitted, a binary compiled from \.sieve is saved as \.svbin. If this argument is omitted and **-b** is specified, the binary dump is output to **stdout**. ## EXIT STATUS **sievec** will exit with one of the following values: **0** : Compile was successful. (EX_OK, EXIT_SUCCESS) **1** : Operation failed. This is returned for almost all failures. (EXIT_FAILURE) **64** : Invalid parameter given. (EX_USAGE) **67** : User does not exist. **68** : Input file, address or other resource does not exist. **73** : Cannot create output file. **77** : Permission error. **78** : Configuration error. **127** : Unknown error. ## FILES */etc/dovecot/dovecot.conf* : Dovecot's main configuration file. */etc/dovecot/conf.d/90-sieve.conf* : Sieve interpreter settings (included from Dovecot's main : configuration file) ## SEE ALSO [[man,dovecot]], [[man,dovecot-lda]], [[man,sieve-dump]], [[man,sieve-filter]], [[man,sieve-test]], [[man,pigeonhole,,7]] # ACL: Access Control List Plugin (`acl`) This page talks mainly about how ACLs work, for more general description of how shared mailboxes work, see [[link,shared_mailboxes]]. Dovecot supports both administrator-configured ACL files and the IMAP ACL extension (see [[plugin,imap-acl]], which allows users to change ACLs themselves). The ACL code was written to allow multiple ACL drivers, but currently Dovecot supports only virtual ACL files. ::: warning Using ACLs doesn't grant mail processes any extra filesystem permissions that they already don't have. [[link,shared_mailboxes_permissions,You must make sure that the processes have enough permissions]] to be able to access the mailboxes. To test, you can first try accessing shared/public mailboxes without ACL plugin enabled. ::: ## Settings (dovecot.conf) ## Configuration ### Groups The [[setting,acl_groups]] setting can be dynamically set via [[link,userdb_extra_fields]]. ### IMAP ACLs To enable the IMAP ACL commands, you must load the [[plugin,imap_acl]]. This plugin should only be loaded inside a `protocol imap {}` block. ### Sample Configuration ```doveconf[dovecot.conf] # Enable internal ACL support mail_plugins { acl = yes } # Enable the IMAP ACL commands protocol imap { mail_plugins { imap_acl = yes } } acl_driver = vfile # If enable, don't try to find dovecot-acl files from mailbox directories. # This reduces unnecessary disk I/O when only global ACLs are used. # (v2.2.31+) acl_globals_only = yes namespace inbox [ inbox = yes mailbox Foo { acl owner { rights = lr } } acl user=admin { rights = lwristepai } ## Set this to yes to ignore ACLS for this namespace #acl_ignore = yes } ## setting ACLs here will affect all shared mailboxes namespace shared { mailbox Public { acl anyone { rights = lr } } } # Dict for mapping which users have shared mailboxes to each other. #acl_sharing_map { # dict file { # path = /var/lib/dovecot/dovecot-acl.db # } #} # ACL username # defaults to master_user, but if it expands to empty, will use current user. #acl_username = %{master_user} ``` ### Creating rule sets with group You can also simplify ACL rule set management by defining rule sets. Group settings expand as configuration where they are used, so they can include values from other filters too. ```[dovecot.conf] # define rule sets group @acl_rule_set set1 { acl user=user1 { rights = lri } } group @acl_rule_set set2 { acl user=user2 { rights = lri } } group @acl_rule_set set3 { acl user=user3 { rights = lri } } group @acl_rule_set default { acl user=admin { rights = lwristepai } } namespace public { @acl_rule_set = default mailbox "Secret" { @acl_rule_set = set1 } mailbox "TopSecret" { @acl_rule_set = set2 } mailbox "Foo*" { @acl_rule_set = set3 } mailbox "FooBar" { @acl_rule_set = set1 } } ``` With this configuration user `admin` will have full rights to all folders under public unless negated. Folders `Secret` and `FooBar` will have `user1` with rights, while folders `TopSecret` has `user2` with rights. This includes user `admin` from namespace level. User `user3` will have rights on anything that starts with `Foo`, including `FooBar`. ## Master Users ::: info [[deprecated,settings_acl_global_settings_added]]: This setting is deprecated in favor of configuration-file embedded settings. ::: Master users have their own ACLs. They're not the mailbox owners, so by default they have no permissions to any of the mailboxes. See [[link,acl_master_users]] for more information. ## ACL vfile Driver `vfile` driver supports per-mailbox ACLs and global ACLs. Per-mailbox ACLs are stored in `dovecot-acl` named file, which exists in: * Maildir:: The Maildir's mail directory (e.g., `~/Maildir`, `~/Maildir/.folder/`). * mbox: Control directory. You should explicitly specify [[setting,mail_control_path]]. * dbox: dbox's mail directory (e.g., `~/dbox/INBOX/dbox-Mails/`). ## ACL File Format The ACL files are in format: ``` [:] ``` Where **identifier** is one of: * `group-override=` * `user=` * `owner` * `group=` * `authenticated` * `anyone` (or `anonymous`) * Negative rights can be given by prepending the identifier with `-` The ACLS are processed in the precedence given above, so for example if you have given read-access to a group, you can still remove that from specific users inside the group. Group-override identifier allows you to override users' ACLs. Probably the most useful reason to do this is to temporarily disable access for some users. For example: ```[dovecot-acl] user=foo rw group-override=tempdisabled ``` Now if foo is in tempdisabled group, he has no access to the mailbox. This wouldn't be possible with a normal group identifier, because the `user=foo` would override it. Negative rights can be used to remove rights. For example a user may be given full rights to all mailboxes, except some of the rights removed from some specific mailboxes. ### Supported ACLs | ID | Type | Description | | --- | ---- | ----------- | | `l` | lookup | Mailbox is visible in mailbox list. Mailbox can be subscribed to. | | `r` | read | Mailbox can be opened for reading. | | `w` | write | Message flags and keywords can be changed, except \Seen and \Deleted | | `s` | write-seen | \Seen flag can be changed | | `t` | write-deleted | \Deleted flag can be changed | | `i` | insert | Messages can be written or copied to the mailbox | | `p` | post | Messages can be posted to the mailbox by [[link,lda]], e.g. from Sieve | | `e` | expunge | Messages can be expunged | | `k` | create | Mailboxes can be created (or renamed) directly under this mailbox (but not necessarily under its children, see [ACL Inheritance](#acl-inheritance-and-default-acls)) (renaming also requires delete rights) | | `x` | delete | Mailbox can be deleted | | `a` | admin | Administration rights to the mailbox (currently: ability to change ACLs for mailbox) | The ACLs are compatible with [[rfc,4314]] (IMAP ACL extension). Unknown ACL letters are complained about, but unknown named ACLs are ignored. Named ACLs are mostly intended for future extensions. ::: tip The file is rather picky about formatting; using a tab (or multiple spaces) instead of a space character between fields may not work. If you are having problems, make sure to check for tabs, extra spaces and other unwanted characters. ::: ### Examples Mailbox owner has all privileges, `foo` has list-read privileges: ```[dovecot-acl] owner lrwstipekxa user=foo lr ``` Allow everyone to list and read a public mailbox (public namespace has no owner): ```[dovecot-acl] anyone lr ``` Prevent all users from deleting their Spam folder (notice no x flag): ```[dovecot-acl] INBOX.Spam owner lrwstipeka ``` Allow a masteruser full access to all mailboxes, except no access to INBOX: ```[dovecot-acl] * user=masteruser lrwstipekxa INBOX -user=masteruser lrwstipekxa ``` ## ACL Inheritance and Default ACLs Every time you create a new mailbox, it gets its ACLs from the parent mailbox. If you're creating a root-level mailbox, it uses the namespace's default ACLs. There is no actual inheritance, however: If you modify parent's ACLs, the child's ACLs stay the same. There is currently no support for ACL inheritance. There are default ACLs though: * In private namespace, the owner has all ACL rights for mailboxes in the namespace. * In shared and public namespaces, there are no ACL rights by default. * However, optionally the default ACLs can be taken from the INBOX for private and shared namespaces. See [[setting,acl_defaults_from_inbox]]. ::: warning Currently the default ACLs are merged with the mailbox-specific ACLs. So if a default ACL gives access to `user1` and a per-mailbox ACL gives access to `user2`, the `user1` still has access to that mailbox. ::: ## Global ACLs Global ACLs can be used to apply ACLs globally to all user's specific mailboxes. They are used mainly for two purposes: 1. Removing some permissions from users' personal mailboxes. For example each user might have an `Invoices` mailbox which will be read-only. 2. Giving permissions to master user logins. See [[link,acl_master_users]] for more information. If a mailbox has both global ACLs and the per-mailbox ACL file, both of them are read and the ACLs are merged. If there are any conflicts, the global ACL file overrides per-mailbox ACL file. This is because users can modify their own per-mailbox ACL files via IMAP ACL extension. Global ACLs can only be modified by administrator, so users shouldn't be able to override them. ### Global ACL File Global ACL file path is specified as a parameter to vfile driver in [[setting,acl]], `/etc/dovecot/dovecot-acl` in the above example. The file contains otherwise the same data as regular per-mailbox `dovecot-acl` files, except each line is prefixed by the mailbox name pattern. The pattern may contain `*` and `?` wildcards that do the shell-string matching, not stopping at any boundaries. Example: ```[dovecot-acl] * user=foo lrw Public user=bar lrwstipekxa Public/* user=bar lrwstipekxa ``` The first line shares every mailbox of every user to the user `foo` with a limited set of rights, and the last line shares every folder below `Public` of every user to the user `bar`. ## List Cache `dovecot-acl-list` file lists all mailboxes that have `l` rights assigned. If you manually add/edit `dovecot-acl` files, you may need to delete the `dovecot-acl-list` to get the mailboxes visible. ## Dictionaries In order for an ACL to be fully useful, it has to be communicated to IMAP clients. For example, if you use ACL to share a mailbox to another user, the client has to be explicitly told to check out the other user's mailbox too, as that one is shared. Placing the ACL file makes the ACL effective, but Dovecot doesn't take care of the user to shared mailboxes mapping out of the box, and as a result, it won't publish shared mailboxes to clients if this is not set up. You have to configure this manually by defining an appropriate [[link,dict]] to store the map using [[setting,acl_sharing_map]]. ```doveconf[dovecot.conf] acl_sharing_map { dict file { path = /var/lib/dovecot/dovecot-acl.db } } ``` # AppArmor Plugin (`apparmor`) [AppArmor](https://www.wikipedia.org/wiki/AppArmor) plugin, which allows changing "hat" (apparmor context) when user is loaded. Context is changed back to default on user deinit. Multiple hats are supported and passed to [`aa_change_hatv()`](https://gitlab.com/apparmor/apparmor/-/wikis/manpage_aa_change_hat.2) function. ## Settings ## Settings: Extra Fields You can also specify hats from user or password database extra fields. ### Password Database If you provide from [[link,passdb]], use `userdb_apparmor_hats=hat`. ### User Database If you provide from [[link,userdb]], use `apparmor_hats=hat`. ## Sample Configuration ```doveconf[dovecot.conf] mail_plugins { apparmor = yes } apparmor_hats = hat_name ``` ## Debugging Enable [[setting,log_debug]] to see context changes. # Charset Alias Plugin (`charset-alias`) This plugin allows treating the specified source charset as a different charset when decoding to UTF-8. Example: when decoding from shift_jis to UTF-8, using cp932 (or sjis-win) instead of shift_jis may be preferable to handle Microsoft extended chars properly. ## Settings ## Sample Configuration ```doveconf[dovecot.conf] mail_plugins { charset_alias = yes } charset_aliases { shift_jis = sjis-win euc-jp = eucjp-win iso-2022-jp = iso-2022-jp-3 } ``` # Compression Plugin (`fs-compress`) `fs-compress` plugin is used to wrap other data streams in a compression layer. It can be used by any of the settings using the [[link,fs,FS drivers]]. The exact location where to set it in the FS driver hierarchy depends on what other FS drivers are being used. The important rules are: * Must be set before the final storage driver (`s3`, `sproxyd`, ...) * Should be set after `fscache` (you generally don't want `fscache` to be compressed for performance reasons). * Must be set before [[link,mail_crypt_fs_crypt,fs_crypt]], because encrypted data compresses poorly. ## Settings # Apache Solr FTS Plugin (`fts-solr`) [Solr](https://solr.apache.org/) is a Lucene indexing server. Dovecot communicates to it using HTTP/XML queries. ::: tip This documentation is written for Solr 7.7.0. You will need to adapt if using a different version. Installation and operation of a Solr system is outside the scope of this documentation. Refer to the Solr documentation for further information. This documentation focuses on Dovecot-specific tasks that need to be done to configure the system for FTS support. ::: ## Compiling Dovecot is not compiled with Solr FTS support by default. To enable it, you need to add the `--with-solr` parameter to your invocation of the `configure` script. You will also need to have libexpat installed, including development headers (typically from a separate development package). Configuration will fail if `--with-solr` is enabled while libexpat headers cannot be found. ## Server Setup ### Solr Installation Using this FTS engine requires Solr to be installed. Most OS distributions have packages for this. To use Solr with Dovecot, it needs to configured specifically for use with Dovecot. ```sh sudo -u solr /opt/solr/bin/solr create -c dovecot ``` Once the instance is created, you can start the Solr service. By default, the Solr administration page for the newly created instance is located at https://localhost:8983/solr/#/~cores/dovecot. It can be used to check the status of the Solr instance. Configuration errors are often most conveniently viewed here. Solr also writes log files, which can be used for debugging. ### Solr Configuration There are three primary configuration files that need to be changed to accommodate the Dovecot FTS needs: the instance configuration file `solrconfig.xml` and the schema files `schema.xml` and `managed-schema` used by the instance. These files are both located in the `conf` directory of the Solr instance (e.g., `/var/solr/data/dovecot/conf/`). #### Remove default core configuration files ```sh rm -f /var/solr/data/dovecot/conf/schema.xml rm -f /var/solr/data/dovecot/conf/managed-schema rm -f /var/solr/data/dovecot/conf/solrconfig.xml ``` #### Install schema.xml and solrconfig.xml Copy [`doc/solr-config-7.7.0.xml`](https://raw.githubusercontent.com/dovecot/core/main/doc/solr-config-7.7.0.xml) and [`doc/solr-schema-7.7.0.xml`](https://raw.githubusercontent.com/dovecot/core/main/doc/solr-schema-7.7.0.xml) to `/var/solr/data/dovecot/conf/` as `solrconfig.xml` and `schema.xml`. The `managed-schema` file is generated based on `schema.xml`. ## Dovecot Setup ::: tip This plugin requires the [[plugin,fts]] to be activated and configured ::: ## Dovecot Settings ## Example Configuration ```doveconf[dovecot.conf] mail_plugins { fts = yes fts_solr = yes } fts solr { url = url=https://solr.example.org:8983/solr/ batch_size = 1000 } ``` Important notes: - Some mail clients will not submit any search requests for certain fields if they index things locally eg. Thunderbird will not send any requests for fields such as sender/recipients/subject when Body is not included as this data is contained within the local index. ## Solr Commits & Optimization Solr indexes should be optimized once in a while to make searches faster and to remove space used by deleted mails. Dovecot never asks Solr to optimize, so you should do this yourself. Perhaps a cronjob that sends the optimize-command to Solr every n hours. Dovecot only does soft commits to the Solr index to improve performance. You must run a hard commit once in a while or Solr will keep increasing its transaction log sizes. For example send the commit command to Solr every few minutes. ```sh Optimize should be run somewhat rarely, e.g. once a day curl https://:/solr/dovecot/update?optimize=true # Commit should be run pretty often, e.g. every minute curl https://:/solr/dovecot/update?commit=true ``` You may not need those if you are using a recent Solr (7+) or SolrCloud. The default configuration of Solr is to auto-commit every once in a while (~15sec) so commit is not necessary. Also, the default TieredMergePolicy in Solr will automatically purge removed documents later, so optimize is not necessary. ### Soft Commits If soft commits are enabled, dovecot will perform a soft commit to Solr at the end of transaction. This has the benefit that search results are immediately available. You can also enable automatic commits in SOLR config, with ```xml 60000 ``` or setting it in `solrconfig.xml` with ```xml ${solr.autoSoftCommit.maxTime:60000} ``` ## Re-index Mailbox If you require Dovecot to reindex a whole mailbox, you can run [[doveadm,fts rescan]]. This command will only take action when a search is done and will apply to the whole mailbox. If you want to index a single mailbox/all mailboxes you can run [[doveadm,index]].This command will happen immediately and will block until the indexing is completed. ## Sorting by Relevancy Solr/Lucene supports returning a relevancy score for search results. If you want to sort the search results by the score, use Dovecot's non-standard X-SCORE sort key: ``` 1 SORT (X-SCORE) UTF-8 ``` ## Solr Indexes Dovecot creates the following fields: - id: Unique ID consisting of uid/uidv/user/box. - Note that your user names really shouldn't contain '/' character. - uid: Message's IMAP UID. - uidv: Mailbox's UIDVALIDITY. This changes if mailbox gets recreated. - box: Mailbox name - user: User name who owns the mailbox, or empty for public namespaces - hdr: Indexed message headers - body: Indexed message body - any: "Copy field" from hdr and body, i.e. searching based on this will search from both headers and bodies. Lucene/Solr does duplicate suppression based on the "id" field, so even if Dovecot sends the same message multiple times to Solr it gets indexed only once. This might happen currently if multiple searches are started at the same time. You might want to build a cronjob to go through the Solr/Lucene indexes once in a while to delete indexed messages (or entire mailboxes) that no longer exist on the filesystem. It shouldn't normally find any such messages though. ## Testing ``` # telnet localhost imap * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS STARTTLS AUTH=PLAIN AUTH=LOGIN] I am ready. 1 login username password 2 select Inbox 3 SEARCH text "test" ``` ## Sharding If you have more users than fit into a single Solr box, you can split users off to different servers. A couple of different ways you could do it are: - Have some HTTP proxy redirecting the connections based on the URL - Configure Dovecot's userdb lookup to return a different host for [[setting,fts_solr_url]] setting using [[link,userdb_extra_fields]]. - MySQL: `query = SELECT concat('https://', solr_host, ':8983/solr/dovecot/') AS fts_solr_url, ...` ... concat('https://', solr_host, ':8983/solr/dovecot/') AS fts_solr_url, ... - LDAP: ::: code-group ```doveconf[dovecot.conf] userdb ldap { ... fields { fts_solr_url = https://%{ldap:solrHost}:8983/solr/dovecot/ } } ``` ::: You can also use [SolrCloud](https://lucene.apache.org/solr/guide/7_6/solrcloud.html), the clustered version of Solr, that allows you to scale up, and adds failover / high availability to your FTS system. Dovecot-solr works fine with a SolrCloud cluster as long as the solr schema is the right one. ## External Tutorials External sites with tutorials on using Solr under Dovecot - [FreeBSD](https://mor-pah.net/2016/08/15/dovecot-2-2-with-solr-6-or-5/) - [Substring searches with ngrams](https://dovecot.org/list/dovecot/2011-May/059338.html) ## Tips Some additional things which might help you configuring Solr search: - If you are using Tomcat: Set `maxHttpHeaderSize="65536"` (connector definition for port 8080 in `/etc/tomcat7/server.xml`) to accept long search query strings (iPhones tend to send multi-kilobyte-sized queries) - Set `df` to `hdr` in `/etc/solr/conf/solrconfig.xml` (`/select` request handler) to avoid strange `undefined field text` errors. - Please keep in mind that you will have to change the Solr URL to include the core name (ie: `dovecot`: `https://localhost:8939/solr/dovecot`). - To troubleshoot the settings you can enable debug logs using: ```doveconf[dovecot.conf] log_debug = category=fts-solr ``` and rawlogs using: ```doveconf[dovecot.conf] fts_solr { http_client_rawlog_dir = /path/to/writable/directory/solr-rawlogs } ``` # FTS: Full Text Search Plugin (`fts`) As the amount and importance of information stored in email messages is increasing in people’s everyday lives, searching through those messages is becoming ever more important. At the same time mobile clients add their own restrictions for what can be done on the client side. The ever diversifying mail client software also tests the limits of the IMAP protocol and current server implementations. Furthermore, the IMAP protocol requires some rather complicated and expensive searching capabilities. For example, the protocol requires arbitrary substring matching. Some newer mobile clients (e.g. Apple iOS) rely on this functionality. Without a high-performance index, Dovecot must fall back to a slow sequential search through all messages (default behavior). If storage latencies are high, this searching may not be completed in a reasonable time, or resource utilization may be too large, especially in mailboxes with large messages. ## Searching In Dovecot When a FTS indexing driver is not present, searches use a slow sequential search through all message data. This is both computationally and time expensive. It is desirable to pre-index data so that searches can be executed against this index. There is a subtle but important distinction between searching through message headers and searching through message bodies. Searching through message bodies (via the standard IMAP 'SEARCH TEXT/BODY' commands) makes use of the FTS indexes. On the other hand, searching through message headers benefits from Dovecot's standard index and cache files (`dovecot.index` and `dovecot.index.cache`), which often contain the necessary information. It is possible to redirect header searches to FTS indexes via a configuration option ([[setting,fts_search_add_missing]]). Triggers for FTS indexing are configurable. It can be started on demand when searching, or automatically when new messages arrive or as a batch job. By default the FTS indexes are updated only while searching, so neither LDA/LMTP nor an IMAP 'APPEND' command updates the indexes immediately. This means that if a user has received a lot of mail since the last indexing (i.e., the last search operation), it may take a while to index all the new mails before replying to the search command. Dovecot sends periodic "\* OK Indexed n% of the mailbox" updates which can be caught by client implementations to implement a progress bar. Updating the FTS index as messages arrive makes for a more responsive user experience, especially for users who don’t search often, but have a lot of mail. On the other hand, it increases overall system load regardless of whether or not the indexes will ever be used by the user. ## Dovecot FTS Architecture Dovecot splits the full text search functionality into two parts: a common tokenization library (lib-language) and driver indexing engine responsible for storing the tokens produced by the common library persistently. Some of the FTS drivers do their own internal tokenization, although it's possible to configure them to use the lib-language tokenization as well. See [Tokenization](#tokenization) for more details about configuring the tokenization. All drivers are implemented as plugins that extend the base fts plugin's functionality. ## Settings ## Configuration ### FTS Indexing Triggers Missing mails are always added to FTS indexes when using IMAP SEARCH command that attempts to access the FTS indexes. Automatic FTS indexing can also be done during mail delivery, IMAP APPEND and other ways of adding mails to mailboxes using [[setting,fts_autoindex]]. Indexing can also be triggered manually: ```sh doveadm index -u user@domain -q INBOX ``` ### Enforce FTS When FTS indexing fails, Dovecot falls back on using the built-in search, which does not have indexes for mail bodies. This could end up opening all the mails in the mailbox, which often isn't wanted. To disable this functionality, enable [[setting,fts_search_add_missing]]. ## Indexing Attachments Attachments can be indexed either via a script that translates the attachment to UTF-8 plaintext or [Apache Tika](https://tika.apache.org/) server. * [[setting,fts_decoder_driver]] * [[setting,fts_decoder_script_socket_path]] * [[setting,fts_decoder_tika_url]] ## Rescan Dovecot keeps track of indexed messages in the `dovecot.index files`. If this becomes out of sync with the actual FTS indexes (either too many or too few mails), you'll need to do a rescan and then index missing mails: ```sh doveadm fts rescan -u user@domain doveadm index -u user@domain -q '*' ``` Note that currently most FTS drivers don't implement the rescan. Instead, they simply delete all the FTS indexes. This may change in the future versions. ## Languages Language names are given as ISO 639-1 alpha 2 codes. Stemming support indicates whether the `snowball` filter can be used. Stopwords support indicates whether a stopwords file is distributed with Dovecot. Currently supported languages: | Language Code | Language | Stemming | Stopwords | | ------------- | -------- | -------- | --------- | | da | Danish | Yes | Yes | | de | German | Yes | Yes | | en | English | Yes | Yes | | es | Spanish | Yes | Yes | | fi | Finnish | Yes | Yes | | fr | French | Yes | Yes | | it | Italian | Yes | Yes | | ja | Japanese (Requires Dovecot Pro) | No | No | | nl | Dutch | Yes | Yes | | no | Norwegian (Bokmal & Nynorsk detected) | Yes | Yes | | pt | Portuguese | Yes | Yes | | ro | Romanian | Yes | Yes | | ru | Russian | Yes | Yes | | sv | Swedish | Yes | Yes | | tr | Turkish | Yes| Yes | ## Tokenization Dovecot contains tokenization support that can be used by FTS drivers. The lib-language tokenization library works in the following way: 1. Language detection: When indexing, the text language is attempted to be detected. If the detection fails, the first listed language is used. When searching, the search is done using all the configured languages. 2. Tokenization: The text is split to tokens (individual words). * Whitespace and other nonindexable characters are dropped. * Base64 sequences are looked for and skipped. 3. Filtering: Tokens are normalized: * Normalization / lowercasing * Stemming 4. Stopwords: A configurable list of words not to be indexed ### Language Definition The [[setting,language]] setting declares the languages that need to be detected. At least one language must be listed. The first language is the default language used in case detection fails. Each added language makes the indexing and searching slightly slower, so it's recommended not to add too many languages unnecessarily. The language detection performance can be improved by limiting the number of languages available for textcat, see [[setting,textcat_config_path]]. Example: ```doveconf[dovecot.conf] language en { default = yes } language de { } ``` ### Filter and Tokenizer Order The filters and tokenizers are created in the order they are declared in their respective settings in the configuration file. They form a chain, where the first filter or tokenizer is the parent or grandparent of the rest. The direction of the data flow needs some special attention. In filters, the data flows from parent to child, so tokens are first passed to the grandparent of all filters and then further down the chain. For some filtering chains the order is important. E.g. the snowball stemmer wants all input in lower case, so the filter lower casing the tokens will need to be listed before it. In tokenizers however, the data however flows from child to parent. This means that the tokenizer listed 'last' gets the processed data 'first'. So, for filters data flows "left to right" through the filters listed in the configuration. In tokenizers the order is "right to left". ### Base64 Detection Base64 sequences are looked for in the tokenization buffer and skipped when detected. A base64 sequence is detected by: * An optional leader character comprised in `leader-characters` set, * A run of characters, all comprised in the `base64-characters` set, at least `minimum-run-length` long, * An end-of-buffer, or a trailer character comprised in `trailer-characters` set, where: * `leader-characters` are: `[ \t\r\n=:;?]` * `base64-characters` are: `[0-9A-Za-z/+]` * `trailer-characters` are: `[ \t\r\n=:;?]` * `minimum-run-length` is: `50` * `minimum-run-count` is: `1` Thus, (even single) 50-chars runs of characters in the base64 set are recognized as base64 and ignored in indexing. If a base64 sequence happens to be split across different chunks of data, part of it might not be detected as base64. In this case, the undetected base64 fragment is still indexed. However, this happens rarely enough that it does not significantly impact the quality of the filter. So far the above rule seems to give good results in base64 indexing avoidance. It also performs well in removing base64 fragments inside headers, like ARC-Seal, DKIM-Signature, X-SG-EID, X-SG-ID, including header-encoded parts (e.g. `=?us-ascii?Q?...?=` sequences). ## Filter Configuration Filters affect how data is indexed. They are configured through [[setting,language_filters]]. Example: ```doveconf[dovecot.conf] language_filters = normalizer-icu snowball stopwords language en { language_filters = lowercase snowball english-possessive stopwords } ``` Available filters: ### `lowercase` Change all text to lower case. Supports UTF8, when compiled with libicu and the library is installed. Otherwise only ASCII characters are lowercased. ### `stopwords` Filter certain common and short words, which are usually useless for searching. ::: warning Using stopwords with multiple languages configured WILL cause some searches to fail. The recommended solution is to NOT use the stopword filter when multiple languages are present in the configuration. ::: #### Settings ### `snowball` Stemming tries to convert words to a common base form. A simple example is converting `cars` to `car` (in English). This stemmer is based on the [Snowball stemmer](https://snowballstem.org/) library. ### `normalizer-icu` Normalize text using libicu. This is potentially very resource intensive. ::: warning There is a caveat for the Norwegian language: The default normalizer filter does not modify `U+00F8` (Latin Small Letter O with Stroke). In some configurations it might be desirable to rewrite it to, e.g., `o`. Same goes for the upper case version. This can be done by passing a modified `id` setting to the normalizer filter. Similar cases can exist for other languages as well. ::: #### Settings ### `english-possessive` Remove trailing `'s` from English possessive form tokens. Any trailing single `'` characters are already removed by tokenizing, whether this filter is used or not. The `snowball` filter also removes possessive suffixes from English, so if using `snowball` this filter is not needed. ::: tip `snowball` likely produces better results, so this filter is advisable only when `snowball` is not available or cannot be used due to extreme CPU performance requirements. ::: ### `contractions` Removes certain contractions that can prefix words. The idea is to only index the part of the token that conveys the core meaning. Only works with French, so the language of the input needs to be recognized by textcat as French. It filters `qu'`, `c'`, `d'`, `l'`, `m'`, `n'`, `s'` and `t'`. Do not use at the same time as `generic` tokenizer with both * [[setting,language_tokenizer_generic_algorithm,tr29]] and * [[setting,language_tokenizer_generic_wb5a,yes]]. ## Tokenizer Configuration Tokenizers affect how input data is parsed. Available tokenizers: ### `generic` Input data, such as email text and headers, need to be divided into words suitable for indexing and searching. The generic tokenizer does this. #### Settings ### `email-address` This tokenizer preserves email addresses as complete search tokens, by bypassing the generic tokenizer, when it finds an address. It will only work as intended if it is listed **after** other tokenizers. #### Settings # IMAP ACL Plugin (`imap-acl`) This plugin implements the IMAP ACL ([[rfc,4314]]) extension. ## Settings ## Configuration Configuration and further details can be found on the [[plugin,acl]] page. # IMAP FILTER=SIEVE Plugin (`imap-filter-sieve`) Normally, Sieve filters can either be applied at initial mail delivery or triggered by certain events in the Internet Message Access Protocol (IMAPSIEVE; [[rfc,6785]]). The user can configure which Sieve scripts to run at these instances, but it is not possible to trigger the execution of Sieve scripts manually. However, this could be very useful; e.g, to test new Sieve rules and to re-filter messages that were erroneously handled by an earlier version of the Sieve scripts involved. Pigeonhole provides the `imap_filter_sieve` plugin, which provides a vendor-defined IMAP extension called `FILTER=SIEVE`. This adds a new `FILTER` command that allows applying a mail filter (a Sieve script) on a set of messages that match the specified IMAP searching criteria. This plugin implements the latest draft of the [FILTER=SIEVE Sieve Extension](https://github.com/dovecot/pigeonhole/blob/master/doc/rfc/draft-bosch-imap-filter-sieve-00.txt). This plugin is experimental and the specification is likely to change. Use the specification included in your current release to obtain the matching specification for your release. The plugin is included in the Pigeonhole package and are therefore implicitly compiled and installed with Pigeonhole itself. ## Settings There are no `dovecot.conf` settings for this plugin. ## Configuration The IMAP FILTER Sieve plugin is activated by adding it to the [[setting,mail_plugins]] setting for the imap protocol: ```doveconf[dovecot.conf] protocol imap { mail_plugins { imap_filter_sieve = yes } } ``` Note that enabling this plugin allows users to specify the Sieve script content as a parameter to the `FILTER` command, not just run existing stored scripts. This plugin uses the normal configuration settings used by the [[link,lda]] Sieve plugin at delivery. The [[link,sieve_storage_type_before,before]], [[link,sieve_storage_type_after,after]] and [[link,sieve_storage_type_discard,discard]] Sieve script storage types are currently ignored by this plugin. # IMAP Quota Plugin (`imap-quota`) This plugin implements the IMAP command for requesting current quota information. It requires that the [[plugin,quota]] be activated and configured in Dovecot. It implements the IMAP commands defined in [[rfc,2087]] ## Settings There are no `dovecot.conf` settings for this plugin. # IMAPSieve Plugin (`imap-sieve`) As defined in the base specification ([[rfc,5228]]), the Sieve language is used only during delivery. However, in principle, it can be used at any point in the processing of an email message. [[rfc,6785]] defines the use of Sieve filtering in IMAP, operating when messages are created or their attributes are changed. This feature extends both Sieve and IMAP. Therefore, Pigeonhole provides both an IMAP plugin and a Sieve plugin. The `sieve_imapsieve` plugin implements the `imapsieve` extension for the Sieve filtering language, adding functionality for using Sieve scripts from within IMAP. The `imap_sieve` plugin for IMAP adds the `IMAPSIEVE` capability to the `imap` service. The basic `IMAPSIEVE` capability allows attaching a Sieve script to a mailbox for any mailbox by setting a special IMAP METADATA entry. This way, users can configure Sieve scripts that are run for IMAP events in their mailboxes. Beyond the standard, the Pigeonhole implementation also adds the ability for administrators to configure Sieve scripts outside the user's control, that are run either before or after a user's script if there is one. ::: warning The `imapsieve` extension can only be used in a Sieve script that is invoked from IMAP. When it is used in the active delivery script, it will cause runtime errors. To make a Sieve script suitable for both delivery and IMAP, the availability of the extension can be tested using the `ihave` test ([[rfc,5463]]) as usual. ::: ## Configuration ### imap-sieve The IMAP plugin is activated by adding it to the [[setting,mail_plugins]] setting for the imap protocol: ```doveconf[dovecot.conf] protocol imap { mail_plugins { imap_sieve = yes } } ``` This will only enable support for administrator scripts. User scripts are only supported when a Sieve URL is additionally configured using the [[setting,imapsieve_url]] setting. This URL points to the [[link,managesieve]] server that users need to use to upload their Sieve scripts. This URL will be shown to the client in the IMAP CAPABILITY response as `IMAPSIEVE=`. User scripts are retrieved from the user's [[link,sieve_storage_type_personal,personal]] storage by name ([[rfc,6785]]), which requires no additional configuration. Script storages for administrator scripts are defined in [[setting,sieve_script]] blocks with [[setting,sieve_script_type]] [[link,sieve_storage_type_before,before]] or [[link,sieve_storage_type_after,after]]. These execute administrator scripts before or after the user's personal script, respectively. The [[setting,sieve_script_cause]] setting for the administrator storages used by the `imap_sieve` plugin must include the cause of the IMAP event ([[rfc,6785]]): either `append`, `copy`, or `flag`. The [[setting,sieve_script_cause]] setting can list several causes together, including the default `delivery`, which in that case means that those administrator scripts are also executed at delivery. The applicability of administrator scripts can be limited to a destination mailbox by placing the corresponding [[setting,sieve_script]] blocks inside a [[setting,mailbox]] block for that mailbox. For a source mailbox, limiting the applicability of administrator scripts can similarly be achieved by placing the corresponding [[setting,sieve_script]] blocks inside a [[setting,imapsieve_from]] block with that mailbox name. The [[setting,mailbox]] and [[setting,imapsieve_from]] blocks can be nested when both are required. The `imap_sieve` plugin defines an additional [[link,sieve_storage_type,script storage type]] called `copy-source-after`. Administrator scripts in such storages only apply when the cause is `copy` and are executed for the message in the source mailbox after the Sieve scripts for the corresponding message in the destination mailbox successfully finish executing. This does not apply to moved messages, since the message is removed from the source mailbox in that case. ### sieve-imapsieve The Sieve plugin is activated by adding it to the [[setting,sieve_plugins]] setting: ```doveconf[dovecot.conf] sieve_plugins { sieve_imapsieve = yes } ``` This plugin registers the `imapsieve` extension with the Sieve interpreter. This extension is enabled implicitly, which means that it does not need to be added to the [[setting,sieve_extensions]] setting. ## Example Configuration ```doveconf[dovecot.conf] imapsieve_from Spam { sieve_script ham { type = before cause = copy path = /etc/dovecot/sieve/ham.sieve } } mailbox Spam { sieve_script spam { type = before cause = copy path = /etc/dovecot/sieve/spam.sieve } } ``` ## Settings ### imap-sieve ### sieve-imapsieve There are no `dovecot.conf` settings for this plugin. # Last Login Plugin (`last-login`) This plugin can be used to update user's last-login timestamp in a configured dictionary. Last login information is useful for troubleshooting scenarios, which usually starts with end user contacting customer care agent that the mailbox is unreachable or empty. Amongst the first things is to check when the customer last successfully did login to the mailbox and using which protocol, as this might indicate that there might be some device with POP3 configured thus emptying the mailbox. Last login feature is designed for this use case, to allow easy way to search per any account the timestamp of last login or last mail delivery to the mailbox. Last login information is also useful in determining system usage statistics. ## Settings ## Example Configuration ```doveconf[dovecot.conf] protocol imap { mail_plugins { last_login = yes } } protocol pop3 { mail_plugins { last_login = yes } } redis_host = 127.0.0.1 redis_port = 6379 last_login { dict redis { } #key = last-login/%{user} # default } ``` In this example, last_login plugin is explicitly enabled only for imap & pop3 protocols. If enabled globally, it'll also update the timestamp whenever new mails are delivered via lda/lmtp or when doveadm is run for the user. This can also be thought of as a feature, so if you want to update a different timestamp for user when new mails are delivered, you can do that by enabling the last_login plugin also for lda/lmtp and changing the [[setting,last_login_key]] setting to include `%{service}`. ### MySQL Example This includes the service and remote IP address as well. Using [[setting,last_login_dict_fields]] ensures that both the timestamp and the IP address are updated if a login record for that user/service already exists. ::: code-group ```doveconf[dovecot.conf] last_login { dict proxy { name = sql } key = last-login/%{service}/%{user}/access last_login_dict_fields { ip = %{remote_ip} } precision = ms } dict_server { dict sql { sql_driver = mysql mysql sql.example.com { dbname = mails user = dovecot password = pass } dict_map shared/last-login/$service/$user/access { sql_table = last_login value_field last_access { type = uint } key_field userid { value = $user } key_field service { value = $service } } dict_map shared/last-login/$service/$user/ip { sql_table = last_login value_field last_ip { } key_field userid { value = $user } key_field service { value = $service } } } } ``` ```sql[SQL Schema] CREATE TABLE last_login ( userid VARCHAR(255) NOT NULL, service VARCHAR(10) NOT NULL, last_access BIGINT NOT NULL, last_ip VARCHAR(40) NOT NULL, PRIMARY KEY (userid, service) ); ``` ::: ### Cassandra Example This includes the service and remote IP address as well. ::: code-group ```doveconf[dovecot.conf] last_login { dict proxy { name = cassandra socket_path = dict-async } key = last-login/%{service}/%{user}/access last_login_dict_fields { ip = %{remote_ip} } precision = ms } dict_server { dict cassandra { driver = sql sql_driver = cassandra cassandra { hosts = cassandra.example.com keyspace = mails user = dovecot password = pass } dict_map shared/last-login/$service/$user/access { sql_table = last_login value_field last_access { type = uint } key_field userid { value = $user } key_field service { value = $service } } dict_map shared/last-login/$service/$user/ip { sql_table = last_login value_field last_ip { } key_field userid { value = $user } key_field service { value = $service } } } } ``` ```cql[Cassandra Schema] CREATE TABLE last_login ( userid TEXT, service TEXT, last_access TIMESTAMP, last_ip TEXT, PRIMARY KEY ((userid), service) ); ``` ::: ### Alternative Schema Cassandra Example Instead of using a separate last_login table, add different services as separate fields to the main users table. ::: code-group ```doveconf[dovecot.conf] last_login { dict proxy { name = cassandra socket_path = dict-async } key = last-login/%{service}/%{user}/%{remote_ip} precision = ms } dict_server { dict cassandra { driver = sql sql_driver = cassandra cassandra { hosts = cassandra.example.com keyspace = mails user = dovecot password = pass } dict_map shared/last-login/imap/$user/$remote_ip { sql_table = users value_field last_imap_access { type = uint } key_field userid { value = $user } key_field last_imap_ip { value = $remote_ip } } dict_map shared/last-login/pop3/$user/$remote_ip { sql_table = users value_field last_pop3_access { type = uint } key_field userid { value = $user } key_field last_pop3_ip { value = $remote_ip } } dict_map shared/last-login/lmtp/$user/$remote_ip { sql_table = users value_field last_lmtp_access { type = uint } key_field userid { value = $user } key_field last_lmtp_ip { value = $remote_ip } } } } ``` ```cql[Cassandra Schema] CREATE TABLE users ( userid TEXT, last_imap_access TIMESTAMP, last_pop3_access TIMESTAMP, last_lmtp_access TIMESTAMP, last_imap_ip TEXT, last_pop3_ip TEXT, last_lmtp_ip TEXT, PRIMARY KEY ((userid)) ); ``` ::: # Lazy Expunge Plugin (`lazy-expunge`) The lazy expunge plugin provides a "second-chance" to recover messages that would otherwise be deleted from a mailbox by user action. It does this by moving the message to a defined location when a user deletes the message from a mailbox. This behavior is useful for a variety of reasons: 1. Protect against misconfigured clients (e.g. POP3 client that deletes all messages) 2. Protect against accidental deletion (user error) 3. Archiving Generally, lazy-expunge is configured so that the expunged mails are not counted in the user's quota. Unless being used for archiving, autoexpunge should be used to prune the mailbox to control storage usage. ## Settings ## Configuration ### Storage Location Messages that are expunged are moved to a single mailbox. The mailbox is created automatically. You probably also want to hide it with an [[link,acl]] from the user, if recovery is only expected to be an action performed by an admin/operator. To move to a mailbox, do NOT add a trailing delimiter to the [[setting,lazy_expunge_mailbox]] setting. #### Example Configuration ::: code-group ```doveconf[dovecot.conf] namespace inbox { mailbox .EXPUNGED { autoexpunge = 7days autoexpunge_max_mails = 100000 # Define ACL so that user cannot list the .EXPUNGED mailbox acl owner { rights = rwstipekxa } } } mail_plugins { lazy_expunge = yes acl = yes } acl_driver = vfile # Move messages to an .EXPUNGED mailbox lazy_expunge_mailbox = .EXPUNGED mailbox .EXPUNGED { # Expunged messages most likely don't want to be included in quota: quota_ignore = yes } ``` ::: You could also leave the permissions empty if you don't want to allow clients to access it at all. ### Copy Only the Last Instance If a mail has multiple copies within a user account, each copy is normally moved to the lazy expunge storage when it's expunged. Example: this may happen when moving a message to Trash, as clients can issue IMAP COPY command to copy the message to Trash before expunging the message from the original mailbox. Deleting later from Trash would result in two copies of the same message in the lazy expunge storage. You can enable [[setting,lazy_expunge_only_last_instance]] to copy only the last instance to the expunge storage. This ensures that only a single copy of a message will appear in the expunge storage. ::: warning This feature only works with certain storage setups. See [[setting,lazy_expunge_only_last_instance]] for further information. ::: ### Quota Generally, it is desired that messages in expunge storage are NOT counted towards user quota, as the messages seen by the user will not match-up with the size of the quota otherwise (especially if expunge storage is hidden from users via ACL). Example to exclude expunged storage from the quota: ```doveconf[dovecot.conf] quota "User quota" { quota_storage_size = 1GB } mailbox .EXPUNGED { # Exclude .EXPUNGED mailbox from the quota quota_ignore = yes } ``` See [[plugin,quota]]. ## Cleaning Up ### Doveadm Doveadm can be used to manually clean expunge storage. Example to delete all messages in `.EXPUNGED` mailbox older than one day: ```sh doveadm expunge mailbox '.EXPUNGED' savedsince 1d ``` ### Autoexpunge Set [[setting,mailbox_autoexpunge]] configuration to automatically clean old messages. # Mail Compression Plugin (`mail-compress`) This plugin can be used to read compressed mbox, maildir or dbox files. It can also be used to write (via IMAP, [[link,lda]] and/or [[link,lmtp]]) compressed messages to [[link,dbox]] or [[link,maildir]] mailboxes. ## Compression Methods The following algorithms are supported: | Name | Library (algorithm) | Dovecot Support | | ---- | ------------------- | --------------- | | `bz2` | [libbzip2 (bzip2)](https://sourceware.org/bzip2/) | v2.0+ | | `gz` | [zlib (gzip)](https://www.zlib.net/) | v2.0+ | | `deflate` | [zlib (gzip)](https://www.zlib.net/) | v2.0+ | | `lz4` | [liblz4](https://www.lz4.org/) | v2.2.11+ | | `zstd` | [Zstandard](https://facebook.github.io/zstd/) | v2.3.12+ | ## Settings ## Example Configuration ```doveconf[dovecot.conf] # Enable compression plugin globally for reading/writing: mail_plugins { mail_compress = yes } # Enable compressing the mails while saving (not just reading): mail_compress_write_method = zstd ``` ## Interaction with Mailbox Formats ### mbox Compressed mbox files can be accessed only as read-only. The compression is detected based on the file name, so your compressed mboxes should end with .gz or .bz2 extension. There is no support for compression during saving. ### dbox Mails can be stored as compressed. Existing uncompressed mails can't currently be directly compressed (or vice versa). You could, however, use [[man,doveadm-sync]] to copy all mails to another location (which saves them compressed) and then replace the original location with the new compressed location. You can do this by treating the operation the same as if you were migrating from one mailbox format to another (see the dsync page examples). ### Maildir When this plugin is loaded Dovecot can read both compressed and uncompressed files from Maildir. The files within a Maildir can use any supported compression algorithm (e.g., some can be compressed using gzip, while others are compressed using zstd). The algorithm is detected by reading the first few bytes from the file and figuring out if it's a valid compressed header. The file name doesn't matter. To avoid IMAP clients attempting to exploit security holes in the compression algorithm libraries (e.g., bzlib) by writing specially crafted mails using IMAP's APPEND command, Dovecot will not allow clients to save mails that are detected as compressed. All mails must have `,S=` in their filename where \ contains the original uncompressed mail size, otherwise there will be problems with quota calculation as well as other potential random failures. Note that if the filename doesn't contain the `,S=` before compression, adding it afterwards changes the base filename and thus the message UID. The safest thing to do is simply to not compress such files. You should also preserve the file's mtime so INTERNALDATE doesn't change. If you want to use dsync to convert to a compressed Maildir you may need `-o` `maildir_copy_with_hardlinks=no` (this is set to yes by default and will prevent compression). ## Compress Existing Mails To compress existing mails, the supported way is to use local dsync migration. See [[link,migrating_mailboxes]]. You'll probably want to use some cronjob to compress old mails. However note that to avoid seeing duplicate mails in rare race conditions you'll have to use the [maildirlock utility](https://github.com/dovecot/tools/blob/main/README.maildirlock). The idea is to: 1. Find the mails you want to compress in a single maildir. * Skip files that don't have `,S=` in the filename. 2. Compress the mails to `tmp/` * Update the compressed files' mtimes to be the same as they were in the original files (e.g. touch command) 3. Run `maildirlock `. It writes PID to stdout, save it. * `` is path to the directory containing Maildir's dovecot-uidlist (the control directory, if it's separate) * `` specifies how long to wait for the lock before failing. 4. If maildirlock grabbed the lock successfully (exit code 0) you can continue. 5. For each mail you compressed: 1. Verify that it still exists where you last saw it. 2. If it doesn't exist, delete the compressed file. Its flags may have been changed or it may have been expunged. This happens rarely, so just let the next run handle it. 3. If the file does exist, `rename() (mv)` the compressed file over the original file. Dovecot can now read the file, but to avoid compressing it again on the next run, you'll probably want to rename it again to include e.g. a `Z` flag in the file name to mark that it was compressed (e.g. `1223212411.M907959P17184.host,S=3271:2,SZ`). Remember that the [Maildir specifications](https://cr.yp.to/proto/maildir.html) require that the flags are sorted by their ASCII value, although Dovecot itself doesn't care about that. Unlock the maildir by sending a TERM signal to the maildirlock process (killing the PID it wrote to stdout). ## Benchmarking ::: info A simple benchmarking exercise to compare compression ratios/speed between the various supported compression algorithms. ::: ### Setup * Compression of a real-world corpus of mails of various lengths, compositions, and types * 128,788 messages * Messages imported via [[man,doveadm-import]] into a single [[link,sdbox]] mailbox * Mailbox storage in tmpfs partition, so drive performance should be irrelevant * Time is total clock time (real + sys) to compress the entire mailbox * Size is the total size of the sdbox mail data directory ONLY * Dovecot indexes are not included in size ### Results | Algorithm | Size (GB) | Compression | Time (MM:SS) | | --------- | --------- | ----------- | ------------ | | None | 7.99 | 0% | 0:21 | | `bz2` | 3.41 | 57% | 7:08 | | `gz` | 3.44 | 57% | 2:30 | | `deflate` | 3.44 | 57% | 2:34 | | `lz4` | 4.76 | 40% | 0:23 | | `zstd` | 3.41 | 57% | 0:34 | # Mail Crypt Plugin (`mail-crypt`) The mail crypt plugin is used to secure email messages stored in a Dovecot system. Messages are encrypted before written to storage and decrypted after reading. Both operations are transparent to the user. In case of unauthorized access to the storage backend, the messages will, without access to the decryption keys, be unreadable to the offending party. There can be a single encryption key for the whole system or each user can have a key of their own. The used cryptographical methods are widely used standards and keys are stored in portable formats, when possible. ## Functional Overview The use of mail crypt plugin depends on a user having a keypair, a private and a public key, for asymmetric cryptography. These keys are provisioned in a variable via the user database or directly from Dovecot configuration files. The public half of the provisioned keypairs are used to generate and encrypt keys for symmetric encryption. The symmetric keys are used to encrypt and decrypt individual files. Symmetric encryption is faster and more suitable for block mode storage encryption. The symmetric key used to encrypt a file is stored, after being encrypted with the public asymmetric key, together with the file. ## Encryption Technologies The mail crypt plugin provides encryption at rest for emails. Encryption of the messages is performed using the symmetric Advanced Encryption Standard (AES) algorithm in Galois/Counter Mode (GCM) with 256 bit keys. Integrity of the data is ensured using Authenticated Encryption with Associated Data (AEAD) with SHA256 hashing. The encryption keys for the symmetric encryption are randomly generated. These keys in turn are encrypted using a key derived with from the provisioned private key. Provisioned keys can be Elliptic Curve (EC) keys or RSA keys. [[changed,mail_crypt_ml_kem_keys]] ML-KEM keys are also supported with OpenSSL 3.3+. Encryption is done using the Integrated Encryption Scheme (IES). This algorithm is usable both with EC and RSA keys. ## Limitations By default, AES-GCM is used. This algorithm is limited to 64 GiB input, after potential compression. If you expect to run to this limitation, you should use AES-CBC or ChaCha20-Poly1305 algorithm. Also, particularly the AES-XTS or AES-CCM cannot be used due to the way they work. ## Technical Requirements Using per-folder keys is not considered production quality, but global keys are fine. ::: warning Improper configuration or use can make your emails unrecoverable! Treat encryption with care and backup encryption keys! ::: This page assumes you are using configuring mail encryption from scratch with a recent version of Dovecot. ### Supported symmetric algorithms While mail crypt plugin does not support setting encryption algorithm, it is possible to specify one with FS crypt. Dovecot supports all algorithms in OpenSSL that have an OID assigned, and additionally few more (with official OIDs). In particular, XTS, CCM and CTR modes are not supported, due to the way they would need to be handled. Some operating systems limit the available algorithms with policies. It is recommended to use AES-GCM or ChaCha20-Poly1305 algorithm, with SHA256 or greater. Algorithm setting format is <algorithm name>‐<mode>‐<hash algorithm;>. E.g. `aes-256-gcm-sha256` or `chacha20-poly1305-sha256`. Note that hash algorithm is used for various hashing purposes, not just data integrity, so it is always required. Files encrypted with one algorithm can be decrypted even if the configuration specifies different algorithm, as the parameters are stored in the file. List of known algorithms that Dovecot supports as of writing. | Encryption algorithm | Supported size | Supported modes | | -------------------- | -------------- | --------------- | | [chacha20](https://en.wikipedia.org/wiki/ChaCha20) | - | [poly1305](https://en.wikipedia.org/wiki/ChaCha20-Poly1305)1,3 | | [aes](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) | 128, 192, 256 | [gcm](https://en.wikipedia.org/wiki/Galois/Counter_Mode)1, [cbc](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC)2 | | [camellia](https://en.wikipedia.org/wiki/Camellia_(cipher)) | 128, 192, 256 | [cbc](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC)2 | | [aria](https://en.wikipedia.org/wiki/ARIA_(cipher)) | 128, 192, 256 | [cbc](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC)2 | | [seed](https://en.wikipedia.org/wiki/SEED) | - | [cbc](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC)2 | | [sm4](https://en.wikipedia.org/wiki/SM4_(cipher)) | - | [cbc](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC)2 | | [des-ede3](https://en.wikipedia.org/wiki/Triple_DES) | - | [cbc](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CBC)2 | 1 Uses [AEAD](https://en.wikipedia.org/wiki/AEAD) integrity. 2 Uses [HMAC](https://en.wikipedia.org/wiki/HMAC) integrity. 3 Requires recent enough OpenSSL. ## Modes Of Operation Mail crypt plugin can operate using **either** global keys or folder keys. Using both is not supported. ### Global keys In this mode, all keying material is taken from the settings: * [[setting,crypt_global_public_key_file]] * [[setting,crypt_global_private_key]] - List of [[setting,crypt_private_key_file]] keys You can use either Elliptic Curve (EC) keys (recommended) or RSA keys. [[changed,mail_crypt_ml_kem_keys]] ML-KEM keys are also supported with OpenSSL 3.3+. See below for examples using them. No key generation is automatically performed. A good solution for environments where no user folder sharing is needed is to generate per-user EC key pair and encrypt that with something derived from user's password. The benefit is that it can be easier to do key management when you can do the EC re-encryption steps in case of password change in your user database instead of dovecot's database. You should not configure [[setting,crypt_user_key_curve]] when using global keys. #### Elliptic Curve (EC) Key In order to generate an EC key, you must first choose a curve from the output of this command: ```sh openssl ecparam -list_curves ``` If you choose the curve `prime256v1`, generate an EC key with the command: ```sh openssl ecparam -name prime256v1 -genkey | openssl pkey -out ecprivkey.pem ``` Then generate a public key out of your private EC key ```sh openssl pkey -in ecprivkey.pem -pubout -out ecpubkey.pem ``` These keys can now be used with this configuration: ```doveconf[dovecot.conf] mail_plugins { mail_crypt = yes } crypt_global_public_key_file = ecpubkey.pem crypt_global_private_key main { crypt_private_key_file = ecprivkey.pem crypt_private_key_password = secret } ``` ##### Converting EC key to PKEY If you have an EC private key which begins with something like: ``` -----BEGIN EC PRIVATE KEY----- ``` With possibly parameters like this before that: ``` -----BEGIN EC PARAMETERS----- BgUrgQQACg== -----END EC PARAMETERS----- ``` You must convert it to pkey format with: ```sh openssl pkey -in oldkey.pem -out newkey.pem ``` Then `newkey.pem` can be used with mail-crypt plugin. #### Using Edwards curve DSA (EdDSA) [[added,mail_crypt_eddsa]] You can use EdSDA keys by using algorithm `X25519` or `X448` (case sensitive). To generate a suitable keypair, use ```sh openssl genpkey -algorithm X448 -out edprivkey.pem openssl pkey -in private.pem -pubout -out edpubkey.pem ``` Note that ED25519 keys are not suitable for X25519. #### RSA key ::: warning Use of RSA keys is discouraged, please use [[link,mail_crypt_ec_key,EC keys]] instead. ::: You can generate an unencrypted RSA private key in the pkey format with the command: ```sh openssl genpkey -algorithm RSA -out rsaprivkey.pem ``` Alternatively, you can generate a password encrypted private key with: ```sh openssl genpkey -algorithm RSA -out rsaprivkey.pem -aes-128-cbc -pass pass:secret ``` This does make the password show up in the process listing, so it can be visible for everyone on the system. Regardless of whether you generated an unencrypted or password encrypted private key, you can generate a public key out of it with: ```sh openssl pkey -in rsaprivkey.pem -pubout -out rsapubkey.pem ``` These keys can then be used with this configuration: ```doveconf[dovecot.conf] mail_plugins { mail_crypt = yes } crypt_global_public_key_file = rsapubkey.pem crypt_global_private_key main { crypt_private_key_file = rsaprivkey.pem crypt_private_key_password = secret } ``` ### Folder Keys In this mode, a key pair is generated for the user. Then for each folder a key pair is generated. This folder is encrypted using the user key. A user can have more than one key pair for reading, but only one can be active for writing. * [[setting,crypt_user_key_curve]] must be set. * [[setting,mail_attribute]] must be set, as it is used to store the keys. #### Unencrypted User Keys In this version of the folder keys mode, each user's private key is stored unencrypted on the server. Example config for folder keys with Maildir: ```doveconf[dovecot.conf] mail_plugins { mail_crypt = yes } mail_attribute { dict file { path = %{home}/Maildir/dovecot-attributes } } crypt_user_key_curve = secp521r1 ``` #### Encrypted User Keys In this version of the folder keys mode, the user's private key is stored encrypted on the server. Example config for mandatory encrypted folder keys with Maildir: ```doveconf[dovecot.conf] mail_plugins { mail_crypt = yes } mail_attribute { dict file { path = %{home}/Maildir/dovecot-attributes } } crypt_user_key_curve = secp521r1 crypt_user_key_require_encrypted = yes ``` The password that is used to decrypt the user's private key must be provided via the [[setting,crypt_user_key_password]] setting. See below. #### Choosing Encryption Password It is recommended to use a hash of the user's plaintext login password as the encryption key password instead of the plaintext password directly. This way the plaintext password is less likely to become visible accidentally, such as in debug logs. Also using a strong hash makes the key more resistant against brute force attacks. Another issue that you must consider when using the login password is that when the password changes, **you must re-encrypt the user private key**. Instead of using the login password, another possibility could be to store the encryption password in a separate database (e.g. SQL or LDAP). Example config where the user's login password is used as the encryption key password: ```doveconf[dovecot.conf] passdb sql { query = SELECT email as user, password, '%{password | hash("pbkdf2")}' AS userdb_crypt_user_key_password \ FROM virtual_users \ WHERE email='%{user}' } ``` ## Base64-encoded Keys Mail-crypt plugin can read keys that are base64 encoded. This is intended mostly for providing PEM keys via userdb, because it may be difficult to get userdb to return multi-line values. Hence, this is possible: ::: code-group ```sh[Key Generation] openssl ecparam -name secp256k1 -genkey | openssl pkey | base64 -w0 > ecprivkey.pem base64 -d ecprivkey.pem | openssl ec -pubout | base64 -w0 > ecpubkey.pem ``` ```doveconf[dovecot.conf] mail_plugins { mail_crypt = yes } crypt_global_private_key main { # create the filter, but leave its settings empty } passdb static { password = pass fields { crypt_global_public_key_file = ecpubkey.pem crypt_global_private_key/main/private_key_file = inline: } } ``` ::: ## Read-only Mode If you have encrypted mailboxes that you need to read, but no longer want to encrypt new mail, use empty [[setting,crypt_write_algorithm]] setting: ```doveconf[dovecot.conf] crypt_write_algorithm = crypt_global_private_key main { crypt_private_key_file = server.key } ``` ## mail-crypt-plugin and ACLs If you are using global keys, mails can be shared within the key scope. The global key can be provided with several different scopes: * Global scope: key is configured in `dovecot.conf` file * Per-user(group) scope: key is configured in userdb file With folder keys, key sharing can be done to single user, or to multiple users. When a key is shared to a single user, and the user has a public key available, the folder key is encrypted using recipient's public key. This requires the `mail_crypt_acl` plugin, which will enable accessing the encrypted shared folders. If you have [[setting,crypt_acl_require_secure_key_sharing]] enabled, you can't share the key to groups or someone with no public key. ## Decrypting Files Encrypted with mail-crypt Plugin You can use [`decrypt.py`][https://github.com/dovecot/tools/blob/main/dcrypt-decrypt.py] to decrypt encrypted files. ## Settings ## `fs-crypt` `fs-crypt` is a [[link,fs,lib-fs wrapper]] that can encrypt and decrypt files. It works similarly to the [[link,fs_compress,fs-compress wrapper]]. It can be used to encrypt e.g.: * External mail attachments ([[setting,mail_ext_attachment]]) Note that `fs-crypt` and the [[plugin,fs-compress]] wrapper can be also combined. Please make sure that compression is always applied before encryption. See [[plugin,fs-compress]] for an example and more details about compression. ### `fs-crypt` settings See [[link,mail_crypt_settings]] for generic mail-crypt settings. `fs-crypt` supports the same key types as `mail-crypt`. [[changed,mail_crypt_ml_kem_keys]] ML-KEM keys are also supported with OpenSSL 3.3+. ::: warning [[changed,fs_crypt_require_encryption_keys]] fs-crypt requires encryption keys by default. ::: ## Doveadm Commands ::: tip For doveadm commands that are working with password protected keys, the global `-o` option should be used to provide the password. Example: ```sh doveadm -o crypt_private_key_password=some_password <...doveadm command...> ``` ::: To encrypt/decrypt files manually, you can use: ```sh doveadm \ -o fs=crypt,posix \ -o fs/crypt/fs_driver=crypt \ -o fs/posix/fs_driver=posix \ -o crypt_private_key_file=pubkey.pem \ -o crypt_global_private_key=main \ -o crypt_global_private_key/main/crypt_private_key_file=privkey.pem \ fs get/put '' path/to/input-file [/path/to/output-file] ``` # Mail Logger Plugin (`mail-log`) This plugin can be used to log several actions done in a mail session: * Setting and removing \Deleted flag * Expunging (includes autoexpunge) * Copying mails * Saves * Mailbox creations * Mailbox deletions * Mailbox renames * Any flag changes Messages' IMAP UID and Message-ID header is logged for each action. Example: ``` imap(user): copy -> Trash: uid=908, msgid=<123.foo@bar> imap(user): delete: uid=908, msgid=<123.foo@bar> imap(user): expunged: uid=908, msgid=<123.foo@bar> ``` The [[plugin,notify]] is required the mail_log plugin's operation, so be certain it's also enabled. ## Settings ## Example Configuration ```doveconf[dovecot.conf] # Enable the plugin globally for all services mail_plugins { notify = yes mail_log = yes } mail_log_events = delete undelete expunge mailbox_delete mailbox_rename mail_log_fields = uid box msgid size from mail_log_cached_only = yes ``` # Mail Lua Plugin (`mail-lua`) mail-lua is a plugin that can be loaded to provide API for mail storage Lua plugins. See [[link,lua]]. ## Settings ## Variable expansion functions This component registers two providers. Note that these providers have very limited functionality at this moment. ### `%{lua_file(,,...)}` Executes the script at given path, and if it's successful, use the string result. If values are provided after function name, they are passed to the Lua function as parameters. Pipeline value is always added last, if present. Example: ```[dovecot.conf] mail_plugins { mail_lua = yes } mail_home = %{user|lua_file("/etc/dovecot/get_home.lua","get_home")} ``` ```[get_home.lua] -- This is not a good way to do this, provided here for example -- purposes only. Do not use this. local function get_home(user) return "/home/" .. user end ``` ### `%{lua_call(,...)}` Executes Lua function in the [[setting,lua_file]], and if successful, use the string result. If values are provided after function name, they are passed to the Lua function as parameters. Pipeline value is always added last, if present. Example: ```[dovecot.conf] mail_plugins { mail_lua = yes } mail_lua { lua_file = /etc/dovecot/mail.lua } mail_home = %{user|lua_call("get_home")} ``` ```[mail.lua] -- This is not a good way to do this, provided here for example -- purposes only. Do not use this. local function get_home(user) return "/home/" .. user end ``` # Notify Status Plugin (`notify-status`) This plugin updates a [[link,dict]] with mailbox status information every time a mailbox changes. ## Settings ::: warning This plugin requires that the [[plugin,notify]] is loaded. ::: ## Configuration ### Dictionary Configuration See [[link,dict]] for how to configure dictionaries. This plugin updates the `priv/status/` key. ### Example ```doveconf[dovecot.conf] mail_plugins { notify = yes notify_status = yes } notify_status { dict proxy { name = notify_status socket_path = dict-async } } # By default no mailbox is added to dict. To enable all notify_status for # all mailboxes add: #mailbox_notify_status = yes # If you keep the default mailbox_notify_status = no you can enable it per # mailbox like this: mailbox inbox { notify_status = yes } mailbox TestBox { notify_status = yes } ``` ### SQL dict Example ::: code-group ```[Dictionary Map] dict_map priv/status/$box { sql_table = mailbox_status username_field = username key_field mailbox { value = $box } value_field status { } } ``` ```sql[SQL Schema] CREATE TABLE mailbox_status ( username VARCHAR(255) NOT NULL, mailbox VARCHAR(255) NOT NULL, status VARCHAR(255), PRIMARY KEY (username, mailbox) ); ``` ::: # Notify Plugin (`notify`) The notify plugin can be used to easily develop other plugins that need to do some work when something in user’s mailboxes change. See [[plugin,mail-log]] plugin as an example how to develop a plugin based on the notify plugin. ## Settings There are no `dovecot.conf` settings for this plugin. # POP3 Migration Plugin (`pop3-migration`) The pop3-migration plugin is used to preserve POP3 UIDLs. When dsync is handling IMAP INBOX and requests a POP3 UIDL, the plugin connects to the POP3 server and figures out which IMAP messages match the POP3 messages and returns the appropriate POP3 UIDL. The plugin works by matching POP3 messages to IMAP messages. This isn’t always trivial with some servers, which can keep the POP3 and IMAP messages in different order or include more than just IMAP INBOX messages in the POP3 messages. ::: danger Always do a test migration to verify that POP3 UIDLs are preserved correctly. If the UIDL format is wrong, all the mails have to be re-migrated. ::: ::: tip See Also: * [[link,migration]]. ::: ## Configuration This plugin requires a pop3c namespace configured for accessing the source POP3 server. For example: ```doveconf[dovecot.conf] namespace pop3c { prefix = POP3-MIGRATION-NS/ separator = / mail_driver = pop3c mail_path = inbox = no list = no hidden = yes } ``` ## Settings # Push Notification Plugin: Lua (`push-notification-lua`) You can use Lua to write custom push notification handlers. ::: info Lua push notification requires the base push-notification plugin to be configured. See [[plugin,push-notification]] for configuration information. ::: See [[link,lua]] for general information on how Lua is implemented in Dovecot. ## Configuration Lua push notification handler requires [[plugin,push-notification]], [[plugin,mail-lua]], and [[plugin,push-notification-lua]] to be loaded. | Name | Required | Type | Description | | ---- | -------- | ---- | ----------- | | `push_notification_driver` | **YES** | [[link,settings_types_string]] | To identify this settings block the driver should get the value `lua`. | | `push_notification_lua_file` | NO | [[link,settings_types_file]] | The lua file to execute. See [[setting,lua_file]]. | | `push_notification_lua_settings` | NO | [[link,settings_types_strlist]] | Extra parameters to pass to the Lua `script_init()` function. See [[setting,lua_settings]]. | ## Example Configuration ```doveconf[dovecot.conf] mail_plugins { mail_lua = yes notify = yes push_notification = yes push_notification_lua = yes } push_notification lua { lua_file = /path/to/lua/script lua_settings { extra_param = %{userdb:extra_param} } } ``` ## API Overview The Lua driver hooks into all events, and calls matching functions when found in Lua script. The driver supports all available [[link,push_notification_events]]. All events are called within a transaction. The event is called with context and an event table, which contains the event parameters. All events contain at least: | Name | Description | | ---- | ----------- | | `name` | Name of the event name | | `user` | Current mail user | Events are always called after the fact. There has to be at least one event handler, or the transaction begin and end functions are never called. This is an optimization to avoid a roundtrip to Lua when it's not needed. ### Transactions `dovecot_lua_notify_begin_txn(user)` : Start transaction. Return value is used as transaction context and is treated as opaque value by Lua driver. The user parameter is `mail_user` object. `dovecot_lua_notify_end_txn(context, success)` : End transaction, context is unreferenced. ### Mailbox Events All mailbox events contain the following parameters: | Name | Description | | ---- | ----------- | | `mailbox` | Name of the affected mailbox | Functions: `dovecot_lua_notify_event_mailbox_create(context, {name, mailbox})` : Called when mailbox has been created. `dovecot_lua_notify_event_mailbox_delete(context, {name, mailbox})` : Called when mailbox has been deleted. `dovecot_lua_notify_event_mailbox_rename(context, {name, mailbox, mailbox_old})` : Called when mailbox has been renamed, old name is retained in `mailbox_old` attribute. `dovecot_lua_notify_event_mailbox_subscribe(context, {name, mailbox})` : Called when mailbox has been subscribed to. The mailbox does not necessarily exist. `dovecot_lua_notify_event_mailbox_unsubscribe(context, {name, mailbox})` : Called when mailbox has been unsubscribed from. The mailbox does not necessarily exist. ### Message Events All message events contain following parameters: | Name | Description | | ---- | ----------- | | `mailbox` | Mailbox name | | `uid` | Message UID | | `uid_validity` | Mailbox UIDVALIDITY | Functions: `dovecot_lua_notify_event_message_new(context, {name, mailbox, uid, uid_validity, date, tz, from, from_address, from_display_name, to, to_address, to_display_name, subject, snippet})` : Called when message is delivered. `dovecot_lua_notify_event_message_append(context, {name, mailbox, uid, uid_validity, from, from_address, from_display_name, to, to_address, to_display_name, subject, snippet})` : Called when message is APPENDed to a mailbox (via IMAP). `dovecot_lua_notify_event_message_read(context, {name, mailbox, uid, uid_validity})` : Called when message is marked as `Seen`. `dovecot_lua_notify_event_message_trash(context, {name, mailbox, uid, uid_validity})` : Called when message is marked `Deleted`. `dovecot_lua_notify_event_message_expunge(context, {name, mailbox, uid, uid_validity})` : Called when message is expunged. `dovecot_lua_notify_event_flags_set(context, {name, mailbox, uid, uid_validity, flags, keywords_set})` : Called when message flags or keywords are set. `flags` is a bitmask. `keywords_set` is a table of strings of the keywords set by the event. `dovecot_lua_notify_event_flags_clear(context, {name, mailbox, uid, uid_validity, flags, keywords_clear, keywords_old})` : Called when message flags or keywords are removed. `flags` is a bitmask. `keywords_clear` contains the keywords cleared, `keywords_old` is the table of keywords that were set before the event. ## Example Scripts ::: details Simple example with `dovecot.http.client` ```lua:line-numbers local url = require 'socket.url' local client = nil function script_init() client = dovecot.http.client({debug=True, timeout=10000}) end local function table_get(t, k, d) return t[k] or d end function dovecot_lua_notify_begin_txn(user) return {messages={}, ep=user:plugin_getenv("push_lua_url"), username=user.username} end function dovecot_lua_notify_end_txn(ctx, success) local i, msg = next(ctx["messages"], nil) while i do local rq = client:request({url=ctx["ep"], method="POST"}) rq:set_payload("from=" .. url.escape(table_get(msg, "from", "")) .. "&to=" .. url.escape(table_get(msg, "to", "")) .. "&subject=" .. url.escape(table_get(msg, "subject", "")) .. "&snippet=" .. url.escape(table_get(msg, "snippet", "")) .. "&user=" .. url.escape(ctx["username"])) r = rq:submit() if r and r:status()/100 ~= 2 then dovecot.i_error("lua-push: Remote error " .. tostring(r:reason()) .. " handling push notification") end i, msg = next(ctx["messages"], i) end end function dovecot_lua_notify_event_message_append(ctx, event) table.insert(ctx["messages"], event) end function dovecot_lua_notify_event_message_new(ctx, event) table.insert(ctx["messages"], event) end ``` ::: ::: details Example with event code ```lua:line-numbers -- To use: -- -- push_notification lua { -- lua_file = /home/example/empty.lua -- lua_settings { -- push_lua_url = http://push.notification.server/handler -- } -- } -- -- server is sent a POST message to given url with parameters -- local client = nil local url = require "socket.url" function table_get(t, k, d) return t[k] or d end function script_init() client = dovecot.http.client({debug=True, timeout=10000}) end function dovecot_lua_notify_begin_txn(user) return {user=user, event=dovecot.event(), ep=user:plugin_getenv("push_lua_url"), states={}, messages={}} end function dovecot_lua_notify_event_message_new(ctx, event) -- get mailbox status local mbox = ctx.user:mailbox(event.mailbox) mbox:sync() local status = mbox:status(dovecot.storage.STATUS_RECENT, dovecot.storage.STATUS_UNSEEN, dovecot.storage.STATUS_MESSAGES) mbox:free() ctx.states[event.mailbox] = status table.insert(ctx.messages, {from=event.from,subject=event.subject,mailbox=event.mailbox}) end function dovecot_lua_notify_event_message_append(ctx, event, user) dovecot_lua_notify_event_message_new(ctx, event, user) end function dovecot_lua_notify_end_txn(ctx) -- report all states for i,msg in ipairs(ctx.messages) do local e = dovecot.event(ctx.event) e:set_name("lua_notify_mail_finished") reqbody = "mailbox=" .. url.escape(msg.mailbox) .. "&from=" .. url.escape(table_get(msg, "from", "")) .. "&subject=" .. url.escape(table_get(msg, "subject", "")) e:log_debug(ctx.ep .. " - sending " .. reqbody) local rq = client:request({url=ctx["ep"], method="POST"}) rq:set_payload(reqbody) rq:add_header("content-type", "application/x-www-form-url.escaped") local code = rq:submit():status() e:add_int("result_code", code) e:log_info("Mail notify status " .. tostring(code)) end for box,state in pairs(ctx.states) do local e = dovecot.event() e:set_name("lua_notify_mailbox_finished") reqbody = "mailbox=" .. url.escape(state.mailbox) .. "&recent=" .. tostring(state.recent) .. "&unseen=" .. tostring(state.unseen) .. "&messages=" .. tostring(state.messages) e:log_debug(ctx.ep .. " - sending " .. reqbody) local rq = client:request({url=ctx["ep"], method="POST"}) rq:set_payload(reqbody) rq:add_header("content-type", "application/x-www-form-url.escaped") local code = rq:submit():status() e:add_int("result_code", code) e:log_info("Mailbox notify status " .. tostring(code)) end end ``` ::: # Push Notification Plugin (`push-notification`) Dovecot's Push Notification plugin implements a framework that exposes [[rfc,5423]] (Internet Message Store Events) events that occur in Dovecot to a system that can be used to report these events to external services. ## Push Notification Events These events (see [[rfc,5423,4.1]] for descriptions) are available within the notification framework, although a driver may not implement all of them: * FlagsClear * FlagsSet * MailboxCreate * MailboxDelete * MailboxRename * MailboxSubscribe * MailboxUnsubscribe * MessageAppend * MessageExpunge * MessageNew * MessageRead * MessageTrash These events are not supported by the notification framework: * Login (handled by [[link,authentication]]) * Logout (handled by [[link,authentication]]) * QuotaExceed (handled by [[plugin,quota]]) * QuotaWithin (handled by [[plugin,quota]]) ## Usage To use push notifications, both the `notify` and the `push_notification` plugins need to be activated by defining them in [[setting,mail_plugins]]. This can either be set globally or restricted to the protocols where you want push notifications to be generated. For example, to restrict to mail delivery notifications only, this config should be used: ```doveconf[dovecot.conf] protocol lmtp { mail_plugins { notify = yes push_notification = yes } } # If notifications are also needed for LDA-based delivery, add: protocol lda { mail_plugins { notify = yes push_notification = yes } } ``` ## Settings ## Drivers A push notification driver is defined by the [[setting,push_notification]] setting. The configuration value is a named filter for a specified driver, see the driver for their names and their supported options. It is possible to specify multiple push notification drivers by giving unique names to the individual driver configurations. Multiple configuration for a driver of the same type is useful if, for example, you want to process a single notification with the same driver but different endpoints. Example: ```doveconf[dovecot.conf] push_notification ox1 { driver = ox ox_url = http://example.com/foo } push_notification ox2 { driver = ox ox_url = http://example.com/bar } ``` The list of drivers shipped with Dovecot core appears below. ### DLOG (Debug log) [`dlog`] The most simple push notification plugin is the `dlog` plugin. It will write notifications into the debug log of the process. This driver has no options. To enable it you will have to define it explicitly, otherwise it is disabled. | Name | Required | Type | Description | | ---- | -------- | ---- | ----------- | | `push_notification_driver` | **YES** | [[link,settings_types_string]] | To identify this settings block the driver should get the value `dlog`. | #### Example Configuration ```doveconf[dovecot.conf] push_notification dlog { driver = dlog } ``` ### OX (Open-Xchange) driver [`ox`] The OX driver supports sending notifications on MessageNew events (i.e. mail deliveries, not IMAP APPENDs). This driver was designed for use with [OX App Suite Push Notification API][ox-appsuite-push-notification-api] but can be used by any push endpoint that implements this API, not just OX App Suite. #### Configuration Options | Name | Required | Type | Description | | ---- | -------- | ---- | ----------- | | `push_notification_driver` | **YES** | [[link,settings_types_string]] | To identify this settings block the driver should get the value `ox`. | | `push_notification_ox_url` | **YES** | [[link,settings_types_string]] | The HTTP end-point (URL + authentication information) to use is configured in the Dovecot configuration file. Contains authentication information needed for Basic Authentication (if any). Example: `http + "://" + + ":" + + "@" + + ":" + + "/preliminary/http-notify/v1/notify"`
For HTTPS endpoints, system CAs are trusted by default, but internal CAs might need further configuration.
For further details on configuring the App Suite endpoint, see: [OX App Suite Push Notification API#Configuration of Dovecot "http-notify" plugin-in][ox-appsuite-push-notification-api-dovecot-configuration] | | `push_notification_ox_cache_ttl` | NO | [[link,settings_types_time]] | Cache lifetime for the METADATA entry for a user. (DEFAULT: `60 seconds`) | | `push_notification_ox_user_from_metadata` | NO | [[link,settings_types_boolean]] | Use the user stored in the METADATA entry instead of the user sent by OX endpoint. (DEFAULT: user returned by endpoint response is used, i.e. `no`) | #### Example Configuration ```doveconf[dovecot.conf] push_notification ox { ox_url = http://login:pass@node1.domain.tld:8009/preliminary/http-notify/v1/notify user_from_metadata = yes cache_ttl = 10secs } ``` #### Metadata The push notifications are enabled separately for each user using METADATA. Normally [OX App Suite][ox-app-suite] does this internally, but for e.g. testing purposes you can do this yourself: ```sh doveadm mailbox metadata set -u user@example.com \ -s "" /private/vendor/vendor.dovecot/http-notify user=11@3 ``` #### Example Payload Push notification sent in JSON format with the following fields: | Name | Type | Description | | ---- | ---- | ----------- | | `event` | string | [[rfc,5423]] event type (currently only "MessageNew") | | `folder` | string | Mailbox name | | `from` | string | [[rfc,2822]] address of the message sender (MIME-encoded), if applicable | | `imap-uid` | number | UID of the message, if applicable | | `imap-uidvalidity` | number | [[rfc,3501]] UIDVALIDITY value of the mailbox | | `snippet` | string | Snippet of the message body (UTF-8), if applicable | | `subject` | string | Subject of the message (MIME-encoded), if applicable | | `unseen` | number | [[rfc,3501]] UNSEEN value of the mailbox | | `user` | string | User identifier | ::: info The returned numbers are generally integer values in the range `0`..`4294967295`. ::: Example (`Content-Type: application/json; charset=utf-8`): ```json { "user": "4@464646669", "imap-uidvalidity": 123412341, "imap-uid": 2345, "folder": "INBOX", "event": "MessageNew", "from": "=?utf-8?q?=C3=84?= ", "subject": "Test =?utf-8?q?p=C3=A4iv=C3=A4=C3=A4?=", "snippet": "Hey guys\nThis is only a test...", "unseen": 2 } ``` ### Lua [`lua`] You can use Lua to write custom push notification handlers. See [[plugin,push-notification-lua]] for configuration information. [ox-appsuite]: https://www.open-xchange.com/products/ox-app-suite/ [ox-appsuite-push-notification-api]: https://documentation.open-xchange.com/7.10.5/middleware/mail/dovecot/dovecot_push.html [ox-appsuite-push-notification-api-dovecot-configuration]: https://documentation.open-xchange.com/latest/middleware/mail/dovecot/dovecot_push.html#configuration-of-dovecot-http-notify-plug-in # Quota Clone Plugin (`quota-clone`) Quota clone plugin is useful when you want to store everybody's current quota usage to a database, but you don't want to use the database as the authoritative quota database. For example you might want to access everybody's quota via Redis (or SQL) but you don't store the Redis database permanently so it could become empty once in a while. Additionally, it is expensive to directly scan quota information from each individual user account, so quota-clone allows access to quota information that is less resource intensive. In these example use-cases, you can use [[link,quota_driver_count]] as the authoritative quota database and make a copy of the quota usage to Redis. From Redis you could then once in a while gather everybody's current quota usage and send it to yet another place (e.g. for statistics handling). Every time quota is updated, the value is updated to the cloned dict. There are race conditions with it so the quota may not always be 100% correct. The old value is always replaced with the new one though (not just incremented/decremented) so the cloned quota is never too much wrong. ## Settings ## Updated Keys The keys that are written: | Key | Value | | --- | ----- | | `priv/quota/messages` | Count of messages | | `priv/quota/storage` | Storage usage (in bytes) | ## Example Configuration ```doveconf[dovecot.conf] mail_plugins { quota = yes quota_clone = yes } redis_host = 127.0.0.1 redis_port = 6379 quota_clone { dict redis { } } ``` More complex example using SQL: ```doveconf[dovecot.conf] dict_server { dict mysql { driver = sql sql_driver = mysql dict_map priv/quota/messages { sql_table = quota username_field = username value_field messages { } } dict_map priv/quota/storage { sql_table = quota username_field = username value_field bytes { } } } } quota_clone { dict proxy { name = mysql } } ``` # Quota Plugin (`quota`) Quota tracking and enforcing plugin. Three plugins are associated with quota: | Name | Description | | ---- | ----------- | | [[plugin,imap-quota]] | Enables IMAP commands for requesting and administering current quota. | | quota (this plugin) | Implements the actual quota handling and includes all quota drivers. | | [[plugin,quota-clone]] | Copy the current quota usage to a dict. | ## Configuration ### Enabling Quota Plugins Enable in configuration files, e.g.: ```doveconf[dovecot.conf] # Enable quota plugin for tracking and enforcing the quota. mail_plugins { quota = yes } protocol imap { # Enable the IMAP QUOTA extension, allowing IMAP clients to ask for the # current quota usage. mail_plugins { imap_quota = yes } } # Keep this setting outside the quota { .. } to allow easily overriding it # in userdb lookups. quota_storage_size = 1G quota "User quota" { } ``` ### Quota Root Quota root is a concept from IMAP Quota specifications ([[rfc,2087]]). Normally you'll have only one quota root, but in theory there could be, e.g., "user quota" and "domain quota" roots. It's unspecified how the quota roots interact with each other (if at all). In some systems, for example, INBOX could have a completely different quota root from the rest of the mailboxes (e.g. INBOX in `/var/mail/` partition and others in `/home/` partition). ### Quota Limits There are two types of quota limits: * Message count limits * Storage size limits The message count limit is calculated as: [[setting,quota_message_count]] \* [[setting,quota_message_percentage]]. Zero is assumed to be unlimited. The storage size limit is calculated as: [[setting,quota_storage_size]] \* [[setting,quota_storage_percentage]] + [[setting,quota_storage_extra]]. Zero is assumed to be unlimited. The percentage and extra values are mainly useful to allow exceeding the regular quota limit in some mailboxes, such as allowing clients that move messages with IMAP COPY+EXPUNGE to Trash folder to temporarily exceed the quota. #### Example ```doveconf[dovecot.conf] quota_storage_size = 1G namespace inbox { mailbox Trash { quota_storage_extra = 100M } mailbox SPAM { quota_ignore = yes } } ``` This means that the user has 1GB quota, but when saving messages to Trash mailbox it's possible to use up to 1.1GB of quota. The quota isn't specifically assigned to Trash, so if you had 1GB of mails in Trash you could still save 100MB of mails to Trash, but nothing to other mailboxes. Additionally, any messages in the SPAM folder are ignored and would not count against the quota at all. ### Per-User Quota You can override the quota settings in your [[link,userdb_extra_fields]]. Keep global settings in configuration plugin section and override only those settings you need to in your userdb. Use [[doveadm,user]] command to verify that the userdb returns the expected quota settings. #### Override: LDAP Example [[link,auth_ldap]] where the quota limit is in `quotaBytes` field: ::: code-group ```doveconf[dovecot.conf] userdb ldap { ... fields { home = %{ldap:homeDirectory} quota_storage_size = {ldap:quotaBytes}B } } ``` ::: #### Override: SQL Example (for MySQL): ```doveconf[dovecot.conf] userdb sql { query = SELECT uid, gid, home, CONCAT(quota_limit_bytes, 'B') AS quota_storage_size \ FROM users \ WHERE userid = '%{user}' passdb sql { # SQL with userdb prefetch: Remember to prefix quota_quota_storage_size with userdb_ # (just like all other userdb extra fields): query = SELECT userid AS user, password, uid AS userdb_uid, gid AS userdb_gid, \ CONCAT(quota_limit_bytes, 'B') AS userdb_quota_storage_size \ FROM users \ WHERE userid = '%{user}' } ``` Example (for PostgreSQL and SQLite): ```doveconf[dovecot.conf] sql_driver = sqlite # alternatively: pgsql userdb sql { query = SELECT uid, gid, home, quota_limit_bytes || 'B' AS quota_storage_size \ FROM users \ WHERE userid = '%{user}' } ``` #### Override: passwd-file Example [[link,auth_passwd_file]] entries: ``` user:{plain}pass:1000:1000::/home/user::userdb_quota_storage_size=100M user2:{plain}pass2:1001:1001::/home/user2::userdb_quota_storage_size=200M user3:{plain}pass3:1002:1002::/home/user3::userdb_mail_path=~/Maildir userdb_quota_storage_size=300M ``` #### Override: passwd The [[link,auth_passwd]] userdb doesn't support extra fields. That's why you can't directly set users' quota limits to passwd file. You can use an additional userdb (e.g. [[link,auth_passwd_file]] where only the quota limits are specified. ### Quota for Public Namespaces You can create a separate namespace-specific quota that's shared between all users. This is done by configuring the quota root inside the namespace filter. For example: ```doveconf[dovecot.conf] namespace public { type = public prefix = Public/ #mail_path = .. quota "Shared quota" { #quota_storage_size = ... } } quota "User quota" { #quota_storage_size = ... } ``` Note that globally configured quota roots are used only for private namespaces. ### Quota for Private Namespaces You can create a separate namespace-specific quota for a folder hierarchy. This is done by configuring the quota root inside the namespace filter. For example: ```doveconf[dovecot.conf] namespace inbox { quota "User quota" { #quota_storage_size = ... } } namespace archive { type = private prefix = Archive/ #mail_path = .. quota "Archive quota" { #quota_storage_size = ... } } ``` Note that both quotas must be configured inside the namespace filter. Using a global quota configuration would apply to both namespaces. ### Quota and Shared Namespaces Quota plugin considers shared namespaces against owner's quota, not the current user's. The regular private quota configuration is used - there is no need to explicitly configure quota for shared namespaces. The quota limits are also taken from the userdb. Public namespaces are ignored unless there is explicit quota specified for it. ### Custom Quota Exceeded Message See [[setting,quota_exceeded_message]]. Example: ```doveconf[dovecot.conf] quota_exceeded_message = Quota exceeded, please go to http://www.example.com/over_quota_help for instructions on how to fix this. ``` ## Quota Drivers Quota driver specifies the method how Dovecot keeps track of the current quota usage. They don't specify users' quota limits - that's done by [returning extra fields from userdb](#per-user-quota). We recommend using [`count`](#driver-count) for any new installations. If you need usage data to an external database, consider using [[plugin,quota-clone]] for exporting the information. (It's very slow to query every user's quota from the index files directly.) ### Driver: Count The `count` quota driver tracks the quota internally within Dovecot's index files. ::: info This is the **RECOMMENDED** way of calculating quota on recent Dovecot installations. ::: Each mailbox's quota is tracked separately and when the current quota usage is wanted to be known, the mailboxes' quotas are summed up together. To get the best performance, make sure [[setting,mailbox_list_index,yes]]. ::: warning If you're switching from some other quota driver to `count`, make sure that all the mails have their virtual sizes already indexed. Otherwise there may be a significant performance hit when Dovecot starts opening all the mails to get their sizes. You can help to avoid this by accessing the mailbox vsizes for all the users before doing the configuration change: [[doveadm,mailbox status,-u user@domain vsize '\*']]. ::: #### Configuration `count` driver doesn't have any additional parameters. ```doveconf[dovecot.conf] mailbox_list_index = yes # Avoid spending excessive time waiting for the quota calculation to finish # when mails' vsizes aren't already cached. If this many mails are opened, # finish the quota calculation on background in indexer-worker process. Mail # deliveries will be assumed to succeed, and explicit quota lookups will # return internal error. protocol !indexer-worker { mail_vsize_bg_after_count = 100 } # 10MB quota limit quota_storage_size = 10M quota "User quota" { } ``` ### Driver: fs The `fs` (filesystem) quota driver supports both local filesystems and rquota (NFS). #### Configuration #### Systemd If you are using systemd, please make sure you **turn off** `PrivateDevices=yes`, otherwise the driver won't work properly. The best way to do this is to use `systemctl edit dovecot` command or add file `/etc/systemd/system/dovecot.service.d/override.conf` with: ``` [Service] PrivateDevices=off ``` #### Index Files It's a good idea to keep index files in a partition where there are no filesystem quota limits. The index files exist to speed up mailbox operations, so Dovecot runs more slowly if it can't keep them updated. You can specify the index file location with the [[setting,mail_index_path]] setting. Dovecot can handle "out of disk space" errors in index file handling and transparently move to in-memory indexes. It'll use the in-memory indexes until the mailbox is re-opened. #### mbox It's a good idea to have [[setting,mbox_lazy_writes,yes]] (default), otherwise Dovecot might give "Not enough disk space" errors when opening the mailbox, making it impossible to expunge any mails. If user has run out of quota and index files are also in memory (because they're also over quota), it's possible that message flag changes are lost. This should be pretty rare though because Dovecot keeps some extra space allocated inside the mbox file for flag changes. Example: ```doveconf[dovecot.conf] mail_driver = mbox mail_path = ~/mail mail_inbox_path = /var/mail/%{user} mail_index_path = /var/no-quotas/index/%{user} ``` #### Maildir Maildir needs to be able to add UIDs of new messages to `dovecot-uidlist` file. If it can't do this, it can give an error when opening the mailbox, making it impossible to expunge any mails. Currently the only way to avoid this is to use a separate partition for the uidlist files where there are no filesystem quota limits. You can do this with the [[setting,mail_control_path]] setting. Example: ```doveconf[dovecot.conf] mail_driver = maildir mail_path = ~/Maildir mail_index_path = /var/no-quotas/index/%{user} mail_control_path = /var/no-quotas/control/%{user} ``` Note that if you change the location of the control files, Dovecot will look in the new control path directory (`/var/no-quotas/control/%{user}`) for the mailbox `subscriptions` file. #### Configuration Examples ```doveconf[dovecot.conf] mail_plugins { quota = yes } protocol imap { mail_plugins { imap_quota = yes } } quota user { driver = fs } ``` If you want to see both user and group quotas as separate quota roots, you can use: ```doveconf[dovecot.conf] quota "User quota" { driver = fs fs_type = user } quota "Group quota" { driver = fs fs_type = group } ``` If you have your mails in two filesystems, you can create two quota roots: ```doveconf[dovecot.conf] quota INBOX { driver = fs # Assuming INBOX in /var/mail/ which is mounted to / fs_mount_path = / } quota Others { driver = fs # Assuming other mailboxes are in /home mount fs_mount_path = /home } ``` ### Driver: imapc See [[link,imapc_quota]]. #### Configuration ### Driver: maildir ::: warning Note that **Maildir++ quota works only with Maildir format**. However, even with Maildir format the recommendation is to use [`count`](#driver-count). ::: The `maildir` quota driver implements Maildir++ quota in Dovecot. Dovecot implements the [Maildir++ specification](https://www.courier-mta.org/imap/README.maildirquota.html) so Dovecot remains compatible with [Courier](https://www.courier-mta.org/), [maildrop](https://www.courier-mta.org/maildrop/), [Exim](https://www.exim.org/), etc. #### Maildirsize File The `maildirsize` file in the Maildir root directory contains both the quota limit information and the current quota status. It contains a header in format: ``` S,C ``` [[removed,quota_maildir_driver_removed]] Maildir++ quota limit must now be specified in Dovecot configuration. It will no longer be read from the `maildirsize` file. The limits are still written to the file header, but they are ignored by Dovecot. Maildir++ quota relies on `maildirsize` file having correct information, so if your users can modify the file in some way (e.g. shell access), you're relying on the goodwill of your users for the quota to work. You can't rely on Dovecot noticing external changes to Maildir and updating `maildirsize` accordingly. This happens eventually when quota is being recalculated, but it may take a while. Quota recalculation also won't trigger quota warning executions. Once the `maildirsize` reaches 5120 bytes, the quota is recalculated and the file is recreated. This makes sure that if quota happens to be broken (e.g. externally deleted files) it won't stay that way forever. ## Quota Service The quota service allows Postfix to check quota before delivery. This service does not support proxying, so it works only in non-clustered setups when there is a single Dovecot server. ```doveconf[dovecot.conf] service quota-status { executable = quota-status -p postfix inet_listener quota-status { # You can choose any port you want port = 12340 } client_limit = 1 } ``` And then have postfix `check_policy_service` check that: ``` smtpd_recipient_restrictions = ... check_policy_service inet:mailstore.example.com:12340 ``` For more about this service, see https://sys4.de/en/blog/postfix-dovecot-mailbox-quota/ ## Quota Warning Scripts You can configure Dovecot to run an external command when user's quota exceeds a specified limit. Note that the warning is ONLY executed at the exact time when the limit is being crossed, so when you're testing you have to do it by crossing the limit by saving a new mail. If something else besides Dovecot updates quota so that the limit is crossed, the warning is never executed. The quota warning limits are configured the same way as the actual [[link,quota_limits]], but just placed inside the [[setting,quota_warning]] filter. Only the command for the first exceeded limit is executed, so configure the highest limit first. The actual commands that are run need to be created as services (create a named Dovecot service and use the service name as the \`quota-warning socket name\` argument). ### Configuration ### Example Configuration ```doveconf[dovecot.conf] quota user { warning warn-95 { quota_storage_percentage = 95 execute quota-warning { args = 95 %{user} } } warning warn-80 { quota_storage_percentage = 80 execute quota-warning { args = 80 %{user} } } warning warn-under { quota_storage_percentage = 100 # user is no longer over quota threshold = under execute quota-warning { args = below %{user} } } } service quota-warning { executable = script /usr/local/bin/quota-warning.sh # use some unprivileged user for executing the quota warnings user = vmail unix_listener quota-warning { } } ``` With the above example, when user's quota exceeds 80% `quota-warning.sh` is executed with parameter `80`. The same goes for when quota exceeds 95%. If user suddenly receives a huge mail and the quota jumps from 70% to 99%, only the 95 script is executed. You have to create the `quota-warning.sh` script yourself. Here is an example that sends a mail to the user: ::: details Example `quota-warning.sh` ```sh #!/bin/sh PERCENT=$1 USER=$2 cat << EOF | /usr/local/libexec/dovecot/dovecot-lda -d $USER -o quota_enforce=no From: postmaster@domain.com Subject: quota warning Your mailbox is now $PERCENT% full. EOF ``` ::: The quota enforcing is disabled to avoid looping. ### Overquota-flag [[link,quota_warning_scripts,Quota warning scripts]] can be used to set an overquota-flag to userdb (e.g. LDAP) when user goes over/under quota. This flag can be used by MTA to reject mails to an user who is over quota already at SMTP RCPT TO stage. A problem with this approach is there are race conditions that in some rare situations cause the overquota-flag to be set even when user is already under quota. This situation doesn't solve itself without manual admin intervention or the overquota-flag feature: This feature checks the flag's value every time user logs in (or when mail gets delivered or any other email access to user) and compares it to the current actual quota usage. If the flag is wrong, a script is executed that fixes up the situation. The [[setting,execute]] setting inside [[setting,quota_over_status]] named filter specifies the script that is executed. The current [[setting,quota_over_status_current]] value is appended as the last parameter. The overquota-flag name in userdb must be [[setting,quota_over_status_current]]. These settings are available: * [[setting,quota_over_status_lazy_check]] * [[setting,quota_over_status_mask]] Example: ```doveconf[dovecot.conf] quota_over_status { # If quota_over_status_current=TRUE, the overquota-flag is enabled. # Otherwise not. mask = TRUE # Any non-empty value for quota_over_status_current means user is over quota. # Wildcards can be used in a generic way, e.g. "*yes" or "*TRUE*" #mask = * lazy_check = yes execute quota-warning { args = mismatch %{user} } } ``` ## Quota Grace See [[setting,quota_storage_grace]]. By default the last mail can bring user over quota. This is useful to allow user to actually unambiguously become over quota instead of fail some of the last larger mails and pass through some smaller mails. Of course the last mail shouldn't be allowed to bring the user hugely over quota, so by default this limit is 10 MB. To change the quota grace, use: ```doveconf[dovecot.conf] # allow user to become max 50 MB over quota quota_storage_grace = 50 M } ``` ## Maximum Mailbox Count See [[setting,quota_mailbox_count]]. Maximum number of mailboxes that can be created. Each namespace is tracked separately, so e.g. shared mailboxes aren't counted towards the user's own limit. The default is `0`, which is unlimited. ## Maximum Messages Per Mailbox See [[setting,quota_mailbox_message_count]]. Maximum number of messages that can be created in a single mailbox. ## Maximum Saved Mail Size See [[setting,quota_mail_size]]. Dovecot allows specifying the maximum message size that is allowed to be saved (e.g. by LMTP, IMAP APPEND or doveadm save). The default is `unlimited`. Since outgoing mail sizes are also typically limited on the MTA side, it can be beneficial to prevent user from saving too large mails, which would later on fail on the MTA side anyway. ## Quota Virtual Sizes Indicates that the quota plugin should use virtual sizes rather than physical sizes when calculating message sizes. Required for the `count` driver. This is automatically determined by the quota plugin. ## Quota Admin Commands The [[plugin,imap-quota]] implements the `SETQUOTA` command, which allows changing the logged in user's quota limit if the user is admin. See [[plugin,imap-quota]] for further configuration information. ## Quota Recalculation If your quotas are out of sync, you can use [[doveadm,quota recalc,-u <uid>]] command to recalculate them. ## Quota and Trash Mailbox Standard way to expunge messages with IMAP works by: 1. Marking message with `\Deleted` flag 2. Actually expunging the message using EXPUNGE command Both of these commands can be successfully used while user's quota is full. However many clients use a `move-to-Trash` feature, which works by: 1. COPY the message to Trash mailbox 2. Mark the message with \Deleted 3. Expunge the message from the original mailbox 4. (Maybe later expunge the message from Trash when `clean trash` feature is used) If user is over quota (or just under it), the first COPY command will fail and user may get an unintuitive message about not being able to delete messages because user is over quota. The possible solutions for this are: * Disable move-to-trash feature from client * You can create a separate quota rule ignoring Trash mailbox's quota. Note that this would allow users to store messages infinitely to the mailbox. * You can create a separate quota rule giving Trash mailbox somewhat higher quota limit (but not unlimited). To make sure users don't start keeping messages permanently in Trash you can use [[setting,mailbox_autoexpunge]] to expunge old messages from Trash mailbox. ## Debugging Quota User's current quota usage can be looked up with [[doveadm,quota get,-u user@domain]]. User's current quota may sometimes be wrong for various reasons (typically only after some other problems). The quota can be recalculated with [[doveadm,quota recalc,-u user@domain]]. ## Quota Status Service Dovecot supports quota-status service, which uses Postfix-compatible policy server protocol. This allows Postfix to check the quota before mail delivery. Example: ::: code-group ```doveconf[dovecot.conf] service quota-status { executable = quota-status -p postfix unix_listener /var/spool/postfix/private/quota-status { user = postfix } # Or with TCP: inet_listener postfix { # You can choose any port you want port = 12340 } client_limit = 1 } ``` ```[/etc/postfix/main.cf] smtpd_recipient_restrictions = ... check_policy_service unix:private/quota-status # Or with TCP: #check_policy_service inet:mailstore.example.com:12340 ``` ::: ### Configuration ## Settings # Pigeonhole Sieve Extprograms Plugin (`sieve-extprograms`) The "sieve_extprograms" plugin provides an extension to the Sieve filtering language, adding new action commands for invoking a predefined set of external programs. Messages can be piped to or filtered through those programs and string data can be input to and retrieved from those programs. To mitigate the security concerns, the external programs cannot be chosen arbitrarily; the available programs are restricted through administrator configuration. ## Configuration The plugin is activated by adding it to the [[setting,sieve_plugins]] setting: ```doveconf[dovecot.conf] sieve_plugins { sieve_extprograms = yes } ``` This plugin registers the `vnd.dovecot.pipe`, `vnd.dovecot.filter`, and `vnd.dovecot.execute` extensions with the Sieve interpreter. However, these extensions are not enabled by default and thus need to be enabled explicitly. It is recommended to restrict the use of these extensions to global context by adding these to the [[setting,sieve_global_extensions]] setting. If personal user scripts also need to directly access external programs, the extensions need to be added to the [[setting,sieve_extensions]] setting. The commands introduced by the Sieve language extensions in this plugin can directly pipe a message or string data to an external program (typically a shell script) by forking a new process. Alternatively, these can connect to a unix socket behind which a Dovecot script service is listening to start the external program, e.g. to execute as a different user or for added security. The program name specified for the new Sieve `pipe`, `filter`, and `execute` commands is used to find the program or socket in a configured directory. Separate directories are specified for the sockets and the directly executed binaries. The socket directory is searched first. Since the use of "/" in program names is prohibited, it is not possible to build a hierarchical structure. Programs are executed with a limited set of environment variables: `HOME`, `USER`, `SENDER`, `RECIPIENT`, and `ORIG_RECIPIENT`. The [[setting,import_environment]] setting does not apply here. If a shell script is expected to read a message or string data, it must fully read the provided input until the data ends with EOF, otherwise the Sieve action invoking the program will fail. The action will also fail when the shell script returns a nonzero exit code. Standard output is available for returning a message (for the filter command) or string data (for the execute command) to the Sieve interpreter. Standard error is written to the LDA log file. The three extensions introduced by this plugin - `vnd.dovecot.pipe`, `vnd.dovecot.filter` and `vnd.dovecot.execute` - each have separate but similar configuration. ## Settings ## Specification Read the [specification](https://github.com/dovecot/pigeonhole/blob/master/doc/rfc/spec-bosch-sieve-extprograms.txt) for detailed information on how to use the new language extensions. ## Configuration Examples ### Socket Service for "pipe" and "execute" ```doveconf[dovecot.conf] sieve_script personal { path = ~/.dovecot.sieve } sieve_plugins { sieve_extprograms = yes } sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.execute = yes } # pipe sockets in /var/run/dovecot/sieve-pipe sieve_pipe_socket_dir = sieve-pipe # execute sockets in /var/run/dovecot/sieve-execute sieve_execute_socket_dir = sieve-execute service sieve-pipe-script { # This script is executed for each service connection executable = script /usr/lib/dovecot/sieve-extprograms/sieve-pipe-action.sh # use some unprivileged user for execution user = dovenull # socket name is program-name in Sieve (without sieve-pipe/ prefix) unix_listener sieve-pipe/sieve-pipe-script { } } service sieve-execute-action { # This script is executed for each service connection executable = script /usr/lib/dovecot/sieve-extprograms/sieve-execute-action.sh # use some unprivileged user for execution user = dovenull # socket name is program-name in Sieve (without sieve-execute/ prefix) unix_listener sieve-execute/sieve-execute-action { } } ``` ### Direct Execution for "pipe" and "filter" ```doveconf[dovecot.conf] sieve_script personal { path = ~/.dovecot.sieve } sieve_plugins { sieve_extprograms = yes } sieve_global_extensions { vnd.dovecot.pipe = yes vnd.dovecot.filter = yes } # This directory contains the scripts that are available for the pipe command. sieve_pipe_bin_dir = /usr/lib/dovecot/sieve-pipe # This directory contains the scripts that are available for the filter # command. sieve_filter_bin_dir = /usr/lib/dovecot/sieve-filter ``` ### Test Incoming Message This simple example shows how to use the "vnd.dovecot.execute" extension to perform some sort of test on the incoming message. ::: code-group ```doveconf[dovecot.conf] sieve_extensions { vnd.dovecot.execute = yes } sieve_plugins { sieve_extprograms = yes } sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute ``` ```[Sieve Script] require "vnd.dovecot.execute"; if not execute :pipe "hasfrop.sh" { discard; stop; } ``` ```sh[hasfrop.sh] # Something that reads the whole message and inspects it for some # property. Not that the whole message needs to be read from input! N=`cat | grep -i "FROP"` # Check it for the undesirable text "FROP" if [ ! -z "$N" ]; then # Result: deny exit 1; fi # Result: accept exit 0 ``` ::: At the location `/usr/lib/dovecot/sieve-execute`, create the executable script `hasfrop.sh`. In this example, the `hasfrop.sh` checks whether the message contains the literal text "FROP" anywhere in the message. The Sieve script shown above discards the message if this script ends with an exit code other than 0, which happens when "FROP" was found. ### Query/Update MySQL This example shows how to use the `vnd.dovecot.execute` extension for querying/updating a MySQL database. This is used to redirect messages only once every 300s for a particular sender. Note that this particular use case could also be implemented using the Sieve [[link,sieve_duplicate]]. ::: code-group ```doveconf[dovecot.conf] sieve_extensions { vnd.dovecot.execute = yes } sieve_plugins { sieve_extprograms = yes } sieve_execute_bin_dir = /usr/lib/dovecot/sieve-execute ``` ```[Sieve Script] require ["variables", "copy", "envelope", "vnd.dovecot.execute"]; # put the envelope-from address in a variable if envelope :matches "from" "*" { set "from" "${1}"; } # execute the vacationcheck.sh program and redirect the message based on # its exit code if execute :output "vacation_message" "vacationcheck.sh" ["${from}","300"] { redirect :copy "foo@bar.net"; } ``` ```sh[vacationcheck.sh] USER=postfixadmin PASS=pass DATABASE=postfixadmin # DB STRUCTURE #CREATE TABLE `sieve_count` ( # `from_address` varchar(254) NOT NULL, # `date` datetime NOT NULL #) ENGINE=InnoDB DEFAULT CHARSET=latin1; # #ALTER TABLE `sieve_count` # ADD KEY `from_address` (`from_address`); MAILS=$(mysql -u$USER -p$PASS $DATABASE --batch --silent -e "SELECT count(*) as ile FROM sieve_count WHERE from_address='$1' AND DATE_SUB(now(),INTERVAL $2 SECOND) < date;") ADDRESULT=$(mysql -u$USER -p$PASS $DATABASE --batch --silent -e "INSERT INTO sieve_count (from_address, date) VALUES ('$1', NOW());") # uncomment below to debug # echo User $1 sent $MAILS in last $2 s >> /usr/lib/dovecot/sieve-pipe/output.txt # echo Add result : $ADDRESULT >> /usr/lib/dovecot/sieve-pipe/output.txt # echo $MAILS if [ "$MAILS" = "0" ] then exit 0 fi exit 1 ``` ::: At the location `/usr/lib/dovecot/sieve-execute`, create the executable script `vacationcheck.sh`. In this example, the `vacationcheck.sh` script needs two parameters: the sender address and a time interval specified in seconds. The time interval is used to specify the minimum amount of time that needs to have passed since the sender was last seen. If the script returns exit code 0, then message is redirected in the Sieve script shown above. # Sieve IMAPSieve Plugin (`sieve-imapsieve`) IMAPSieve ([[rfc,6785]]) defines the use of Sieve filtering in IMAP, operating when messages are created or their attributes are changed. The `sieve_imapsieve` plugin implements the `imapsieve` extension for the Sieve filtering language, adding functionality for using Sieve scripts from within IMAP. ::: tip Full details about this plugin can be found at [[plugin,imap-sieve]]. ::: # Sieve Plugin (`sieve`) ## Configuration To use Sieve, you will first need to make sure you are using Dovecot [[link,lda]] or [[link,lmtp]] for delivering incoming mail to users' mailboxes. Then, you need to enable the Sieve plugin in your configuration: ```doveconf[dovecot.conf] protocol lda { mail_plugins { sieve = yes } } protocol lmtp { mail_plugins { sieve = yes } } ``` ## Script storage Sieve scripts are retrieved from a script storage. This can currently be the local filesystem, an LDAP database or any dict storage. Depending on the storage implementation, its type and its configuration, storages can contain one script, several scripts identified by name, and a series of scripts in a well-defined order to be executed in sequence. Script storages are configured in a named [[setting,sieve_script]] block: ```doveconf[dovecot.conf] sieve_script personal { path = ~/.dovecot.sieve } ``` The storage name (`personal` in the example) is used internally within configurations, as an identifier for logging, and as an identifier for command line tools. It also allows updating a storage that was defined earlier - by repeating the [[setting,sieve_script]] block and adding additional configuration settings - or it allows userdb to override storage settings for specific users. ### Script storage types Sieve scripts can be evaluated at various stages in message delivery and for stored messages. The type of the Sieve script storage determines where it is applicable, how the storage is accessed and how the retrieved Sieve script is evaluated. The type of the Sieve script storage is configured using the [[setting,sieve_script_type]] setting. The following types are currently recognized (others are defined by the [[plugin,sieve-imapsieve]]): #### `personal` {#script-storage-type-personal} The `personal` storage serves as the user's main personal storage. Although more than a single `personal` storage can be defined, only the first one listed in the configuration is used. The LDA Sieve plugin uses the personal storage to find the active script for Sieve filtering at delivery. If the storage supports storing more than a single script (e.g. the [[link,sieve_storage_file,file storage]] does), personal scripts can also be retrieved by name. The Sieve include extension will then use this storage for retrieving `:personal` scripts and the ManageSieve service will be able to store the user's scripts there. If the storage supports storing more than a single script, only one of those scripts will be the active script used at delivery. The active script can be managed by the user through the ManageSieve service. If the personal storage has no active script, the [[link,sieve_storage_type_default,default script]] will be executed if configured. If no personal storage is defined explicitly, auto-detection will be attempted. This is currently only trying the [[link,sieve_storage_file,file storage driver]], which looks for a `~/.dovecot.sieve` script file or a directory at `~/sieve/` containing script files. In the latter case `~/.dovecot.sieve` is expected to be a symbolic link pointing to the active script file. If auto-detection also finds no personal storage, Sieve processing will be skipped and no default script is executed. #### `after` {#script-storage-type-after} An `after` storage is the source of one script or several scripts that are to be executed after the user's personal script. If the storage supports storing more than a single script, these scripts will be executed in a well-defined order defined by the storage driver. Multiple `after` storages can be configured and each storage will be accessed in sequence to retrieve scripts for execution after the personal script. The storages will be accessed in the order these storages are defined in the configuration, unless the order is overridden by the [[setting,sieve_script_precedence]] setting. This is usually a global script, so be sure to pre-compile the specified script manually in that case using the sievec command line tool, as explained by [[man,sievec]]. #### `before` {#script-storage-type-before} A `before` storage behaves identical to an `after` storage, except the contained script or scripts are run **before** user's personal script (instead of **after**). #### `default` {#script-storage-type-default} The `default` storage yields the sieve script that gets executed **only** if the user's personal Sieve script does not exist. Although more than a single `default` storage can be defined, only the first one listed in the configuration is used. If [[setting,sieve_script_name]] is set for this script storage, the default script can be seen and accessed by this name through ManageSieve (and doveadm sieve). See [[link,sieve_visible_default_script]]. This is usually a global script, so be sure to pre-compile the specified script manually in that case using the sievec command line tool, as explained by [[man,sievec]]. #### `discard` {#script-storage-type-discard} The `discard` storage yields the sieve script that gets executed for any message that is about to be discarded; i.e., it is not delivered anywhere by the normal Sieve execution. Although more than a single `discard` storage can be defined, only the first one listed in the configuration is used. The `discard` storage is currently only applicable for message delivery. The script from the `discard` storage is only executed when the "implicit keep" is canceled, by e.g. the "discard" action, and no actions that deliver the message are executed. Delivery in this case means both local delivery to a mailbox and redirection to a remote recipient. This "discard script" can prevent discarding the message, by executing alternative actions. If the discard script does nothing, the message is still discarded as it would be when no discard script is configured. #### `global` {#script-storage-type-global} A `global` storage is the source of `:global` include scripts for the Sieve include extension. Scripts are accessed by name, so if the storage yields only one script, a name must be defined for it; either implicitly by the storage driver or explicitly using [[setting,sieve_script_name]]. Multiple `global` storages can be configured and each storage will be queried in sequence to retrieve the requested script by name. The storages will be queried in the order these storages are defined in the configuration until the script is found. The order can be overridden by the [[setting,sieve_script_precedence]] setting. ### Script storage drivers Sieve script storages are implemented as a storage driver. The default [file](#sieve_storage_file) storage driver uses the local filesystem. It can use a single script file or a directory containing several Sieve script files with a symbolic link pointing to the active script. More complex setups can use other storage drivers such as [ldap](#sieve_storage_ldap) or [dict](#sieve_storage_dict) to fetch Sieve scripts from LDAP databases or dict storages, respectively. The storage driver is configured using the [[setting,sieve_script_driver]] setting. If not explicitly configured for a [[setting,sieve_script]] block, the storage driver is [[link,sieve_storage_file,file]] and the default directory is `~/sieve/` with a symbolic link at `~/.dovecot.sieve` pointing to the active script file in that directory. #### Common Settings All Sieve script storages support the following common settings: ### File storage driver The `file` script storage driver is used to retrieve Sieve scripts from the file system. This is the default type if the [[setting,sieve_script_driver]] setting is omitted. The path configured using the [[setting,sieve_script_path]] setting can either point to a directory or to a regular file. If the path points to a directory, a script called `name` is retrieved by reading a file from that directory with the file name `name.sieve`. When a script storage with type [[link,sieve_storage_type_personal,personal]] is using the `file` driver and the[[setting,sieve_script_path]] points to a directory, a symbolic link points to the currently active script (the script executed at delivery). The active script can be modified by the user through ManageSieve and by the administrator using [[doveadm,sieve activate]]. The location of this symbolic link can be configured using the [[setting,sieve_script_active_path]] setting. When a script storage with type [[link,sieve_storage_type_before,before]] or [[link,sieve_storage_type_after,after]] is using the `file` driver and [[setting,sieve_script_path]] points to a directory, all files in that directory with a `.sieve` extension are part of the sequence. The sequence order of the scripts in that directory is determined by the file names, using a normal 8-bit per-octet comparison. Unless overridden using the [[setting,sieve_script_bin_path]] setting, compiled binaries for scripts retrieved from a `file` script storage are by default stored in the same directory as where the script file was found if possible. #### Configuration The `file` storage driver supports all settings described in [Common Settings](#common-settings). Additionally, the following settings apply to this driver: ##### `sieve_script_name` If the [[setting,sieve_script_name]] setting is not configured and the Sieve script is not retrieved by name (e.g. using the [[link,sieve_include,include extension]] or by [[link,managesieve]]), the name defaults to the file name without the `.sieve` suffix. ##### `sieve_script_bin_path` If the [[setting,sieve_script_bin_path]] setting is not configured, the binaries are stored in the same directory as the corresponding sieve scripts by default. #### Example ```doveconf[dovecot.conf] sieve_script personal { driver = file path = ~/sieve active_path = ~/.dovecot.sieve } sieve_script default { type = default name = default driver = file path = /etc/dovecot/sieve/default/ } ``` ### Dict storage driver To retrieve a Sieve script from a [[link,dict]] database, two lookups are performed. First, the name of the Sieve script is queried from the dict path `/priv/sieve/name/`. If the Sieve script exists, this yields a data ID which in turn points to the actual script text. The script text is subsequently queried from the dict path `/priv/sieve/data/`. The second query is only necessary when no compiled binary is available or when the script has changed and needs to be recompiled. The data ID is used to detect changes in the dict's underlying database. Changing a Sieve script in the database must be done by first making a new script data item with a new data ID. Then, the mapping from name to data ID must be changed to point to the new script text, thereby changing the data ID returned from the name lookup, i.e. the first query mentioned above. Script binaries compiled from Sieve scripts contained in a dict database record the data ID. While the data ID contained in the binary is identical to the one returned from the dict lookup, the binary is assumed up-to-date. When the returned data ID is different, the new script text is retrieved using the second query and compiled into a new binary containing the updated data ID. #### Configuration The `dict` storage driver supports all settings described in [Common Settings](#common-settings). ##### `sieve_script_name` If the [[setting,sieve_script_name]] setting is not configured and the Sieve script is not retrieved by name (e.g. using the [[link,sieve_include,include extension]] or by [[link,managesieve]]), the name defaults to `default`. ##### `sieve_script_bin_path` By default, compiled binaries are not stored at all for Sieve scripts retrieved from a dict database. Thus, the Sieve binaries will be compiled each time they are called. To improve performance, [[setting,sieve_script_bin_path]] should be specified to cache the compiled binaries on the local filesystem. For Example: ```doveconf[dovecot.conf] sieve_script personal { driver = dict name = keep bin_path = ~/.sieve-bin # or #bin_path=/var/sieve-scripts/%{user} dict file { path = /etc/dovecot/sieve.dict } } ``` ::: tip Sieve uses the ID number as its cache index and to detect the need to compile. Therefore, if a script is changed, then its ID must also be changed for it to be reloaded. ::: #### Examples ##### Flat File Driver To retrieve the Sieve script named "keep" from the dict file /etc/dovecot/sieve.dict: ::: code-group ```doveconf[dovecot.conf] # Only the "keep" script will be used. sieve_script personal { driver = dict name = keep dict file { path = /etc/dovecot/sieve.dict } } ``` ```[/etc/dovecot/sieve.dict] priv/sieve/name/keep 1 priv/sieve/name/discard 2 priv/sieve/data/1 keep; priv/sieve/data/2 discard; ``` ::: A more advanced example using the same config as above: notify an external email address when new mail has arrived. Note that the script all needs to be on one line. ::: code-group ```[/etc/dovecot/sieve.dict] priv/sieve/name/notify 5 priv/sieve/data/5 require ["enotify", "variables"]; if header :matches "From" "*" { set "from" "${1}";} notify :importance "3" :message "New email from ${from}" "mailto:other@domain.com?body=New%20email%20has%20arrived."; ``` ::: ##### Using a SQL Driver For greater flexibility, it's possible to use a SQL driver for your dict scripts. First, set up a configuration file (such as `/etc/dovecot/dict-sieve-sql.conf.inc`) with your database configuration. This should consist of the following parts: First, set up a configuration file (such as `/etc/dovecot/dict-sieve-sql.conf`) with your database configuration. Next, create a dict proxy service (in `dovecot.conf`). Finally, configure Sieve to check the dict to lookup up a script called "active" in the database: ::: code-group ```doveconf[/etc/dovecot/dict-sieve-sql.conf.inc] # The name mapping that yields the ID of the Sieve script # The name of the script, as per the "sieve" config parameter dict_map priv/sieve/name/$script_name { # The database table sql_table = user_sieve_scripts # The username field in the table to query username_field = username # The field which contains the return value of the script ID value_field id { } # The script name field in the table to query key_field script_name { pattern = $script_name } } # The name mapping that yields the script content from ID # The ID, obtained from above dict_map priv/sieve/data/$id { # The database table sql_table = user_sieve_scripts # The username field in the table to query username_field = username # The field which contains the script value_field script_data { } # The id field in the table to query fields id { id = $id } } ``` ```doveconf[dovecot.conf] dict_server { dict sieve { driver = sql sql_driver = pgsql pgsql localhost { parameters { dbname = dovecot user = dovecot password = password } } !include /etc/dovecot/dict-sieve-sql.conf.inc } } # dict lookup sieve_script personal { driver = dict name = active dict proxy { name = sieve } } ``` ::: As with the flat file, the database query will need to return the Sieve script all in one line, otherwise the subsequent lines will be ignored. ::: info You might need to configure the [[link,dict_proxy,dict proxy permissions]]. ::: ### LDAP storage driver The `ldap` storage driver is used to retrieve Sieve scripts from an LDAP database. To retrieve a Sieve script from the LDAP database, at most two lookups are performed. First, the LDAP entry containing the Sieve script is searched using the specified LDAP search filter. If the LDAP entry changed since it was last retrieved (or it was never retrieved before), the attribute containing the actual Sieve script is retrieved in a second lookup. In the first lookup, a special attribute is read and checked for changes. Usually, this is the `modifyTimestamp` attribute, but an alternative can be configured. Depending on how Pigeonhole was configured and compiled (refer to INSTALL file for more information), LDAP support may only be available when a plugin called `sieve_storage_ldap` is loaded. #### Configuration The `ldap` storage driver supports all settings described in [Common Settings](#common-settings). The following settings apply to this script storage driver: ##### `sieve_script_name` If the [[setting,sieve_script_name]] setting is not configured and the Sieve script is not retrieved by name (e.g. using the [[link,sieve_include,include extension]] or by [[link,managesieve]]), the name defaults to `default`. ##### `sieve_script_bin_path` By default, compiled binaries are not stored at all for Sieve scripts retrieved from LDAP. Thus, the Sieve binaries will be compiled each time they are called. To improve performance, [[setting,sieve_script_bin_path]] should be specified to cache the compiled binaries on the local filesystem. For Example: ```doveconf[dovecot.conf] sieve_script personal { driver = ldap name = keep bin_path = ~/.sieve-bin # or #bin_path = /var/sieve-scripts/%{user} # LDAP settings: ... } ``` ::: tip Sieve uses the LDAP entry configured using [[setting,sieve_script_ldap_modified_attribute]] to detect the need to compile. Therefore, if a script is changed, then this entry must also be changed for it to be reloaded. Depending on which LDAP entry is configured, this can happen implicitly by the LDAP database itself (which is normally the case for the default `modifyTimestamp` entry). ::: #### Example If support for the `ldap` script storage driver is compiled as a plugin, it needs to be added to the [[setting,sieve_plugins]] setting before it can be used, e.g.: ```doveconf[dovecot.conf] sieve_plugins { sieve_storage_ldap = yes } ``` ::: code-group ```doveconf[dovecot.conf] sieve_script personal { driver = ldap bin_path = ~/.sieve-bin/ # Don't use privileged LDAP credentials here as these may likely leak. Only # search and read access is required. # Space separated list of LDAP URIs to use. ldap_uris = ldap://localhost # Distinguished Name - the username used to login to the LDAP server. # Leave it commented out to bind anonymously. ldap_auth_dn = cn=sieve,ou=Programs,dc=example,dc=org # Password for LDAP server, if dn is specified. ldap_auth_dnpassword = secret # LDAP base ldap_base = dc=mail,dc=example,dc=org # Dereference: never, searching, finding, always ldap_deref = never # Search scope: base, onelevel, subtree ldap_scope = subtree # Filter for user lookup. Some variables can be used: # %{user} - username # %{user | username} - user part in user@domain, same as %{user} if there's no domain # %{user | domain} - domain part in user@domain, empty if there's no domain # %{name} - name of the Sieve script ldap_filter = (&(objectClass=posixAccount)(uid=%{user})) # Attribute containing the Sieve script ldap_script_attribute = mailSieveRuleSource # Attribute used for modification tracking ldap_modified_attribute = modifyTimestamp } ``` ::: ## Settings ### Extension-specific Configuration Sieve language extensions may have specific configuration. See [[link,sieve_extensions]] for a list of extensions and links to their configuration pages. ### Per-user Sieve script location By default, the Dovecot Sieve plugin looks for the user's Sieve script file in the user's home directory (`~/.dovecot.sieve`). This requires that the [[link,home_directories_for_virtual_users]] is set for the user. If you want to store the script elsewhere, you can override the default by configuring a [[link,sieve_storage_type_personal,personal script storage]]. This can be done in two ways: 1. Define the full [[setting,sieve_script]] block in dovecot configuration. 2. Return the user-specific settings as a extra fields from [[link,userdb_extra_fields]]. For example, to use a Sieve script file named `.sieve` in `/var/sieve-scripts`, use: ```doveconf[dovecot.conf] sieve_script personal { path = /var/sieve-scripts/%{user}.sieve } ``` You may use templates like `%{user}`, as shown in the example. See [[variable]]. A relative path (or just a filename) will be interpreted to point under the user's home directory. ## Executing Multiple Scripts Sequentially The Dovecot Sieve plugin allows executing multiple Sieve scripts sequentially. The extra scripts can be executed before and after the user's private script. For example, this allows executing global Sieve policies before the user's script. See the [[link,sieve_storage_type_before,before]] and [[link,sieve_storage_type_after,after]] Sieve storage types for details on how to configure the execution sequence. The script execution ends when the currently executing script in the sequence does not yield a "keep" result: when the script terminates, the next script is only executed if an implicit or explicit "keep" is in effect. ::: info To end all script execution, a script MUST NOT execute keep and it MUST cancel the implicit keep. For example, executing: `discard; stop;`. ::: This means that the command `keep;` has different semantics when used in a sequence of scripts. For normal Sieve execution, `keep;` is equivalent to `fileinto "INBOX";`, because both cause the message to be stored in INBOX. However, in sequential script execution, it only controls whether the next script is executed. Storing the message into INBOX (the default folder) is not done until the last script in the sequence executes (implicit) keep. To force storing the message into INBOX earlier in the sequence, the fileinto command can be used (with `:copy` or together with `keep;`). Apart from the `keep` action, all actions triggered in a script in the sequence are executed before continuing to the next script. This means that when a script in the sequence encounters an error, actions from earlier executed scripts are not affected. The sequence is broken however, meaning that the script execution of the offending script is aborted and no further scripts are executed. An implicit keep is executed instead. Just as for executing a single script the normal way, the Dovecot Sieve plugin takes care never to duplicate deliveries, forwards or responses. When vacation actions are executed multiple times in different scripts, the usual error is not triggered: the subsequent duplicate vacation actions are simply discarded. For example: ```doveconf[dovecot.conf] # Global scripts executed before the user's personal script. # E.g. handling messages marked as dangerous sieve_script before1 { type = before path = /var/lib/dovecot/sieve/discard-viruses.sieve } # Domain-level scripts retrieved from LDAP sieve_script before2 { type = before name = ldap-domain driver = ldap # ldap settings here: ... } # User-specific scripts executed before the user's personal script. # E.g. a vacation script managed through a non-ManageSieve GUI. sieve_script before3 { type = before path = /var/vmail/%{user | domain}/%{user | username}/sieve-before } # User-specific scripts executed after the user's personal script. # (if keep is still in effect) # E.g. user-specific default mail filing rules sieve_script after1 { type = after path = /var/vmail/%{user | domain}/%{user | username}/sieve-after } # Global scripts executed after the user's personal script # (if keep is still in effect) # E.g. default mail filing rules. sieve_script after2 { type = after path = /var/lib/dovecot/sieve/after.d/ } ``` ::: tip Be sure to manually pre-compile the scripts specified by [[link,sieve_storage_type_before,before]] and [[link,sieve_storage_type_after,after]] Sieve storage types by using the [[link,sievec]] tool. ::: ## Visible Default Script The [[link,sieve_storage_type_default,default]] Sieve storage type specifies the location of a default script that is executed when the user has no active personal script. Normally, this default script is invisible to the user; i.e., it is not listed in [[link,managesieve_server]]. To give the user the ability to see and read the default script, it is possible to make it visible under a specific configurable name using [[setting,sieve_script_name]] in the [[setting,sieve_script]] block of the [[link,sieve_storage_type_default,default]] storage setting. The [[link,sieve_storage_type_default,default]] storage needs to point to a valid script location as well for this to work: if the default script does not exist at the indicated location, it is not shown. ManageSieve will magically list the default script under that name, even though it does not actually exist in the user's normal personal script storage. This way, the ManageSieve client can see that it exists and it can retrieve its contents. If no normal script is active, the default is always listed as active. The user can replace the default with a custom script, by uploading it under the default script's name. If that custom script is ever deleted, the default script will reappear from the shadows implicitly. This way, ManageSieve clients will not need any special handling for this feature. If the name of the default script is equal to the name the client uses for the main script, it will initially see and read the default script when the user account is freshly created. The user can edit the script, and when the edited script is saved through the ManageSieve client, it will override the default script. If the user ever wants to revert to the default, the user only needs to delete the edited script and the default will reappear. ```doveconf[dovecot.conf] sieve_script personal { path = ~/sieve active_path = ~/.dovecot.sieve } sieve_script default { type = default name = roundcube path = /var/lib/dovecot/sieve/default.sieve } ``` ## Trace Debugging Trace debugging provides detailed insight in the operations performed by the Sieve script. Messages about what the Sieve script is doing are written to the specified directory. ::: warning On a busy server, this functionality can quickly fill up the trace directory with a lot of trace files. Enable this only temporarily and as selective as possible; e.g., enable this only for a few users by returning the settings below from userdb as [[link,userdb_extra_fields]] rather than enabling these for everyone. ::: ### Settings These settings apply to both the Sieve plugin and [[plugin,imap-sieve]]. # Trash Plugin (`trash`) Normally, a quota exceeded error is returned if saving/copying a message would bring the user over quota. With the trash plugin, the oldest messages are instead expunged from the specified mailboxes until the message can be saved. If the new message is large enough that it wouldn't fit even if all messages from configured mailboxes were expunged, then no messages are expunged and the user receives a "Quota exceeded" error. ## Settings ## Configuration Requires [[plugin,quota]] to be loaded and configured to use non-FS quota. Example: ::: code-group ```doveconf[dovecot.conf] mail_plugins { quota = yes trash = yes } namespace inbox { # Spam mailbox is emptied before Trash mailbox Spam { trash_priority = 1 } # Trash mailbox is emptied before Sent mailbox Trash { trash_priority = 2 } # If both Sent and "Sent Messages" mailboxes exist, the next oldest message # to be deleted is looked up from both of the mailboxes. mailbox Sent { trash_priority = 3 } mailbox "Sent Messages" { trash_priority = 3 } ``` ::: # Virtual Mailbox Plugin (`virtual`) This plugin allows virtual mailboxes to be created. Virtual mailboxes consist of Dovecot search criteria that are used to build a listing of messages that don't exist in a physical mailbox. ## Settings ## Configuration ### Load Plugin First, you'll have to load the plugin: ```doveconf[dovecot.conf] mail_plugins { virtual = yes } ``` ### Namespace Then, you'll have to create a [[link,namespaces,namespace]] for the virtual mailboxes, for example: ```doveconf[dovecot.conf] namespace virtual { prefix = virtual/ separator = / mail_driver = virtual mail_path = ~/Maildir/virtual } ``` After this you can create virtual mailboxes under `~/Maildir/virtual`. By default it uses the `fs` layout, so you can create directories such as: * INBOX: `~/Maildir/virtual/INBOX/` * Sub/mailbox: `~/Maildir/virtual/Sub/mailbox/` If you prefer to use the Maildir++ layout instead, set [[setting,mailbox_list_layout,maildir++]]. ### Virtual Mailboxes For each virtual directory you need to create a `dovecot-virtual` file. Its syntax is like: ``` <1+ mailbox patterns> [ [etc..]] ``` Mailbox patterns can contain IMAP LIST-compatible [[rfc,3501,6.3.8]] `*` and `%` wildcards. They are currently evaluated only when the virtual mailbox is being selected, so if more mailboxes are created during that they aren't noticed. `*` wildcard matches only one namespace at a time based on the namespace prefix. For example if you have namespaces with an empty prefix and a prefix `mail/`: * `*` matches only mailboxes from the namespace with empty prefix * `mail*` matches mailboxes beginning with name `mail` from the namespace with empty prefix * `mail/*` matches only mailboxes from the `mail/` namespace Beware that `*` will not match any mailbox which already has a more specialized match! The mailbox names have special prefixes: * `-`: Don't include this mailbox. * `+`: Drop \Recent flags from the backend mailbox when opening it. * `!`: Save new mails to this mailbox (see below). If you need to actually include a mailbox name that contains such prefix, you can currently just kludge it by using `+` prefix (if you don't care about the \Recent flags) and adding the mailbox name after that (e.g. `+-box`). Search program is compatible with IMAP SEARCH command [[rfc,3501,6.4.4]]. Besides the standard SEARCH key you may want to use X-MAILBOX key which matches the message's original mailbox. ::: tip Leading whitespace is required in front of the search specifications. ::: ### Saving Mails to Virtual Mailboxes It's possible to configure virtual mailbox so that it's possible to save/copy messages there. This is done by specifying a single physical mailbox where the message is really saved by prefixing it with `!`, e.g.: ``` !INBOX work/* unseen ``` ::: warning Nothing guarantees that the saved mail will actually show up in the virtual mailbox. If a message was saved with \Seen flag to the above virtual mailbox, it wouldn't show up there. This also means it's problematic to support IMAP UIDPLUS extension for virtual mailboxes, and currently Dovecot doesn't even try (no [APPENDUID] or [COPYUID] is sent to client). ::: The `!-prefixed` virtual mailbox is also selected from; you don't need to list it again without an ! or you'll get two copies of your messages in the virtual mailbox. ## IMAPSieve Filters [[added,imapsieve_filters]] When saving to a virtual mailbox is configured, imapsieve scripts act as if the save was done directly to the physical destination mailbox. For example if Virtual/All folder was configured with INBOX as the save destination, this `sieve.before` script would be run both when saving to INBOX and when saving to Virtual/All folder: ```[sieve.before] imapsieve_mailbox_name = INBOX # Virtual/All would NOT work imapsieve_mailbox_causes = COPY imapsieve_mailbox_before = /etc/dovecot/sieve.before ``` Also, the `imap.mailbox` environment always contains INBOX, even when saving via Virtual/All folder. ## Mailbox Selection Based on METADATA Instead of a mailbox name, you can specify a metadata filter: ``` [-]/: ``` There can be multiple metadata entries. All the entries must match. For example: ``` * /private/vendor/vendor.dovecot/virtual:* -/private/vendor/vendor.dovecot/virtual:ignore all ``` This matches all mailboxes, which contain a virtual METADATA entry that has any value except `ignore`. ## Virtual POP3 INBOX If you want POP3 INBOX to contain some or all mailboxes, you can do this in the following way: ::: code-group ```doveconf[dovecot.conf] # Namespace Configuration # The default namespace that is visible to IMAP clients namespace inbox { prefix = separator = / list = yes } # Virtual namespace for the virtual INBOX. Use a global directory for # dovecot-virtual files. namespace virtual { prefix = virtual/ separator = / mail_driver = virtual mail_path = /etc/dovecot/virtual mail_index_path = ~/Maildir/virtual list = no hidden = yes } # Copy of the inbox namespace. We'll use this in dovecot-virtual file. namespace real { prefix = RealMails/ separator = / list = no hidden = yes } # Note: none of the namespaces have inbox=yes. This is because for IMAP users # you want the inbox namespace to have 'inbox=yes', but for POP3 users you want # the virtual namespace to have 'inbox=yes'. This requires setting the # 'inbox=yes' in userdb extra fields. For example with MySQL you can do # this like: userdb sql { query = SELECT ..., \ CASE '%{protocol}' WHEN 'pop3' THEN NULL ELSE 'yes' END AS 'namespace/inbox/inbox', \ CASE '%{protocol}' WHEN 'pop3' THEN 'yes' ELSE NULL END AS 'namespace/virtual/inbox' \ WHERE ... } ``` ```[/etc/dovecot/virtual/INBOX/dovecot-virtual] RealMails RealMails/* -RealMails/Trash -RealMails/Trash/* -RealMails/Spam all ``` ::: You'll have to use the `RealMails/` prefix if you want to use `*` wildcard, otherwise it would match INBOX, which in turn would again lead to the virtual INBOX and that would create a loop. Also to avoid accidental POP3 UIDL changes, you shouldn't base the UIDLs on IMAP UIDs. Instead use GUIDs (with Maildir the same as base filename): ```doveconf[dovecot.conf] pop3_uidl_format = %{guid} ``` ## Configuration Examples List all messages with \Deleted flag in all mailboxes: ::: code-group ```[~/Maildir/virtual/Trash/dovecot-virtual] * deleted ``` ::: List all unseen INBOX and work/\* messages: ::: code-group ```[~/Maildir/virtual/unseen/dovecot-virtual] INBOX work/* unseen ``` ::: Create a GMail-style conversation view for INBOX which shows all threads that have messages in INBOX, but shows all messages in the thread regardless of in what mailbox they physically exist in: ::: code-group ```[~/Maildir/virtual/all/dovecot-virtual] * all ``` ```[~/Maildir/virtual/INBOX/dovecot-virtual] virtual/all inthread refs x-mailbox INBOX ``` ::: Create a mailbox containing messages from all mailboxes except Trash and its children: ::: code-group ```[~/Maildir/virtual/all/dovecot-virtual] * -Trash -Trash/* all ``` ::: Create a virtual Sentmail folder that includes Sent\*: ::: code-group ```[~/Maildir/virtual/Sentmail/dovecot-virtual] Sent* all ``` ::: List messages from past 48 hours (syntax is in seconds): ::: code-group ```[~/Maildir/virtual/recent/dovecot-virtual] INBOX work/* all younger 172800 ``` ::: List unseen messages from foo and flagged messages from all mailboxes (including foo): ::: code-group ```[~/Maildir/virtual/example/dovecot-virtual] foo or unseen flagged * flagged ``` ::: # Welcome Plugin (`welcome`) Call a script when the user logs in for the first time. This is specifically done when the INBOX is (auto)created. The scripts are called similarly to [[link,quota_warning_scripts]]. ## Settings ## Example Configuration # Dovecot Config File Syntax ::: tip See Also: * [[link,settings_types]], and * [[link,settings_variables]]. ::: ## Config Version The first setting in the configuration file must be [[setting,dovecot_config_version]]. It specifies the configuration syntax, the used setting names and the expected default values. [[changed,config_design_changed]] All settings are now global settings, i.e. there is no settings hierarchy. There are various filters, which can limit where the settings are used. It is possible to configure any setting inside any filter, although they may not actually do anything in there. Setting name prefixes can be stripped out (and they are in [[man,doveconf]] output) when the prefix matches the parent [[link,settings_syntax_named_filters,named [list] filter]]. For example: ```doveconf[dovecot.conf] # named list filter namespace inbox { # namespace_separator setting separator = / } # named list filter passdb static { # passdb_static_password setting password = foo # this is allowed, but it does nothing here namespace_separator = / } ``` ## Basic Syntax The syntax generally looks like this: ```doveconf[dovecot.conf] # this is a comment settings_key = settings_value ``` The `#` character and everything after it are comments. Extra spaces and tabs are ignored. If you need to use these, put the value inside quotes. The quote character inside a quoted string is escaped with `\"`: ```doveconf[dovecot.conf] settings_key = "# char, \"quote\", and trailing whitespace " ``` If Dovecot doesn't seem to be reading your configuration correctly, use `doveconf -n` to check how Dovecot actually parses it. ## Named Filters [[added,settings_syntax_named_filters_added]] All settings are globals. There are several filters which can be used to restrict when the settings are used. There are "named filters" and "named list filters". Named filters are used to access settings in some specific situations. For example: ```doveconf[dovecot.conf] mail_attribute { dict file { } } ``` In this case when mail attributes are being accessed, the dict settings are looked up using the named filter called `mail_attribute`. Note that named filters cannot have a name before the `{`, i.e. `mail_attribute foo {` will result in an error. Setting names that begin with the same prefix as a named filter will be treated as if they belong inside the named filter. For example all these settings are equivalent and modify the exact same setting: ```doveconf[dovecot.conf] auth_policy_server_url = example.com auth_policy { server_url = example.com auth_policy_server_url = example.com } ``` Regardless of which method is used in `dovecot.conf`, the [[man,doveconf]] output will be: ```doveconf[dovecot.conf] auth_policy { server_url = example.com } ``` Named list filters are similar to named filters, except there can be many of them, each with a unique name. For example: ```doveconf[dovecot.conf] namespace inbox { prefix = INBOX/ } namespace virtual { prefix = Virtual/ } ``` Both named filters and named list filters can be updated later on in the configuration. For example: ```doveconf[dovecot.conf] namespace inbox { prefix = INBOX/ } # ... # possibly included from another file: # The namespaces settings get merged into the same inbox namespace filter. namespace inbox { mailbox Trash { special_use = \Trash } } ``` The named list filter's name may also sometimes be used as part of the settings instead of simply a name. For example: ```doveconf[dovecot.conf] service auth { unix_listener auth-master { # ... } } ``` Above the `auth-master` both uniquely identifies the filter name, but it also acts as the `unix_listener_path` setting. Settings inside filters are automatically attempted to be prefixed by the innermost filter prefix to avoid repetition. For example: ```doveconf[dovecot.conf] service imap { inet_listener imaps { ssl = yes } } ``` The `ssl` setting is attempted to be looked up in this order: 1. `inet_listener_imaps_ssl` 1. `inet_listener_ssl` 1. `ssl` The first setting that exists is used. ::: tip The filters must currently be written with the linefeeds as shown above. For example this doesn't work: ```doveconf[dovecot.conf] namespace inbox { prefix = INBOX/ } # DOES NOT WORK ``` ::: ## Named Filter Overrides It's possible to add/update/replace named (list) filters via userdb settings or via `-o` command line parameters. For example if you have: ```doveconf[dovecot.conf] oauth2 { http_client_request_max_attempts = 1 } ``` This can be replaced with `-o oauth2/http_client_request_max_attempts=2` command line parameters. Similarly for named list filters if you have: ```doveconf[dovecot.conf] namespace inbox { separator = / } ``` This can be replaced with `-o namespace/inbox/separator=.` command line parameters. If you want to add a new named list filter, use `+=[,,...]`. For example: `-o namespace+=second -o namespace/second/...=...` If you want to replace all the named list filters, use `=[,,...]` (i.e. without the `+`). For example: `-o namespace=inbox,second -o namespace/second/...=...` ## Connection Filters There are a few different connection/session related filters: * `protocol `: Name of the service/protocol that is reading the settings. For example: `imap`, `pop3`, `doveadm`, `lmtp`, `lda` * `remote `: Remote client's IP/network. For non-TCP connections this will never match. For example `10.0.0.1` or `10.0.0.0/16`. * `local_name `: Matches TLS connection's SNI name, if it's sent by the client. Commonly used to [[link,ssl,configure multiple TLS certificates]]. * `local `: Locally connected IP/network. For non-TCP connections this will never match. For example `127.0.0.1` or `10.0.0.0/16`. These filters work for most of the settings, but most importantly auth settings currently only support the protocol filter. Some of the other settings are also global and can't be filtered, such as [[setting,log_path]]. An example, which uses all of the filters: ```doveconf[dovecot.conf] local 127.0.0.1 { local_name imap.example.com { remote 10.0.0.0/24 { protocol imap { # ... } } } } ``` The nesting of the filters must be exactly in that order or the config parsing will fail. When applying the settings, the settings within the most-specific filters override the less-specific filter's settings, so the order of the filters in config file doesn't matter. Example: ```doveconf[dovecot.conf] local 127.0.0.2 { key = 127.0.0.2 } local 127.0.0.0/24 { key = 127.0.0.0/24 } local 127.0.0.1 { key = 127.0.0.1 } # The order of the above blocks doesn't matter: # If local IP=127.0.0.1, key=127.0.0.1 # If local IP=127.0.0.2, key=127.0.0.2 # If local IP=127.0.0.3, key=127.0.0.0/24 ``` Similarly remote local filters override remote filters, which override `local_name` filters, which override protocol filters. In some situations Dovecot may also return an error if it detects that the same setting is being ambiguously set by multiple matching filters. ## Setting types See [[link,settings_types]] for which types of settings are supported by the configuration. Note especially the [[link,settings_types_strlist]] and [[link,settings_types_boollist]] which look similar to named filters. ## Groups includes You can create groups of settings, which can be referred to elsewhere. The groups themselves are grouped into labels. The label prefix can be omitted from the settings' names. The syntax is: ```doveconf[dovecot.conf] group @label name { # settings, with label_ prefix automatically attempted to be added } ``` For example: ```doveconf[dovecot.conf] group @mysql default { host = mysql.example.com mysql_ssl = yes ssl_client_ca_file = /etc/ssl/ca.pem } passdb sql { @mysql = default # ... } group @mailboxes english { mailbox Trash { auto = subscribe special_use = \Trash } mailbox Drafts { auto = subscribe special_use = \Drafts } } group @mailboxes finnish { mailbox Roskakori { auto = subscribe special_use = \Trash } mailbox Luonnokset { auto = subscribe special_use = \Drafts } } namespace inbox { @mailboxes = english } ``` You can override settings inside a group by adding the override settings after it. For example: ```doveconf[dovecot.conf] @mysql = default mysql_host = mysql2.example.com # override the default mysql_host ``` Note that explicit settings always override group settings. For example this is not possible: ```doveconf[dovecot.conf] mailbox trash { name = Trash } group @mailboxes finnish { mailbox trash { name = Roskakori } } @mailboxes = finnish # Does not work - name is still Trash ``` It's possible to override groups using the command line parameter `-o` or userdb. For example above you can return `namespace/inbox/@mailboxes=finnish` from userdb to change mailbox names to Finnish language. Note that groups can't be added via overrides unless `@label` is already set in the config file. You can see the default group contents with e.g.: ```console doveconf -d @metric_defaults/proxy ``` ## Including Config Files The main `dovecot.conf` file can also include other config files: ```doveconf[dovecot.conf] !include local.conf !include /path/to/another.conf !include conf.d/*.conf ``` The paths are relative to the currently parsed config file's directory. Example: ```doveconf[dovecot.conf] # /etc/dovecot/dovecot.conf: !include conf.d/imap.conf # /etc/dovecot/conf.d/imap.conf: !include imap2.conf # /etc/dovecot/conf.d/imap2.conf is being included ``` If any of the includes fail (e.g. file doesn't exist or permission denied), it results in an error. It's not an error if wildcards don't result in any matching files. To avoid these errors, you can use `!include_try` instead: ```doveconf[dovecot.conf] !include_try passwords.conf ``` Including a file preserves the context where it's included from. Example: ```doveconf[dovecot.conf] protocol imap { !include imap-settings.conf } ``` ## Long lines It's possible to split the setting values into multiple lines. ```doveconf[dovecot.conf] setting_key = \ long \ value # equivalent to: "long value" ``` All the whitespace between lines is converted to a single space regardless of how many spaces or tabs are at the beginning of the line or before the '\'. Even if there is zero whitespace a single space is added. ## Reading Value From File It's possible to read the value for a setting from a file: ```doveconf[dovecot.conf] key = login_log_format_elements = $SET:login_log_format_elements method=%{mechanism} login_log_format_elements = $SET:login_log_format_elements session=<%{session}> # Expands to: user=<%{user}> method=%{mechanism} session=<%{session}> ``` [[changed,settings_delayed_expansion_changed]] The setting name can now contain a filter path, for example `$SET:service/auth/service_client_limit`. Full setting names must be used here - automatic prefixing isn't attempted. See also [[link,settings_variables]]. ## Environment Variables It is possible use `$ENV:name` to expand values from environment. Expansion only works when it's surrounded by spaces, and is not inside `"quotes"` or `'quotes'`. Note that these are also Case Sensitive. These can also be used for external config files, but you need to list them in [[setting,import_environment]] so that processes can see them. For [[link,settings_types_file]] it is better to use `$ENV:` instead of `%{env:}`. This is because with `$ENV:` the expansion and file reading is done by the config process, which normally runs as root. With `%{env:}` the expansion is delayed until the process accessing the setting expands it, but the process may not have enough permissions to open the file. # Dovecot Settings Types ## String String can contain any character. Strings support [[variable]]. ## String without variables Certain settings require specific variables and thus don't use the default [[variable]]. For example: ```doveconf[dovecot.conf] imap_logout_format = in=%{input} out=%{output} ``` Here the `%{input}` and `%{output}` refer to variables specific to the [[setting,imap_logout_format]] setting. ## Unsigned Integer Unsigned integer is a number between `0`..`4294967295`, although specific settings may have additional restrictions. The value can also be `unlimited`, which translates to `4294967295`. ## Octal Unsigned Integer Same as [[link,settings_types_uint]], but if the value is prefixed with `0`, the number is read as octal (instead of decimal). ## Boolean Boolean settings interpret any value as true, or false. `yes` and `no` are the recommended values. However, `y` and `1` also work as `yes`. Whereas, only `no` will work as false. All these are case-insensitive. Other values give errors. ## Size The size value type is used in Dovecot configuration to define the amount of space taken by something, such as a file, cache or memory limit. The size value type is case insensitive. The following suffixes can be used to define size: | Suffix | Value | | ------ | ----- | | `B` | bytes | | `K` | kilobytes | | `M` | megabytes | | `G` | gigabytes | | `T` | terabytes | The values can optionally be followed by `I` or `IB`. For example `K = KI = KIB`. The size value type is base `2`, meaning a kilobyte equals `1024` bytes. The value can also be `unlimited`. ## Time The Time value is used in Dovecot configuration to define the amount of Time taken by something or for doing something, such as a sending or downloading file, processing, and more. The Time value supports using suffixes of any of the following words: * `secs` * `seconds` * `mins` * `minutes` * `hours` * `days` * `weeks` ::: info So for example, `d`, `da`, `day`, and `days` all mean the same. Make sure to be explicit if you want to differentiate between `mins` and `msecs`, as `m` does not suffice. ::: The value can also be `infinite`. ## Millisecond Time This is similar to [Time](#time), but additionally supports milliseconds (`ms`) precision. The Millisecond Time value supports using suffixes of any of the following words: * All the suffixes supported by [Time](#time) * `msecs` * `mseconds` * `millisecs` * `milliseconds` All of these have the same meaning. Similarly to [Time](#time), the suffixes can be shortened to e.g. `ms`. ## IP Addresses The IP can be IPv4 address like `127.0.0.1`, IPv6 address without brackets like `::1`, or with brackets like `[::1]`. The DNS name is looked up once during config parsing, e.g. `host.example.com`. If a /block is specified, then it's a CIDR address like `1.2.3.0/24`. If a /block isn't specified, then it defaults to all bits, i.e. /32 for IPv4 addresses and /128 for IPv6 addresses. ## Port Number This type is an [[link,settings_types_uint]] with numbers ranging only from `0` to `65535`. ## URL Special type of [String](#string) setting. Conforms to Uniform Resource Locators (URL) ([[rfc,1738]]). ## File Path to a file. The file contents are read already by the config process, so the file permissions don't usually matter. However, some callers need to open the file again (e.g. the `ssl_client_cert_file` setting with MySQL) after the process has dropped root privileges. If you use [[link,settings_variables,%variables]] in file names, the expansion is delayed until the process accessing the setting expands it. The process is usually not running as root at this point, so you may need to adjust file permissions. It's possible to give inline values (instead of a path to a file) using the [[link,settings_syntax,heredoc syntax]] (`<`. ## Named Filter The settings inside the filter are used only in a specific situation. See [[link,settings_syntax_named_filters]] for more details. ## Named List Filter The settings inside the filter are used only in a specific situation. The filter has a unique name, which can be used to identify it within the list. See [[link,settings_syntax_named_filters]] for more details. ## String List The string list type is a list of `key=value` pairs. Each key name is unique within the list (i.e. giving the same key multiple times overrides the previous one). The string list is configured similarly to [[link,settings_syntax_named_filters]]: ```doveconf[dovecot.conf] fs_randomfail_ops { read = 100 write = 50 } ``` [[changed,settings_list_key_variables_changed]] Both the `key` and the `value` support [[variable]]; previously only the `value` was expanded. Keys are expanded before duplicate keys are resolved, so deduplication operates on the final key name. You can clear out an existing string list by setting it to an empty value. This is mainly useful to drop default settings. For example: ```doveconf[dovecot.conf] auth_policy_request_attributes = auth_policy_request_attributes { login = %{requested_username} } ``` ## Boolean List The boolean list type is a list of `key=yes/no` pairs. Each key is unique within the list (i.e. giving the same key multiple times overrides the previous one). The boolean list can be configured as a space or comma-separated list, which replaces the previous boolean list entirely. For example: ```doveconf[dovecot.conf] mail_plugins = quota imap_quota mail_plugins = acl,imap_acl # removes quota and imap_quota ``` Quotes are also supported: ```doveconf[dovecot.conf] doveadm_allowed_commands = "mailbox list" "mailbox create" ``` The boolean list can also be configured to update an existing boolean list. For example: ```doveconf[dovecot.conf] mail_plugins = quota acl protocol imap { mail_plugins { imap_quota = yes imap_acl = yes } } local 10.0.0.0/24 { protocol imap { mail_plugins { imap_acl = no } } } ``` [[changed,settings_list_key_variables_changed]] The `key` names support [[variable]]; previously they were always used literally. Keys are expanded before duplicate keys are resolved, so deduplication operates on the final key name. # Settings Variables You can use special variables in several places: * All settings, except of type [[link,settings_types_string_novar]]. Most commonly used by [[link,mail_location]]. * Static [[link,userdb]] and [[link,auth_passwd_file]] template strings * [[link,auth_ldap]], [[link,auth_sql]], and [[link,userdb]] query strings * Log prefix for imap/pop3 process ## Variable expansion syntax [[changed,var_expand]] We have introduced an entirely new variable expansion syntax. The basic syntax is `%{variable (| filter | filter ...)}`, which means that most existing variables work, but there are some changes, so check variable usage carefully when converting old syntax. The simple case of just getting a value of variable is `%{variable}`. These can be in middle of strings. Another syntax is `%{provider:variable}`, where the value is provided by a provider. There are global providers, and context-specific providers. A variable can be then filtered with various filters, such as `%{variable | upper}` to get uppercase representation of variable. You can chain as many filters as you need. If a pipeline contains the `safe` filter, it applies to the whole pipeline output. The `safe` filter must always be the last filter in the pipeline. Filters can accept parameters, both positional and named. E.g. `%{literal('\r\n\')}` will expand to CR LF. `%{user | substr(0, 1)}` will take first character of username. Example of named parameters would be `%{user | md5(rounds=1000,salt='pepper')}` For escaping: * `%%{text}` emits `%{text}` * `%%%{text}` emits `%%{text}` * `%{concat('%', variable)}` emits `%` * Otherwise `%` doesn't need any escaping. `%%` emits the same `%%`. Filters accept strings, numbers and variables as parameters. Parameters can be positional or named key-value pairs. Key names cannot be variables. The left side of pipe character (`|`) is provided as input to a filter. Some filters can be used in place of variables, e.g. lookup, literal and if. When value is missing or empty, you can use the `default` filter to provide value. Missing variables will cause errors and must be negated with default. This does not apply to all providers, some providers return empty when value is missing. If the last filter would output binary data, the data is encoded with `hexlify` filter by default. To avoid this, you can use `text` filter, which will sanitize the input and mark it as text. The new syntax also supports simple maths, you can do one operation. E.g. `%{port + 1000}`. Addition, substraction, multiplication, division and modulo operations are supported for now. A special case for modulo operation is that it can be applied to binary input, e.g. `sha1 % 256`. The input is treated as 64-bit unsigned number and modulo is taken from that. All strings must be encapsulated with `"` or `'`, and you can escape them using `\\` within string. Numbers when used as parameters must be provided without quotes. ## List of filters All parameters are strings unless stated otherwise. If parameter is `any`, it accepts both numbers and strings. Boolean type is `0` for false and `1` for true. Filters that have `any` in input and output mean that they will accept bytes or string, and the result will be bytes or strings, depending on the input. The types indicated as interpreted types, as everything is stored as strings internally. Bytes output type indicates that the output will be tagged as binary output. Subsequent filters can change this. | Filter | Input | Output | Description | | ------ | ----- | ------ | ----------- | | `base64(pad=boolean, url=boolean)` | Bytes | String | Base64 encode given input, defaults to pad and not url scheme. | | `benumber` | Bytes | Number | Convert big-endian encoded input into a number. | | `concat(any, any...)` | Bytes | Bytes | Concatenates input with value(s). Numbers are coerced to strings. Input is optional. | | `date(format, tz=string)` | Number | String | Format a UNIX timestamp using [`strftime(3)`](https://man7.org/linux/man-pages/man3/strftime.3.html) `format`. The input may be a plain seconds value or the `.` form produced by the [`time:unix`](#time-variables) provider; any fractional part is ignored. `tz` selects the timezone used to break the timestamp into calendar fields: `utc` (alias `gmt`, the default) or `local`. [[added,variables_timestamp_added]] | | `decrypt(key=bytes, iv=bytes, raw=boolean, algorithm=string)` | Any | Any | Decrypts given input, see [cryptography support](#cryptography-support). | | `decrypt(key=string, salt=string, rounds=number, raw=boolean, hash=string, algorithm=string)` | Any | Any | Decrypts given input, see [cryptography support](#cryptography-support). | | `default(value)` | String | String | Replace empty or missing input with value. Clears missing variable error. If no value is provided, empty string is used. | | `domain` | String | String | Provides domain part of user@domain value. | | `encrypt(key=bytes, iv=bytes, raw=boolean, algorithm=string)` | Any | Any | Encrypts given input, see [cryptography support](#cryptography-support). | | `encrypt(key=string, salt=string, rounds=number, raw=boolean, hash=string, algorithm=string)` | Any | Any | Encrypts given input, see [cryptography support](#cryptography-support). | | `epoch(unit=string)` | Number | Number | Convert a UNIX timestamp into an integer in the requested `unit`: `s` (seconds, the default), `ms` (milliseconds), `us` (microseconds) or `ns` (nanoseconds). The input may be a plain seconds value or the `.` form produced by the [`time:unix`](#time-variables) provider. The output never contains a decimal point. [[added,variables_timestamp_added]] | | `escape` | String | String | Apply the configured escape function to the input. Returns an error if no escape function is configured. This filter is intended to be used with `safe` filter, when used without, the output is escaped again at output time (double-escaped). [[added,variables_escape_added]] | | `from_epoch(unit=string)` | Number | Number | Inverse of `epoch`: convert an integer UNIX timestamp expressed in `unit` (`s`, `ms`, `us` or `ns`, default `s`) into the canonical `.` form produced by the [`time:unix`](#time-variables) provider. Useful for feeding millisecond/nanosecond timestamps from external input into the `date` filter. [[added,variables_timestamp_added]] | | `hash(method, rounds=number, salt=string)` | Bytes | Bytes | Returns raw hash from input using given hash method. Rounds and salt are optional. | | `hexlify(width)` | Bytes | String | Convert bytes into hex with optional width, truncates or pads up to width. | | `hex(width)` | Number | Number | Convert base-10 number to base-16 number. If width is specified the result is truncated or padded with 0 to width. Negative width is applied after number. | | `if(left, operator, right, true, false)` | String | String | Evaluates given comparison and returns true or false value. See [conditionals](#conditionals). | | `if(operator, right, true, false)` | String | String | Evaluates given comparison against input value and retuns true or false value. | | `index(separator, nth)` | String | String | Returns nth element from separator separated string. Zero based. Negative values are looked relative to end of list. | | `iso8601(tz=string)` | Number | String | Format a UNIX timestamp as an ISO 8601 / RFC 3339 date-time string, e.g. `2025-06-08T10:40:00Z`. The input may be a plain seconds value or the `.` form from the [`time:unix`](#time-variables) provider; any fractional part is ignored. `tz` is `utc` (alias `gmt`, the default), which uses the `Z` suffix, or `local`, which uses a `+HH:MM`/`-HH:MM` offset. [[added,variables_timestamp_added]] | | `ldap_dn` | String | String | Converts any `.` into `,dc=`. For example `domain.com` converts into `domain,dc=com`. | | `lenumber` | Bytes | Number | Convert little-endian encoded input into a number. | | `lfill(width, filler)` | Any | Any | Pads value from left with filler until length is width. Default filler is `0`. | | `list(separator)` | String | String | Converts tab-escaped list into separator separated list. There is no escaping if the value already contains the separator. Defaults to `,`. | | `literal(string)` | None | String | Expands into literally the value. If variable is used, works like lookup. Input is ignored. | | `lookup(name)` | None | String | Lookup var from table. If var is variable, the name is taken from variable's contents. Input is ignored. | | `lower` | String | String | Lowercases input. | | `md5(rounds=number, salt=string)` | Bytes | Bytes | Alias for hash with method md5. | | `regexp(expression, replacement)` | String | String |Performs regular expression replacement using [POSIX Extended Regular Expression syntax](https://www.gnu.org/software/findutils/manual/html_node/find_html/posix_002dextended-regular-expression-syntax.html). Supports up to 9 capture groups. | | `reverse` | Any | Any | Reverse input bytes. | | `rfill(width, filler)` | Any | Any | Pads value to right with filler until length is width. Default filler is `0`. | | `sha1(rounds=number, salt=string)` | Bytes | Bytes | Alias for hash with method sha1. | | `sha256(rounds=number, salt=string)` | Bytes | Bytes | Alias for hash with method sha256. | | `sha384(rounds=number, salt=string)` | Bytes | Bytes | Alias for hash with method sha384. | | `sha512(rounds=number, salt=string)` | Bytes | Bytes | Alias for hash with method sha512. | | `substr(offset, length)` | Any | Any | Extracts a substring out of input and returns it. First character is at offset zero. If offset is negative, starts that far back from the end of the string. If length is omitted, returns everything through the end of the string. If length is negative, leaves that many characters off the end of the string. | | `switch(left, operator, condition1, value1, condition2, value2[, ...][, default])` | String | String | Evaluates given comparison with left variable and returns matching condition value or default. See [conditionals](#conditionals). [[added,variables_switch_added]] | | `switch(operator, right, condition1, value1, condition2, value2[, ...][, default])` | String | String | Evaluates given comparison against pipeline and returns matching condition value or default. See [conditionals](#conditionals). [[added,variables_switch_added]] | | `text` | Bytes | String | Sanitize input into text and clear binary tag. | | `truncate(len, bits=number)` | Bytes | Bytes | Truncate to len bytes, or number of bits. The parameters are mutually exclusive. | | `unbase64(pad=boolean, url=boolean)` | String | Bytes | Base64 decode given input, defaults to pad and not url scheme. | | `unhex` | String | Number | Convert base-16 number to base-10 number. | | `unhexlify` | String | Bytes | Convert hex encoded input into bytes. | | `upper` | String | String | Uppercases input. | | `username` | String | String | Provides user part of user@domain value. | | `safe` | String | String | Don't escape the output of the whole pipeline. This must always be the last filter in the pipeline. This is mainly intended for [[setting,ldap_base]] when the DN comes from a variable. [[added,variables_safe_added]] | ## Global providers Global providers that work everywhere are: | Long Name | Description | | --------- | ----------- | | `date:` | [[deprecated,variables_timestamp_added]] Get a local-time date field, available keys are `year`, `month`, `day`. See [replacements](#time-variables). | | `dovecot:` | Get a distribution variable, see [below](#distribution-variables) for a list of supported names. | | `env:` | Environment variable \. Returns empty string if unset. | | `event:` | Get an event field. Returns empty string if no such field is found from event. | | `process:` | Get a process variable, see [below](#process-variables) for list of supported names. | | `system:` | Get a system variable, see [below](#system-variables) for list of supported names. | | `time:unix` | [[added,variables_timestamp_added]] Returns the current time as a `.` UNIX timestamp. See [below](#time-variables). | | `time:` | [[deprecated,variables_timestamp_added]] Get a local-time field, available keys are `hour`, `min`, `minute`, `sec`, `second`, `usec`. See [replacements](#time-variables). | | `generate:` | Generate a GUID/UUID. Available keys are `guid`, `guid128`, `uuid`, `uuid:record`, `uuid:compact` and `uuid:microsoft`. | ## System Variables ### `cpu_count` Number of CPUs available. Works only on Linux and FreeBSD-like systems. Can be overridden with `NCPU` environment variable. This needs to be included in [[setting,import_environment]]. ### `hostname` Hostname (without domain). Can be overridden with `DOVECOT_HOSTNAME` environment variable. This needs to be included in [[setting,import_environment]]. ### `os` OS name reported by `uname()` call. (Similar to `uname -s` output.) ### `os-version` OS version reported by `uname()` call. (Similar to `uname -r` output.) ## Process Variables ### `pid` Current process ID. ### `uid` Effective user ID of the current process. ### `gid` Effective group ID of the current process. ## Distribution Variables ### `name` Name of distributed package. (Default: `Dovecot`) ### `version` Dovecot version. ### `support-url` Support webpage set in Dovecot distribution. (Default: https://www.dovecot.org/) ### `support-email` Support email set in Dovecot distribution. (Default: `dovecot@dovecot.org`) ### `revision` Short commit hash of Dovecot git source tree HEAD. (Same as the commit hash reported in `dovecot --version`.) ## Time variables ### `unix` Returns the current time as a `.` UNIX timestamp (for example `1749379200.123456789`). This is the starting point for the [`epoch`](#list-of-filters), [`from_epoch`](#list-of-filters) and [`date`](#list-of-filters) filters. These also work on UNIX timestamps coming from any other variable, not just the current time: ``` # Current time as a UNIX timestamp with nanosecond precision: %{time:unix} -> 1749379200.123456789 # Current time in milliseconds: %{time:unix | epoch('ms')} -> 1749379200123 # Format an arbitrary UNIX timestamp variable in UTC: %{mytimestamp | date('%Y-%m-%d %H:%M:%S')} -> 2025-06-08 10:40:00 # ...or in the local timezone: %{mytimestamp | date('%H:%M', 'local')} # Convert a millisecond timestamp from input and format it: %{ms_timestamp | from_epoch('ms') | date('%Y-%m-%d')} # Current time as an ISO 8601 / RFC 3339 string: %{time:unix | iso8601} -> 2025-06-08T10:40:00Z ``` ## User Variables ::: tip See also: * [Global Variables](#global-variables) ::: Variables that work nearly everywhere where there is a username: | Variable | Description | | -------- | ----------- | | `user` | Full username (e.g. user@domain) | | `session` | Session ID for this client connection (unique for 9 years) | | `auth_user` | SASL authentication ID (e.g. if master user login is done, this contains the master username). If username changes during authentication, this value contains the original username. Otherwise the same as `user`. | ## Mail Service User Variables ::: tip See also: * [Global Variables](#global-variables), and * [User Variables](#user-variables). ::: | Variable | Description | | -------- | ----------- | | `service` | imap, pop3, smtp, lda (and doveadm, etc.) | | `local_ip` | local IP address | | `remote_ip` | remote IP address | | `local_port` | local port | | `remote_port` | remote port | | `userdb:` | Return userdb extra field "name". | ## Mail User Variables ::: tip See also: * [Global Variables](#global-variables), * [User Variables](#user-variables), and * [Mail Service User Variables](#mail-service-user-variables). ::: | Variable | Description | | -------- | ----------- | | `home` | home directory. Use of `~/` is better whenever possible. | | `hostname` | Expands to the hostname setting. Overrides the global `hostname`. | ## Login Variables ::: tip See also: * [Global Variables](#global-variables), and * [User Variables](#user-variables). ::: | Variable | Description | | -------- | ----------- | | `protocol` | imap, pop3, smtp, lda (and doveadm, etc.)
[[added,variables_login_variables_protocol]] Renamed from `service` variable. | | `local_name` | TLS SNI hostname, if given. | | `local_ip` | Local IP address. | | `remote_ip` | Remote IP address. | | `local_port` | Local port. | | `remote_port` | Remote port. | | `real_remote_ip` | Same as `remote_ip`, except in proxy setups contains the remote proxy's IP instead of the client's IP. | | `real_local_ip` | Same as `local_ip`, except in proxy setups contains the local proxy's IP instead of the remote proxy's IP. | | `real_remote_port` | Similar to `real_remote_ip` except for port instead of IP. | | `real_local_port` | Similar to `real_local_ip` except for port instead of IP. | | `mechanism` | [[link,sasl]], e.g., PLAIN. | | `secured` | "TLS" with established SSL/TLS connections, "TLS handshaking", or "TLS [handshaking]: error text" if disconnecting due to TLS error. "secured" with secured connections (see: [[setting,ssl]]). Otherwise empty. | | `ssl_security` | TLS session security string. If HAProxy is configured and it terminated the TLS connection, contains "(proxied)". | | `ssl_ja3` | [[link,ssl_ja3]] composed from TLS Client Hello. | | `ssl_ja3_hash` | MD5 hash from [[link,ssl_ja3]] composed from TLS Client Hello. | | `ssl_client_cert_fp` | [[setting,ssl_peer_certificate_fingerprint_hash]] of client certificate. | | `ssl_client_cert_pubkey_fp` | [[setting,ssl_peer_certificate_fingerprint_hash]] of client certificate public key. | | `mail_pid` | PID for process that handles the mail session post-login. | | `original_user` | Same as `user`, except using the original username the client sent before any changes by auth process. With master user logins (also with [[setting,auth_master_user_separator]] based logins),this contains only the original master username. | | `listener` | Socket listener name as specified in config file, which accepted the client connection. | | `owner_user` | For shared storage this is the `user` variable of the owner, otherwise it is the same as `user`.
[[added,variables_owner_user_added]] | | `passdb:` | Return passdb extra field "name". | | `passdb:forward_` | Used by proxies to pass on extra fields to the next hop, see [[link,auth_forward_fields]]. | ## Authentication Variables ::: tip See also: * [Global Variables](#global-variables), and * [User Variables](#user-variables). ::: | Variable | Description | | -------- | ----------- | | `protocol` | imap, pop3, smtp, lda (and doveadm, etc.)
[[added,variables_auth_variables_protocol]] Renamed from `service` variable. | | `domain_first` | For "username@domain_first@domain_last" style usernames.| | `domain_last` | For "username@domain_first@domain_last" style usernames. | | `local_name` | TLS SNI hostname, if given. | | `local_ip` | Local IP address. | | `remote_ip` | Remote IP address | | `local_port` | Local port. | | `remote_port` | Remote port. | | `real_remote_ip` | Same as `remote_ip`, except in proxy setups contains the remote proxy's IP instead of the client's IP. | | `real_local_ip` | Same as `local_ip`, except in proxy setups contains the local proxy's IP instead of the remote proxy's IP. | | `real_remote_port` | Similar to `real_remote_ip` except for port instead of IP. | | `real_local_port` | Similar to `real_local_ip` except for port instead of IP. | | `client_pid` | Process ID of the authentication client. | | `session_pid` | For user logins: The PID of the IMAP/POP3 process handling the session. | | `mechanism` | [[link,sasl]], e.g., PLAIN. | | `password` | Cleartext password from cleartext authentication mechanism. | | `secured` | "TLS" with established SSL/TLS connections, "secured" with secured connections (see: [[setting,ssl]]). Otherwise empty. | | `ssl_ja3_hash` | MD5 hash from JA3 string composed from TLS Client Hello. | | `ssl_client_cert_fp` | [[setting,ssl_peer_certificate_fingerprint_hash]] of client certificate. | | `ssl_client_cert_pubkey_fp` | [[setting,ssl_peer_certificate_fingerprint_hash]] of client certificate public key. | | `cert` | "valid" if client had sent a valid client certificate, otherwise empty. | | `login_user` | For master user logins: Logged in user@domain. | | `master_user` | For master user logins: The master username. | | `original_user` | Same as `user`, except using the original username the client sent before any changes by auth process. | | `passdb:` | Return passdb extra field "name". | | `userdb:` | Return userdb extra field "name". Note that this can also be used in passdbs to access any userdb_\* extra fields added by previous passdb lookups. | | `client_id` | If [[setting,imap_id_retain]] is enabled this variable is populated with the client ID request as IMAP arglist. For directly logging the ID see the [[event,imap_id_received]] event. | | `passdb:forward_` | Used by proxies to pass on extra fields to the next hop, see [[link,auth_forward_fields]]. | | `id` | Internal ID number of the current passdb/userdb. | | `token` | Used OAUTH2 token. This is only present in [[setting,oauth2_fields]]. [[added,variables_oauth2]] | | `oauth2:` | Return oauth2 field "name". This is only present in [[setting,oauth2_fields]]. | ## Conditionals The following operators are supported: | Operator | Explanation | | -------- | ----------- | | `==` | Numeric equality. | | `!=` | Numeric inequality. | | `<` | Numeric less than. | | `<=` | Numeric less or equal. | | `>` | Numeric greater than. | | `>=` | Numeric greater or equal. | | `eq` | String equality. | | `ne` | String inequality. | | `lt` | String less than. | | `le` | String less or equal. | | `gt` | String greater than. | | `ge` | String greater or equal. | | `*` | Wildcard match (mask on value2). | | `!*` | Wildcard non-match (mask on value2). | | `~` | Regular expression match (pattern on value2, [POSIX Extended Regular Expression syntax](https://www.gnu.org/software/findutils/manual/html_node/find_html/posix_002dextended-regular-expression-syntax.html)). | | `!~` | String inequality (pattern on value2, [POSIX Extended Regular Expression syntax](https://www.gnu.org/software/findutils/manual/html_node/find_html/posix_002dextended-regular-expression-syntax.html)). | Dovecot supports two kinds of conditional filters, the `if` and the `switch `filter. The difference is that `if` can be used to do single comparison, and `switch` can do multiple comparisons. ::: warning Nested `if` or `switch` statements will not work. You also cannot chain `if` or `switch` in a pipeline to emulate this. If you need to do complicated `if` or `switch` statements, you should use [[link,auth_lua]] instead. Examples: ``` # If %{user} is "testuser", return "INVALID". Otherwise return %{user} uppercased. %{user | if ("=", "testuser, "invalid", user) | upper } # Select subdomain for tenant postmaster@%{switch(userdb:tenant, 'eq', 'one', 'one.com', 'two', 'two.com', 'default.com')} # Or default to user variable's domain, if it's provided. Note the domain operator at the end since you can't use pipelines in values either. postmaster@%{switch(userdb:tenant, 'eq', 'one', '@one.com', 'two', '@two.com', user) | domain | default('default.com')} # Choose by limit. %{switch(number, '<', 100, 'one', 200, 'two', 300, 'three', 'bigger')} ``` ## Cryptography support ### Parameters | Key | Value | | ------------------ | --------------------------------------------------------------------------------| | key | The encryption key. | | iv | Initialization vector. | | salt | Salt to use in PBKDF2 algorithm. | | hash | Hash to use in PBKDF2. Defaults to `sha256`. | | rounds | Number of rounds to use in PBKDF2. Defaults to 10 000. | | algorithm | Encryption algorithm. Expects OpenSSL naming. Defaults to `aes-256-cbc`. | | raw | When set to 1, will return encrypted result in raw output format. Default is 0. | ### Key, initialization vector and salt. For legacy reasons, this function supports direct keying and salted keying. In direct keying, the `key` and `iv` must be provided hex encoded, and must match the algorithm's requirements. If `key` and `salt` are provided, then the actual encryption key and initialization vector are generated with [PBKDF2 algorithm](https://en.wikipedia.org/wiki/PBKDF2). If only `key` is provided a random salt is generated. Random salt cannot be generated in raw mode, because it would not get stored, so it must be always provided. ### Structured output format Dovecot supports structured encrypted data. If initialization vector is directly provided, the output syntax is `iv$data$`. With salt based keying material generation, the format is `s=salt,r=rounds$data$`. ### Raw output format If raw is used, the raw encryption result is emitted with no salt, rounds or IV included. ### Recommended usage For best results, you should leave salt and IV management to Dovecot. ### Examples ```doveconf[dovecot.conf] import_environment { SECRET_KEY = %{env:SECRET_KEY} } imapc_password = "%{literal('s=3-?I&-a|,r=10000$e80e6ab3c18c0da69b20bf201eaf6269$') | decrypt(key=env:SECRET_KEY)}" ``` Stores imap client password securely so that it can be decrypted only if `SECRET_KEY` environment variable is provided. To easily generate an encrypted value, you can use [[doveadm,user,user -e "%{literal('value') | encrypt(key='secret')}"]]. # All Dovecot Doveadm Commands # All Dovecot Events ## Events ## Event Categories ## Event Reasons # Dovecot RFC Support ::: info This is a non-exhaustive list of RFCs that Dovecot implements/supports. ::: ## Email - Standard for ARPA Internet Text ([[rfc,822]]) - Internet Message Format (updated RFC 822) ([[rfc,2822]]) - Multipurpose Internet Mail Extensions (MIME) (part 1) ([[rfc,2045]]) - Multipurpose Internet Mail Extensions (MIME) (part 2) ([[rfc,2046]]) - Multipurpose Internet Mail Extensions (MIME) (part 3) ([[rfc,2047]]) - Multipurpose Internet Mail Extensions (MIME) (part 4) ([[rfc,2048]]) - Multipurpose Internet Mail Extensions (MIME) (part 5) ([[rfc,2049]]) ## Authentication - Anonymous SASL Mechanism ([[rfc,2245]]) - Using TLS with IMAP, POP3 and ACAP ([[rfc,2595]]) - Using Digest Authentication as a SASL Mechanism (DIGEST-MD5) ([[rfc,2831]]) - Salted Challenge Response Authentication Mechanism (SCRAM) ([[rfc,5802]]) - SCRAM-SHA-256 and SCRAM-SHA-256-PLUS Simple Authentication and Security Layer (SASL) Mechanisms ([[rfc,7677]]) - GSS-API (Kerberos V5) SASL Mechanism ([[rfc,4752]]) - A Set of Simple Authentication and Security Layer (SASL) Mechanisms for OAuth ([[rfc,7628]]) - [Google XOAUTH2 Protocol](https://developers.google.com/gmail/xoauth2_protocol) - Channel Bindings for TLS 1.3 ([[rfc,9266]]) ## POP3 - Post Office Protocol - Version 3 ([[rfc,1939]]) - POP3 Extension Mechanism ([[rfc,2449]]) - Using TLS with IMAP, POP3 and ACAP ([[rfc,2595]]) - The SYS and AUTH POP Response Codes ([[rfc,3206]]) - The Post Office Protocol (POP3) - Simple Authentication and Security Layer (SASL) Authentication Mechanism ([[rfc,5034]]) ## IMAP (Base) - IMAP4rev1 ([[rfc,3501]]) - IMAP4 Multi-Accessed Mailbox Practice ([[rfc,2180]]) - Using TLS with IMAP, POP3 and ACAP ([[rfc,2595]]) - IMAP4 Implementation Recommendations ([[rfc,2683]]) ## IMAP (Extensions) - IMAP4 QUOTA extension ([[rfc,2087]]) - IMAP4 non-synchronizing literals (LITERAL+) ([[rfc,2088]]) - IMAP4 IDLE command ([[rfc,2177]]) - IMAP4 Login Referrals ([[rfc,2221]]) - IMAP4 Namespace ([[rfc,2342]]) - IMAP4 ID extension ([[rfc,2971]]) - IMAP4 Child Mailbox Extension ([[rfc,3348]]) - IMAP4 MULTIAPPEND Extension ([[rfc,3502]]) - IMAP4 Binary Content Extension ([[rfc,3516]]) - IMAP4 UNSELECT command ([[rfc,3691]]) - IMAP4 Access Control List (ACL) Extension ([[rfc,4314]]) - IMAP UIDPLUS extension ([[rfc,4315]]) - IMAP URLAUTH Extension ([[rfc,4467]]) - IMAP CATENATE Extension ([[rfc,4469]]) - IMAP Extension for Conditional STORE Operation or Quick Flag Changes Resynchronization ([[rfc,4551]]) - IMAP4 Extension to SEARCH Command for Controlling What Kind of Information Is Returned ([[rfc,4731]]) - IMAP Extension for Simple Authentication and Security Layer (SASL) Initial Client Response ([[rfc,4959]]) - The IMAP COMPRESS Extension ([[rfc,4978]]) - WITHIN Search Extension to the IMAP Protocol ([[rfc,5032]]) - The IMAP ENABLE Extension ([[rfc,5161]]) - IMAP4 Extensions for Quick Mailbox Resynchronization ([[rfc,5162]]) - IMAP Extension for Referencing the Last SEARCH Result ([[rfc,5182]]) - IMAP Internationalization (I18NLEVEL=1 only) ([[rfc,5255]]) - IMAP SORT and THREAD Extensions ([[rfc,5256]]) - IMAP4 - LIST Command Extensions ([[rfc,5258]]) - Contexts for IMAP4 (ESORT and CONTEXT=SEARCH only) ([[rfc,5267]]) - The IMAP METADATA Extension ([[rfc,5464]]) - The IMAP NOTIFY Extension ([[rfc,5465]]) - Extended URLFETCH for Binary and Converted Parts ([[rfc,5524]]) - IMAP Response Codes ([[rfc,5530]]) - Support for PARTIAL in CATENATE and URLAUTH ([[rfc,5550]], Section 5.7.1) - IMAP4 Extension for Returning STATUS Information in Extended LIST ([[rfc,5819]]) - Display-Based Address Sorting for the IMAP4 SORT Extension ([[rfc,5957]]) - IMAP LIST Extension for Special-Use Mailboxes (SPECIAL-USE only) ([[rfc,6154]]) - IMAP4 Extension for Fuzzy Search ([[rfc,6203]]) - Support for IMAP Events in Sieve ([[rfc,6785]]) - Internet Message Access Protocol (IMAP) - MOVE Extension ([[rfc,6851]]) - IMAP Extensions: Quick Flag Changes Resynchronization (CONDSTORE) and Quick Mailbox Resynchronization (QRESYNC) (updated RFC 4551 and RFC 5162) ([[rfc,7162]]) - IMAP4 Non-synchronizing Literals (updated RFC 2088) ([[rfc,7888]]) - IMAP4 APPENDLIMIT Extension ([[rfc,7889]]) - IMAP Extension for STATUS=SIZE ([[rfc,8438]]) - IMAP4 Extension for Returning MYRIGHTS Information in Extended LIST ([[rfc,8440]]) - IMAP “$Important” Keyword and “\\Important” Special-Use Attribute ([[rfc,8457]]) - IMAP REPLACE Extension ([[rfc,8508]]) - Internet Message Access Protocol (IMAP) - SAVEDATE Extension ([[rfc,8514]]) - IMAP4 Extension: Message Preview Generation ([[rfc,8970]]) - IMAP Response Code for Command Progress Notification ([[rfc,9585]]) ## SMTP/LMTP (Base) - Simple Mail Transfer Protocol ([[rfc,821]]) - Simple Mail Transfer Protocol (updated RFC 821) ([[rfc,2821]]) - Simple Mail Transfer Protocol (updated RFC 2821) ([[rfc,5321]]) - Local Mail Transfer Protocol ([[rfc,2023]]) - Message Submission for Mail ([[rfc,6409]]) ## SMTP/LMTP (Extensions) - SMTP Service Extension for Message Size Declaration ([[rfc,1870]]) - SMTP Service Extension for Returning Enhanced Error Codes ([[rfc,2034]]) - SMTP Service Extension for Command Pipelining ([[rfc,2920]]) - SMTP Service Extensions for Transmission of Large and Binary MIME Messages ([[rfc,3030]]) - SMTP Service Extension for Secure SMTP over Transport Layer Security ([[rfc,3207]]) - Message Submission BURL Extension ([[rfc,4468]]) - SMTP Service Extension for Authentication ([[rfc,4954]]) - SMTP Service Extension for 8-bit MIME Transport ([[rfc,6152]]) ## Dovecot Specific Extensions ### SEARCH=MIMEPART [SEARCH=MIMEPART IMAP Extension](/rfcs/draft-bosch-imap-search-mimepart-00.txt) * Body and Header searches not yet implemented. # All Dovecot Settings ## Settings ## Advanced Settings ::: danger These settings should not normally be changed. ::: # vitepress-plugin-llmstxt Source: https://github.com/angelespejo/vitepress-plugin-llmstxt/ The plugin source is currently hardcoded in this directory, as there are several bugs/limitations that allow the npm plugin to work correctly. If/when all required changes are made to upstream, this hard-coded plugin code can be removed and replaced with the global plugin. ## LICENSE MIT License Copyright 2010 James Halliday (mail@substack.net); Modified work Copyright 2014 Contributors (ben@npmjs.com) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
[Dovecot Pro](https://www.dovecotpro.com/) is a full-service email platform that delivers dynamic scalability, high performance, efficient utilization of hardware, and outstanding support to the world’s largest email providers (such as Telcos, ISP's, Hosters, MSPs, Public Sector, Education).
::: info This site provides documentation and information on the commercial Dovecot Pro product. Documentation for Dovecot Community Edition (CE) can be found at [https://doc.dovecot.org/](https://doc.dovecot.org/). ::: # Dovecot Pro: Product Description Dovecot Pro Version 3.x ("Pro") is a highly-available, distributed, standards compliant email platform designed to handle both message storage and remote message access, that scales to tens of millions of active users. The platform is highly available, can work across multiple physical and/or virtual sites, and provides [[link,sla,SLA support]] options. Pro’s design allows any platform component to be lost, taken offline for maintenance, or upgraded without affecting the overall service availability for an individual end-user. Pro supports distributed storage technologies to securely and reliably provide cost-effective message and mailbox metadata storage. Pro implements the following open email network protocols: * IMAP4 ([[rfc,3501]]; mail/mailbox access) * POP3 ([[rfc,1939]]; legacy mail/mailbox access) * LMTP ([[rfc,2033]]; mail delivery) * ManageSieve ([[rfc,5804]]; centralized mail filtering administration) * Submission ([[rfc,6409]]; subset of SMTP for outgoing mail delivery) * Doveadm ([[link,doveadm,Dovecot administration API]]; binary and HTTP API)
See [[link,rfcs]] for a non-exhaustive list of additional standards that Dovecot implements.
## Scope This page describes Pro in detail, and defines how the software must be used in order to be eligible for SLA support. This document incorporates all content from [the Dovecot Pro website (https://doc.dovecotpro.com/)](/) for support descriptions of any features or concepts that do not specifically appear on this page. If there is a conflict between the information in this page, and the documentation on the rest of this site, this document takes precedence. ## Dovecot Pro Email Platform (Palomar) Pro's exclusive mail platform architecture, the [[link,palomar_architecture,Dovecot Pro Palomar Architecture ("Palomar")]], contains the various components (both Dovecot software and external services) necessary to operate the platform. The customer MUST operate Palomar in the design outlined in this product definition. Dovecot/OX cannot support operation of Pro software via custom configuration and designs. ### Palomar Overview The Palomar architecture comprises [[link,palomar_proxy,Dovecot Pro Proxies ("Proxy")]] and [[link,palomar_backend,Dovecot Pro Backends ("Backend")]], [[link,cluster_controller,Palomar Cluster Controller ("Controller")]], GeoDB, a highly-available shared storage with access to a shared [[link,dictmap]] server, [[link,palomar_ox_abuse_shield,OX Abuse Shield]] (optional), and integration with a customer's identity and authentication databases ([[link,passdb]]/[[link,userdb]]) and external load balancers. Palomar's stateless design enables a highly-available service, in which any of the individual components can be lost, taken offline for maintenance, or upgraded (up to the high availability capacity limitations determined by a customer) without affecting the overall service availability. This high-availability design maximizes both uptime and operational flexibility, allowing for dynamic scalability and zero-downtime maintenance. At any given point in time, a user is routed to a single Backend node in the system, from any connection point at the external boundary of the platform, due to performance and efficiency reasons. However, the user does not "live" on this Backend and may be serviced from any other Backend as time passes. A user's mails should not be accessed simultaneously from multiple Backends in this architecture; the GeoDB and cluster services prevent this from happening. However, even if simultaneous access on multiple Backends did occur, the [[plugin,obox]] mailbox format was designed not to lose any mails or metadata changes in such situation. This self-healing feature introduces some loss of performance when it occurs, due to the need to continually merge index changes between the multiple Backend accesses, which is why Palomar directs a user to a single Backend, no matter the number of incoming connections that a user spawns. In Palomar, users are packaged into "groups". Generally, Palomar actions (such as site rebalancing) are performed on these user groups as opposed to individual users. The Palomar architecture supports multiple sites. "Sites" can be virtual sites hosted within the same data center. Multi-site operations are supported ONLY IF using a multi-site capable storage solution -- currently, only [[link,obox_sproxyd]]. For all intents and purposes, in Palomar, "cluster" is synonym to "site". The Palomar architecture enables both horizontal and vertical scaling. The required network topology is: * **Public (No user data)**: load balancers for network ingress * **Private (no mail data on nodes; requires access to GeoDB)**: Proxy pool(s) with cluster service enabled; Cluster Controller node * **Private (temporary user mail data)**: Backend pool(s) with cluster service enabled; Authentication source(s) - accessed by Proxy and Backends, but is customer specific; GeoDB (Cassandra/CQL) * **Storage Network (permanent user mail data)**: Mail Storage In Palomar, Proxy and Backend nodes run the same core Pro software; local configuration defines the role each system takes. It is HIGHLY recommended to configure the entire platform as a [zero-trust environment](https://en.wikipedia.org/wiki/Zero_trust_security_model); however, the Palomar architecture does not currently require this. #### End Users End users are defined by provisioning their details into userdb/passdb. End users do not live on Palomar machines; they are exclusively virtual users. End users connect to Palomar via mail APIs; there is no shell access to the systems and users are not provisioned on Palomar machines. ## Palomar Components ### External Load Balancer Incoming connections to publicly available services exposed on Proxies should be distributed among all available nodes. Each incoming connection is independent at this level, so there is no requirement to route connections from the same user or external source to a single proxy. Palomar does not require a specific solution at this level, so the choice is up to the customer. Both hardware (e.g. F5) and software (e.g. haproxy) load balancers have been used successfully in customer installations. The load balancers must either be transparent or they must implement the [[link,haproxy,HAProxy Proxy Protocol v2]]. This is so Pro can correctly log and track the end-user's connection telemetry as opposed to that of the load balancer. For software load balancers, this process MUST live on a separate system than Proxies. Palomar does not support running load balancers and Proxies on the same system. ### Dovecot Pro Proxy #### Submission Proxy Pro/Palomar provides an optional submission proxy service that acts as a frontend for any full-featured Mail Transfer Agent (MTA), adding all the necessary functionality for an SMTP Submission service, also known as a Mail Submission Agent (MSA). The submission proxy can fully handle the required SMTP authentication, which allows a single authentication system to be defined in Dovecot for use with all mail storage and delivery protocols. Submission proxying for the submission service works by proxying to a Dovecot Pro Backend, which then relays to a MTA (which is not provided as part of Pro). Proxying directly from the proxy to an MTA is not supported. ### Authentication Systems (passdb/userdb) Pro supports the following systems for authentication/user information: * [[link,auth_ldap]] * [[link,auth_lua]] * [[link,auth_sql]] * static local files ([[link,auth_staticdb]], [[link,auth_passwd_file]], [[link,auth_passwd]]) Operation, administration, and system performance of the [[link,passdb]]/[[link,userdb]] is the responsibility of the customer; Pro only supports maintaining stable API access to the external systems. LDAP is recommended, as experience has shown it has the necessary performance to scale to millions of connections. SQL is supported functionally, but is NOT recommended. At scale, SQL servers cannot handle login loads and will cause noticeable authentication latencies. Dovecot/OX cannot provide support or optimizations for the slow performance. Customer-specific authentication solutions should be developed using Pro's [[link,auth_lua,Lua auth framework]]. Dovecot/OX Professional Services can be engaged to assist in developing custom solutions. If Lua auth is used to connect to an external HTTP-based service, it must use Pro's [[link,lua_lib-lua,Lua http]] functionality. Static (local) files are mainly useful to inject local configuration into the Pro session. It should not be used for specific customer data. It is recommended that all variables should be injected into configuration via Lua (if used) instead of using separate static files, if possible. ### OX Abuse Shield [[link,palomar_ox_abuse_shield]] is an optional component of Palomar that applies authentication policy during user login, via the Proxies. OX Abuse Shield is recommended to be operated in a high-availability setup; it is not required for login though, although authentication policy will be skipped if the service is not available. OX Abuse Shield is not provided as part of the base Pro license; separate licensing is needed for the product. ### Dovecot Pro Backend ### Dovecot Pro Palomar Cluster Controller The Controller is a non-highly available component that performs administrative tasks and automated tasks on cluster state. These tasks include load balancing, health monitoring, and statistics gathering. One Controller node is needed per site. The Controller does not need to be highly available, but platform-level actions will not occur unless the Controller is active. The Controller provides a graphical user interface to the admin API. It also exposes an API to other Palomar nodes for maintenance tasks and user administration. The Controller is connected to the [[link,geodb,GeoDB]] to track user routing inside the Palomar platform. The Controller is installed and instantiated via either Kubernetes and a helm chart or via docker-compose. ::: danger WARNING Cluster Controller is distributed via containers. These containers MUST be used as-is. The contents of the containers MUST NOT be altered. All interaction with the services in the container MUST be performed via documented APIs only. ::: #### Cluster Controller UI Experimental [[link,cluster_controller_ui]] is an optional component providing a web-based GUI for the Cluster Controller API. Cluster Controller UI is currently marked as experimental. The service is provided as assistance to the operator, but as it is not required for Palomar production usage, no SLA support is currently provided. ### GeoDB ### Mail Storage (Supported API/Systems) [[link,palomar_storage]] is generally the most expensive and technically difficult component of an email system, due to the volume and storage capacities needed. As such, it is critically important that the underlying technology is proven to be stable and secure through extensive development, testing, and QA. Therefore, Palomar/Pro only supports a small, defined list of storage technologies. Palomar requires a highly available, distributed storage solution, independent of the Backends, as users must be able to move between nodes in the platform. Data replication MUST be handled by the storage system; Pro does not do data replication itself. #### Storage Systems ##### Premium Support ###### Scality sproxyd
See [[link,obox_sproxyd]].
* Multi-site (geo-redundant) capable solution. * Sizing, setup, and server support is handled by Scality. * Release Notes: specific version of RING tested against will be provided. ###### AWS S3
See [[link,aws_s3]].
* Single AWS region only (multi-availability zones within a single region is OK). * Platform support is handled by AWS. * Customer is responsible for working with AWS to ensure sufficient operational limits (e.g. IOps and ingress/egress limits). * IAM is supported; v2 and v4 signatures. * Documentation: The full list of tested S3 API calls is provided. * Release Notes: The month & year when the AWS S3 service was tested and the active documentation link at that time. ##### Basic Support ###### "AWS S3 compatible"
See [[link,obox_s3_compatible]].
* Uses AWS's S3 implementation as the reference behavior. * "AWS S3 compatible API" is defined as a storage system that complies with the behavior identified and tested as part of Dovecot Pro "AWS S3" Premium Support for that release. ###### Azure Blob Storage * Microsoft Azure blob storage API. * Documentation: The full list of Azure Blob Storage API calls is provided. * Authentication: User SAS (with Entra IDM). * Release Notes: The month & year when the Azure Blob storage service was last tested and the active documentation link at that time. ###### NFS ::: warning NFS SLA Support is not provided as part of the base Dovecot Pro License. A separate SLA Support agreement needs to be negotiated for customers that need NFS support. ::: * Site replication is NFS vendor-specific. * NFSv3 = known to work; NFSv4 = no production knowledge. * NFS system is customer provided and not supported by Dovecot/OX. * Storage/filesystem performance is not guaranteed. * No sizing information on NFS can be provided. If a customer wants sizing information, they should work with a storage vendor that has expertise. ### Mailbox Format Pro's [[plugin,obox,obox mailbox format]] is the ONLY mailbox format supported for production use. No other mailbox is supported for production use. Software support for non-obox mailbox formats is limited to migration, backups, and/or archiving use-cases. Customers using sdbox/mdbox on Pro 2.3 MUST migrate users to obox on Pro 3. There is no support for direct physical mailbox conversion of sdbox/mdbox to obox. ### fs-dictmap For all object storage installations, fs-dictmap is REQUIRED. fs-dictmap is not required for NFS. Dovecot stores and retrieves fs-dictmap information using CQL (Cassandra Query Language). Dovecot/OX recommends and tests Pro releases with CQL protocol version 4. The fs-dictmap database must be configured to be multi-node and highly available. #### Apache Cassandra Dovecot/OX tests at least one version of Apache Cassandra for every Pro release. Dovecot/OX does not support customer configuration or operation of Cassandra. Dovecot/OX may provide Cassandra recommendations, but these are not binding. Support for Cassandra can be pursued through 3rd parties. As part of the Release Notes, the specific version of Cassandra that was tested and confirmed to be working will be provided. #### Other Options Customer can use other solutions that claim compatibility with CQL, but the customer is responsible for determining this compatibility. ::: warning Note Compatibility means full support for the feature set provided by the Apache Cassandra version(s) identified in the Release Notes. For example, AWS Keyspaces does NOT implement certain features provided by Apache Cassandra so it cannot be used with Dovecot Pro. ::: Dovecot/OX cannot provide support for customer configuration or operation of these databases. ### Mail Quota Pro only supports user quota tracking via the [[link,quota_driver_count,"count" driver]] of the [[plugin,quota]]. The count quota backend tracks the quota internally within Dovecot's index files. ### Mail Data Access Dovecot/OX can only support direct mail data access if the customer uses Pro provided APIs (i.e. doveadm commands; scripts shipped with Pro packages). Dovecot/OX CANNOT support direct modification of mail storage, neither for NFS nor object storage solutions. [[man,doveadm-fs]] commands can be used for debugging and fixing as instructed by OX/Dovecot, but not as a method to access mails in production. ### Mail Delivery Palomar only supports mail delivery via LMTP. Dovecot does not provide or directly support any AV/AS solution. Such a solution must deliver mails via LMTP when processing is completed. ### Mail (IMAP) Searching Palomar only supports searching messages via the IMAP protocol if the [[plugin,fts-dovecot]] is used. ## Pro Features ### Dovecot Pro Object Storage Mailbox Format (obox) "obox" is Pro's exclusively supported mailbox format for Palomar. For obox, a user’s mail data is retrieved to a Backend, index and metadata ("metacache") changes occur on that Backend, and this changed data is uploaded back to object storage as needed. In case of a Backend failure, another Backend can continue servicing the user mailbox by downloading the metacache locally onto its server. Although the system is designed to allow users to move between multiple backends, and there is code to support accidental access of the mailbox from two servers at once, this behavior comes with a performance penalty. Thus, Palomar requires that a user must be accessed from a single server and the platform is designed to enable and support this behavior. obox is optimized for cloud technologies by minimizing I/O with the storage. obox tracks which index files have been altered or are needed locally and uploads / downloads them to object storage only as necessary. This usage pattern most efficiently leverages the object storage paradigm, as opposed to a more traditional black storage strategy. While using object storage, a user’s mail indexes are fetched from storage and cached locally. The mail indexes are periodically updated to object storage while the session is active. Once the session either expires or the user logs off, any updated indexes are uploaded to storage. By working with local, cached indexes, Pro provides fast access to the user’s mailboxes while leveraging the advantages that object storage provides for long-term storage needs. obox consists of three major components. The first component is a block-storage native mailbox format. Each message is stored in its own “file” (a discrete object). Mailbox indexes, and other Dovecot user data files, are bundled into separate discrete objects. The second component is a collection of drivers that implement support for various storages, such as S3 and sproxyd. There is additionally a "fscache" driver that implements a local filesystem cache for mail objects. The third component is metadata storage for index files and other metadata, such as Sieve scripts. It synchronizes these files between a local cache and the object storage. ### Dovecot Pro Full Text Search (FTS) When messages are not pre-indexed, IMAP searches fall back on slow sequential searches through all message headers or text. This strategy is slow on block storage and becomes performance prohibitive in a distributed object storage architecture. At the same time, mobile clients are the fastest growing segment for mailbox access. These clients have additional bandwidth limitations like monetary cost and network latency that emphasize the need for an efficient, feature rich server-based search solution. To assist in addressing these concerns, a Pro exclusive indexing and search architecture has been developed. This design is built-in to the Pro software, provides better performance and scaling for large mail volumes, and uses the same storage pool as mail objects. Full text search has the following features: * Indexes can be natively stored in object storage (built-in interoperability with the obox plugin) * Smaller index sizes, compared to legacy search drivers, to improve search performance * Avoid duplication of data by using word stemming and normalization and skipping bad characters * Native integration with Pro software; no third-party software needed * No extra compute nodes needed for search string word stemming and normalization * No separate storage or search nodes needed; scaling and administration can be done at a single level (Backends) instead of across multiple, disparate server farms Pro's standard IMAP SEARCH TEXT/BODY (RFC 3501) parameters use the FTS indexes. Searches of message headers already benefit from Pro's fast message index cache implementation but can also optionally be done from FTS indexes. #### Tika Support Experimental [Apache Tika](https://tika.apache.org/) enables Dovecot to index text in various mail attachments, to improve the user's search experience. Additionally, Tika supports Optical Character Recognition (OCR) which enables certain types of image data (e.g. scanned PDFs, JPEG) to be indexed as well. [[link,tika_support,Tika support in Dovecot Pro]] is currently marked as experimental. The feature is tested as part of the release process, but no SLA support is provided. ### Shared Mailboxes Dovecot Pro supports multiple users connecting to the same underlying mailbox. This is done through configuration of the software. All users with access to a defined mailbox connect to a distinct mailbox on a single Backend, so there may be performance penalties if an excessive number of users concurrently access the same mailbox. Pro does not provide support for administration of user access rights. This is the responsibility of the Customer’s identity management system. ### OX App Suite Integrations For customers that hold both a Pro license and an OX App Suite license, the following cross-stack features are additionally supported as part of Pro. #### Virtual Attachment View This is a proprietary Dovecot Pro plugin ([[plugin,virtual-attachments]]) to list all attachments in a mailbox; OX App Suite UI will display these attachments in a Drive-like format. #### Dumpster Uses Pro's [[plugin,lazy-expunge]]; OX App Suite UI can display this special mailbox to provide customer self-help assistance in retrieving accidentally deleted emails. #### Unified Quota A single quota can be used for both the mail store (Pro) and Drive (OX App Suite). #### iMIP Notifications Pro push notifications (via the [[plugin,push-notification-chronos]]) to OX App Suite middleware when iMIP (iCalendar Message-Based Interoperability, [[rfc,6047]]) attachments are detected in incoming messages. ### ImapTest The [[link,imaptest,ImapTest]] tool is provided to Pro customers as a courtesy. This package/software has absolutely NO support, warranty, or SLA. ## Pro Distribution Channels Pro, with the exception of the Cluster Controller component, is currently provided as packages built for a specified list of operating systems. ### Packages: Operating System Support Pro is only supported on Linux distributions on x86 hardware. The list of distributions supported is listed in the Release Notes for a given Pro release. The product rules for when Operating System support is added and dropped can be found at the [[link,os_support]] page. ### Cluster Controller The Cluster Controller is distributed either via helm charts (for use with Kubernetes) or via execution through docker-compose. ### Kubernetes Other than Cluster Controller, Pro is not currently supported as a Kubernetes deployment. ## Separately Licensed Plugins The following Pro plugins are available for Pro customers, but they require separate/additional licensing: ### intercept The [[link,intercept-framework]] implements lawful interception (LI) facilities, in which targeted users can be monitored by their interaction with the various Dovecot services. Pro supports several lawful interception vendor APIs, including Utimaco and PineApp. ### fts-jp-kuromoji An additional tokenizer for the "fts-dovecot" plugin which utilizes the Atilika Kuromoji tokenizer library to tokenize Japanese text.
See [[link,fts_kuromoji]].
### proxyauth Implements the PROXYAUTH extension for IMAP.
See [[plugin,proxyauth]].
### vault The [[plugin,vault]] stores incoming mail first to a configurable, read-only mailbox location (e.g., "ARCHIVE") and, if that succeeds, to the user’s INBOX. It also adds the IMAP "\Seen" flag to the message. ### sieve-zimbra-compat This package extends Pro's Sieve support for the vendor-specific language extensions used by the Zimbra implementation of Sieve.
See [[plugin,sieve-zimbra-compat]].
# Authentication Penalty ::: info The authentication penalty is disabled by default in Dovecot Pro. It's recommended to use [[link,palomar_ox_abuse_shield]] instead. ::: ## Algorithm ## Problems ## Enabling Authentication penalty tracking can be enabled with: ```doveconf[dovecot.conf] service anvil { unix_listener anvil-auth-penalty { mode = 0600 } } ``` # IMAP Configuration Dovecot was optimized since the beginning to work as an efficient IMAP server. ## Namespaces See [[link,namespaces]]. ## IMAP Extensions ## IMAP Hibernation ### Configuration IMAP hibernation is enabled by default in Dovecot Pro. [[setting,imap_hibernate_timeout]] can be used to adjust the delay before moving users to `imap-hibernate` process. # Login Processes There are two ways to run the login processes: the high-security mode and the high-performance mode. Both are discussed separately below. For explanation on the various settings for services, see [[link,service_configuration]]. ## High-Performance Mode (Pro default) ## High-Security Mode # HAProxy [HAProxy (High Availability Proxy)](https://www.haproxy.org/), is a popular open source software "TCP and HTTP" Load Balancer and proxying solution. It is available as a package on almost all Linux distros. ::: tip Dovecot Palomar does not require any specific load-balancing solution (see [[link,product_description]]). However, HAProxy has been widely deployed in customer installations, and is used internally during testing and QA. ::: ::: warning This page is not intended to be a comprehensive HAProxy manual; it is designed to broadly explain how HAProxy can be used in a Dovecot-specific environment. For more details on HAProxy configuration and operation, please refer to the official [HAProxy documentation](https://www.haproxy.org/). ::: ## Frontends A frontend defines how requests should be forwarded to backends. Frontends are defined in the frontend section of the HAProxy configuration. Their definitions are composed of the following components: * A set of IP addresses and a port (e.g. `10.10.10.1, *:443`) * ACLs * `use_backend` rules, which define which backends to use depending on which ACL conditions are matched, and/or a `default_backend` rule that handles every other case. An example of a front-end: ``` frontend front_dc_pop3 bind :1110 mode tcp default_backend back_dc_pop3 ``` This configures a frontend named `front_dc_pop3`, which handles all incoming traffic on port 1110. This will send all traffic to the backends defined by `back_dc_pop3`. ## Access Control Lists (ACL) In relation to load balancing, ACLs are used to test some condition and perform an action (e.g. select a server, or block a request) based on the test result. This is similar in concept to an if-else snippet where execution takes place based upon the success or failure of a particular block. Use of ACLs allows flexible network traffic forwarding based on a variety of factors like pattern-matching and the number of connections to a backend. Example of an ACL: ``` acl url_stats path_beg /stats ``` This ACL is matched if the path of a request begins with `/stats`. This would match a request of http://10.10.10.1/stats, for example. Here, `url_stats` is just the label given to the pattern. ## TLS Forwarding For Dovecot to recognize that TLS termination has been performed, you need to configure haproxy to use [PROXYv2](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt) protocol with SSL attributes. For example: ``` server s1 127.0.0.1:143 send-proxy-v2-ssl ``` See also: [[link,secured_connections]]. ## Backends A backend is a set of servers that receives forwarded requests. Backends are defined in the backend section of the HAProxy configuration. In its most basic form, a backend can be defined by: * Which load balance algorithm to use (mentioned below) * A list of servers and ports A backend can contain one or many servers. Adding more servers to your backend will generally increase the both the reliability and load capacity of the configured service by distributing the load over multiple servers. Here is an example of a two backend configurations, `back_dc_pop3` and `back_dc_lmtp`, with two servers in each, listening for `pop3` and `lmtp` traffic respectively: ``` backend back_dc_pop3 mode tcp balance leastconn option allbackups server 10.41.1.131 10.41.1.131:110 check inter 5s server 10.41.1.116 10.41.1.116:110 check inter 5s backend back_dc_lmtp mode tcp balance leastconn option allbackups server 10.41.1.131 10.41.1.131:24 check inter 5s server 10.41.1.116 10.41.1.116:24 check inter 5s ``` ## Health Checking HAProxy uses health checks to determine if a backend server is available to process requests. This avoids having to manually remove a server from the backend if it becomes unavailable. The default health check is to try to establish a TCP connection to the server. E.g., it checks if the backend server is listening on the configured IP address and port. ## Sample Configuration HAProxy configured between Dovecot Backends and Scality sproxyd: ``` global log 127.0.0.1 local2 chroot /var/lib/haproxy pidfile /var/run/haproxy.pid maxconn 60000 user haproxy group haproxy daemon stats socket /var/lib/haproxy/stats defaults mode http log global option httplog option dontlognull option http-server-close option forwardfor except 127.0.0.0/8 option redispatch retries 3 timeout http-request 1m timeout queue 1m timeout connect 10s timeout client 1m timeout server 1m timeout http-keep-alive 10m timeout check 10s maxconn 5000 frontend scality_in bind :::81 option forwardfor option httplog default_backend scality_ring # Capture X-Dovecot-Reason, X-Dovecot-Username and # X-Dovecot-Session-Id headers capture request header X-Dovecot-Reason len 40 capture request header X-Dovecot-Username len 40 capture request header X-Dovecot-Session-Id len 70 backend scality_ring balance roundrobin mode http option forwardfor option httpchk default-server inter 30s server 10.10.10.1 10.10.10.1:81 check server 10.10.10.2 10.10.10.2:81 check server 10.10.10.3 10.10.10.3:81 check server 10.10.10.4 10.10.10.4:81 check server 10.10.10.5 10.10.10.5:81 check server 10.10.10.6 10.10.10.6:81 check ``` # Documentation Data ## Data Files This is the raw data (JSON objects) used to create various Dovecot Pro documentation sections and lists. ## LLM Resources This documentation provides Large Language Model (LLM) friendly formats following the [/llms.txt standard](https://llmstxt.org/). These resources provide structured, plain-text Markdown designed for ingestion by AI assistants, coding tools, and LLMs during inference time. ### Site-Wide LLM Files - **[`llms.txt`](/llms.txt)** A curated index of all documentation pages, structured with summary information and direct links to clean Markdown versions of each page. - **[`llms-full.txt`](/llms-full.txt)** A single aggregated text document containing the full concatenated content of all documentation pages, optimized for loading the entire site into an LLM context window at once. ### Page-Specific Markdown Every page on this site has a corresponding clean Markdown version (`.md`). # Dovecot FTS Tika Support Experimental Dovecot Pro can use [Apache Tika](https://tika.apache.org/) to index text in various mail attachments to improve the user's search experience. Additionally, Tika supports Optical Character Recognition (OCR) which enables certain types of image data (e.g. scanned PDFs, JPEG) to be indexed as well. ## Configuration ### Apache Tika Software #### Docker Dovecot Pro provides a pre-built Apache Tika OCI container that contains the necessary indexing service. This container includes the necessary components to perform OCR. These containers are located in the Open-Xchange Container Registry. ##### Access Instructions 1. Authenticate to registry.open-xchange.com ```console docker login registry.open-xchange.com ``` 2. Pull the image. ```console docker pull registry.open-xchange.com/dovecot-pro/apache-tika:latest ``` 3. Example command to run the container: ```console docker run -d -p 9998:9998 registry.open-xchange.com/dovecot-pro/apache-tika:latest ``` See [Custom Config](https://github.com/apache/tika-docker?tab=readme-ov-file#custom-config) for instructions on how to configure the Tika container. #### Dovecot Configuration Add [[setting,fts_decoder_tika_url]] to the Dovecot configuration: ```doveconf[dovecot.conf] fts_decoder_driver = tika fts_decoder_tika_url = http://example.com:9998/tika/ ``` ### Scaling Tika acts as a microservice, and each request from Dovecot is independent. Therefore, Tika can be scaled horizontally by adding more nodes. The customer will need to provide the service to distribute requests between the various Tika nodes. Dovecot should then be configured to point to this distribution endpoint. ### Security By default, the Tika container exposes its service via an unsecured HTTP port. The customer will need to provide TLS protection if the service needs to be secured. [[setting,fts_decoder_tika_url]] supports https URLs. ## Tika License The Tika container is provided under the terms of the [Apache License v2.0](https://github.com/apache/tika-docker/blob/main/LICENSE). # Dumpster Configuration ::: tip "Dumpster" is an Open-Xchange proprietary App Suite feature that will list messages stored in a single Dovecot Lazy Expunge mailbox. ::: This config moves the last copy of a message, when deleted, to a hidden `EXPUNGED` mailbox. Messages in the `EXPUNGED` mailbox will be automatically expunged after 7 days. Messages in `EXPUNGED` will not count toward the quota limit. The `EXPUNGED` mailbox will NOT be visible to hosts connecting on any IP other than 127.0.0.2 (App Suite should connect to Dovecot on this address so that `EXPUNGED` can be displayed by the Dumpster UI view). ::: code-group ```doveconf[dovecot.conf] namespace inbox { mailbox EXPUNGED { autoexpunge = 7d # Hide EXPUNGED by default acl owner { rights = ip } quota_ignore = yes } } mail_plugins { lazy_expunge = yes } lazy_expunge_mailbox = EXPUNGED lazy_expunge_only_last_instance = yes protocol imap { mail_plugins { acl = yes } } acl_driver = vfile ``` ::: # Object storage server emulator Dovecot has an object storage emulator called `fs-server`. It can be used to emulate Scality sproxyd. S3 is not currently supported. This tool is not intended for production use. This can be ran as part of any Dovecot deployment, but for best results, you should use a dedicated instance for this. ## Configuration First configure the storage location: ```doveconf[dovecot.conf] fs_server { fs metawrap { } fs posix { autodelete_empty_directories = yes prefix=/var/fsserver/ } ``` Then you can configure the listener. For sproxyd, use ```doveconf[dovecot.conf] service fs-server { inet_listener sproxyd { port = 801 } } ``` To configure a backend to use sproxyd, configure ```doveconf[dovecot.conf] obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } #lock_path = /tmp # Set only without lazy_expunge plugin } fs sproxyd { } } metacache { fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } } fs sproxyd { } } ``` Note that sproxyd needs [[link,dictmap]] to work. Files are stored as-is into the specified directory. ### Debugging To enable debugging, add ```doveconf[dovecot.conf] service fs-server { executable = fs-server -D } ``` # Testing with ImapTest The core [[link,testing,testing page]] lists various methods of testing a Dovecot installation, including with [ImapTest](https://dovecot.github.io/imaptest/). As a benefit to Pro customers, ImapTest packages are provided for all supported OS distributions. ::: warning These ImapTest packages are provided as a convenience to Pro customers. There are no [[link,sla,SLA]] guarantees regarding this package, as ImapTest is unrelated to production use. If an issue is found with ImapTest, customers may file tickets through the Open-Xchange Support process at a "Severity 4" level. The Dovecot team will make best efforts to fix the issue. ::: # Shared Mailboxes in Dovecot Pro As mentioned in [[link,palomar_architecture]], you can't have multiple servers accessing the same user at the same time or it will lead into trouble. This can become problematic with shared mailboxes, because two users who are sharing a folder may run in different servers. The solution is to access the shared folders via IMAP protocol, which passes through the Dovecot proxies so the actual filesystem access is done only on a single server. ![Accesses to shared mailboxes via imapc](./images/imapc.drawio.svg) ## Configuring User-shared Folders You'll need to setup master user logins to work for all the users. The logged in user becomes the master user. The master user doesn't actually have any special privileges. It's just used to get ACLs applied correctly using permissions of the master user (the logged in user). It is supported to access shared mailboxes of users which live on other backends via the IMAP protocol. For this purpose shared mailboxes in a cluster must be accessed via another namespace which has [[setting,mail_driver]] configured to use `imapc`. It is recommended to disable shared namespaces for master users so you should add `userdb_namespace/shared/disabled=yes` to your master passdb as a [[link,passdb_extra_fields]]. Depending on the authentication configuration, it may be necessary to also override the [[setting,acl_user]] via [[link,userdb_extra_fields]] like: `userdb_acl_user=%{auth_user}`. Mailboxes in the shared namespace can be accessed using the given namespace prefix. For example the user `someone1` could have access to a mailbox(`shared_mailbox`) owned by the user `someone2`. To access mails in this mailbox `someone1` would access a mailbox with the name `shared/someone2/shared_mailbox`. The permissions which are given to `someone1` on this mailbox are determined by [[plugin,acl,ACLs]]. Example: ```doveconf[dovecot.conf] namespace shared { type = shared prefix = shared/$user/ list = children # Prevent subscriptions from being shared between users subscriptions = no mail_driver = imapc mail_path = ~/shared/%{owner_user} # Use private indexes to enable per-user \Seen flags: mail_index_private_path = ~/shared-pvt/%{owner_user} } ``` ::: info Obox relies on having the [[setting,mail_index_private_path]] configured to `~/shared-pvt`. Otherwise the private indexes are not tracked by metacache and can get lost if user changes backends. ::: ::: info See [[link,shared_mailboxes_user,shared mailbox expansion documentation]] for an explanation more details on the used variables. ::: Additionally imapc must be configured accordingly on the backends: * On backends either passdb or userdb for non-master users must return `userdb_imapc_master_user=%{user}` or [[setting,imapc_master_user,%{user}]] * [[setting,imapc_master_user]] becomes set using userdb. In case of a simple setup [[setting,imapc_master_user]] can also be just set to `%{user}` (the logged in user). * [[setting,imapc_password]] must be set to the master password which is configured on all backends and proxies * [[setting,imapc_host]] must point to a load balancer's address that connects to Dovecot Proxy * [[setting,imapc_features]] is recommended to have `send-id` with the Proxy's [[setting,login_trusted_networks]] containing backends' IPs. This way session IDs can be tracked across IMAP connections. ```doveconf[dovecot.conf] imapc_host = proxy-load-balancer imapc_ssl = imaps # This %variable will be automatically filled with the destination username. #imapc_user = %{owner_user} imapc_password = master-secret imapc_features { send-id = yes } ``` The [[plugin,acl]] must be loaded and configured: ```doveconf[dovecot.conf] mail_plugins { acl = yes } acl_driver = vfile acl_sharing_map { #dict ... { #} } namespace shared { acl_ignore = yes } # In order to be able to issue ACL commands over imap, imap_acl must be loaded protocol imap { mail_plugins { imap_acl = yes } } ``` The ACL plugin must be told to ignore the shared namespace and all its children using the [[setting,acl_ignore,yes]] setting. The shared dictionary needs to be accessible from all the backends. The possibilities are: | Dictionary Type | Description | | --------------- | ----------- | | `file` | A single shared file in filesystem. This becomes a performance bottleneck easily if there are many in a shared filesystem. | | `fs posix` | Shared directory in filesystem. This will create many small files in a shared filesystem. | | `sql` | Shared SQL server | | Other [[link,dict,shared dictionaries]]] | See [[link,shared_mailboxes_listing]] | ## Shared Folders and Quota Quota is automatically handled for shared namespaces without any explicit configuration. See [[plugin,quota]] for more details. ## Example Configuration The following snippets show important configuration parts for configuring cluster wide sharing of mailboxes. The following snippets are not complete configuration. ### Dovecot Proxy Configuration ```doveconf[dovecot.conf] passdb { driver = static master = yes fields { proxy = y } args = password=imapcpass } passdb { driver = static args = proxy=y password=masterpass } ``` ### Dovecot Backend Configuration ```doveconf[dovecot.conf] mail_plugins { acl = yes } imapc_host = imapc_password = imapcpass mail_shared_explicit_inbox = yes imapc_user = %{owner_user} namespace shared { type = shared prefix = shared/$user/ separator = / list = children subscriptions = no mail_driver = imapc mail_path = ~/shared/$user mail_index_private_path = ~/shared-pvt/%{owner_user} } namespace inbox { inbox = yes } passdb { # masterpass is the normal users master password args = password=masterpass userdb_imapc_master_user=%{user} driver = static } passdb { driver = static master = yes # imapcpass is the master password used for master logins (via imapc) args = password=imapcpass userdb_namespace/shared/disabled=yes userdb_acl_user=%{auth_user} } dict_server { # Any shared dictionary is suitable, this is just an example using mysql dict acl-mysql { driver = sql sql_driver = mysql dict_map shared/shared-boxes/user/$to/$from { sql_table = user_shares value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } dict_map shared/shared-user-boxes-rev/$from/$to { sql_table = user_shares value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } dict_map shared/shared-boxes/anyone/$from { sql_table = anyone_shares value_field dummy { } key_field from_user { value = $from } } } } acl_driver = vfile namespace shared { acl_ignore = yes } acl_sharing_map { dict proxy { name = acl-mysql } } protocol imap { mail_plugins { imap_acl = yes } } #mail_plugins { # quota = yes #} #quota "User storage" { # quota_storage_size = 1G #} ``` # Virtualized Dovecot Pro Architecture ::: warning This page is not intended to accurately indicate sizing information for any given Dovecot Pro installation. Since each server site is unique, only the operator/admins at that site can properly determine the best sizing and performance parameters. ::: Dovecot Pro can be run directly on physical hardware or virtualized using various virtualization technologies. We have customers using OpenStack, KVM, VMware and others. Dovecot Pro is agnostic to the underlying virtualization technology used, as long as there is no overcommitment of resources (see below). Dovecot Pro Palomar architecture contains 2 layers: * Proxies * Backends In physical machine based hosting there are usually number of CPUs per each instance type. Sample configuration used in this article which is based on the needed concurrent connections of a sample use case. | 2 layer architecture | Instances | CPU Cores | Total cores | | -------------------- | :-------: | :-------: | :---------: | | Proxy | 3 | 4 | 12 | | Backend | 8 | 8 | 64 | | Total | 11 | 12 | 76 | ## No Over Commitment of Resources Dovecot does not benefit from over allocating of resources and that should be avoided to avoid random errors in the system. This means if Dovecot is configured to run on 4 cores, there should be 4 cores available for Dovecot. The same applies to RAM: running out of RAM will happen and lead to random errors if the visible RAM is over allocated on [host OS](https://en.wikipedia.org/wiki/Virtual_machine) and not available for Dovecot running on [guest OS](https://en.wikipedia.org/wiki/Virtual_machine). Dovecot cares about the CPU cores, but the cores can be [hyper-threaded](https://en.wikipedia.org/wiki/Hyper-threading) cores. They don't have to be physical cores if hyper threading is enabled and supported by the guest OS, although performance with HT cores may not be the same as with a standalone core. Overall in virtual environments, more smaller virtual machines is recommended over few larger machines. These smaller machines might not be economical in physical servers, but are useful for virtualized hardware where several virtual machines can be combined together to utilise a single physical host. ## Proxy Virtualization Proxy layer sizing for physical servers: 2-4 cores per instance. As 2 core physical machines are rare nowadays on servers, proxies are ideal targets for virtualization. Typically on physical servers 4 cores are used if SSL is offloaded from IMAPS to IMAP on the proxies. In many customer projects, SSL is offloaded on the physical Load Balancer, which leaves the proxy infrastructure to Dovecot proxy use. Proxy layer can be expanded by adding CPUs and RAM therefore e.g. assigning multiple login processes, one per CPU core, utilising the extra cores on the system. The proxy layer can also be expanded by adding more instances of proxy nodes which is easy in virtualized environments. ### Virtualized Proxy Sizing As an example if the concurrent connections require 3 instances of 4 CPU proxies it's better to have 12 single core proxy instances than 3 instances of 4 core proxies. Unless specifically configured the proxy does not utilise the additional cores for login process which is one of the main processes on proxy. If any of the proxy nodes needs to be taken offline from production for e.g. OS upgrade, the effect is only 1/12 = 8,3% in the case of 12 single core proxy instances and 1/3 = 33,3% if there are 3 instances of 4 core proxies. ## Backend Virtualization Backend layer sizing for physical servers: 4-8 cores per instance. As the backend is automatically spreading the load on all CPU resources available, it will be more efficient to add more cores to backend instances than to other nodes. Backend layer can be expanded by adding CPUs and RAM therefore expanding the throughput of the backend node. below. The backend layer can also be expanded by adding more instances of backend nodes which is easy in virtualized environments. ### Virtualized Backend Sizing Backends are doing all the heavy lifting and in the case of using object storage as the storage for emails and indexes, backends need fast IO capable preferably local [ephemeral storage](https://en.wikipedia.org/wiki/Persistent_data_structure), which needs to be existing for the duration of the virtual instance. No actual damage is done if the local fscache or metacache is wiped. Fscache consists of temporary cache of individual mail files which are cached as some clients are requesting larger mails in parts. Caching the entire mail mean less IO to object storage. Metacache in turn is the indexes and metadata which can be recovered from the object storage in the case of new virtual machine or new user login - or a new mail delivery - to a user whose data is not cached on the backend yet. Same principle applies for backends as is true for proxies as well: smaller instances are better than larger instances as the maintenance operations are then less disruptive if there are more smaller nodes. As an example if the concurrent connections sizing require 8 instances of 8 core backends, it's better to have 16 instances of 4 core backends. In the case of 8 instances the hit of e.g. OS upgrade is 1/8 = 12,5 %, but in the case of 16 instances of 4 CPUs only 1/17 = 6.3% per node which needs to be upgraded. There is not necessarily advantage to break the backends into small 2 core instances as backends can utilise well the available CPU cores. ## Sizing Virtual Machines The general rule of thumb is to optimize for more smaller virtual instances than aggregating less instances with more capacity per instance. This makes the maintenance operations less disruptive to end users as there are less users being affected in any eventual guest OS maintenance. ## Allocating Virtual Instances on Physical Machines It is advisable to not collect the same role to same physical machine. In other words not all proxies should be running on same physical node, but the physical node should have different Dovecot roles assigned to it. Recommendation is to collect Proxy and Backend to same physical machine. If the space allows (in terms of CPUs and RAM) there could be multiple times the same set per physical machine. As an example using the same sizing of nodes as before, single physical machine could be sharing: | 2 layer architecture | Instances | CPU Cores | Total cores | | -------------------- | :-------: | :-------: | :---------: | | Proxy | 2 | 3 | 6 | | Backend | 4 | 4 | 16 | | Total | | | 22 | If the sample physical server has 24 cores, it leaves 2 cores for hypervisor. Using 4 physical machines, equalling in total 88 needed cores to as in the beginning, total of 96 cores are used as it's likely more economical sizing. When using set of 4 equally configured physical hosts, loosing a single host server means loosing 1/4 = 25% of the concurrent sessions which Dovecot will balance to other existing machines. This 25% is quite a lot, but should not be a likely scenario in any case with highly available modern server hardware. # Dovecot Pro: Getting Started This page provides an overview of how to set up and configure a basic, minimal Dovecot Pro Palomar system. It is designed to help system administrators become familiar with the Palomar architecture and the various Dovecot features, systems, and software packages required for this purpose. ::: danger IMPORTANT It is the responsibility of Dovecot Pro administrators to design and build a configuration tailored to their specific use case, rather than re-using a generic template. For this reason, quick-start "sample configurations" are not provided. This page should provide all information needed to create this initial configuration to fit your local environment. Contact [[link,sla,Open-Xchange Support]] if you have questions during your initial configuration process. ::: ## Dovecot Pro and Palomar **The single most important page to read and understand is the [[link,product_description]].** Read it carefully — then read it again. The product description page describes the various components of Dovecot Pro, as well as the Palomar architecture. Once you're familiar with the concepts described on that page, you'll be equipped with the knowledge to configure your local installation and interpret the guidance presented on this page. ### Palomar Architecture Next, review [[link,palomar_architecture]] to understand Palomar, the architecture at the core of Dovecot Pro 3.x. ### Release Notes Finally, read the [[link,release_notes]] for (at least) the latest Dovecot Pro release. The Release Notes serve as the official source for information on changes and improvements in new versions. Even if some details seem unfamiliar now, reading them early in your educational process will help you get used to the types of updates included in future releases. These notes often contain essential updates requiring your attention. The Dovecot team carefully curates this information to ensure it is valuable to admins and it serves as the primary knowledge base for the product's evolution. ## Prerequisites ### External Services You must setup and populate your user database for authentication. For mail delivery, ensure that SMTP services are available for inbound and outbound mail delivery. Spam and antivirus (AV/AS) filtering are handled in these systems. If you are deploying virtual machines, confirm adequate resource availability. ### Package Repositories Install Dovecot Pro from the repository configured for your OS. See the repository configuration section in the [[link,release_notes]] for setup instructions. ### Cassandra Cluster A Cassandra cluster is required for Palomar's [[link,geodb]] and [[link,palomar_storage_dictmap]] services. You will need at least three nodes for a highly-available Cassandra cluster. See [[link,dovecot_pro_cassandra]] for deployment guidance. ### Hardware Requirements ::: warning These are not sizing guidelines, but rather minimum required resources. These sizing recommendations reflect typical historical customer usage, often influenced by the sizes of available VMs in local environments. It is possible to size components larger or smaller based on the deployment resources - there is no required sizing for any Dovecot component. For sizing tailored to your local environment, [[link,professional_services]] are available to assist. ::: A minimum Palomar installation requires the following Dovecot Pro provided components: * one Dovecot Pro Proxy * two Dovecot Pro Backends * one Dovecot Pro Cluster Controller container These components may run on virtual machines. You will require at least three nodes for a highly-available Cassandra cluster. For storage hardware requirements, consult your storage provider's documentation or support. #### Proxy Each Proxy should have *at least* 4 CPU cores and 4 GiB of memory. #### Backend Each Backend should have *at least* 4 CPU cores and 32 GiB of memory. Additionally: * [[link,obox_metacache,metacache]]: *at least* 100 GiB disk space * [[link,obox_fscache]]: 10 GiB disk space * [[link,palomar_backend_fts,Dovecot Pro Full Text Search (FTS)]] fs-cache: 10 GiB disk space ### Supported Operating Systems See [[link,os_support,supported operating systems]] for the rules governing Operating System (OS) version support in Dovecot Pro releases. The supported OS versions for a specific release are listed in the [[link,release_notes]]. ### Required System Users Dovecot packages automatically create the required `dovenull` and `dovecot` user accounts. An additional account for temporary user data is also required; typically `vmail`, which is assumed for this documentation. User overview: * `dovenull`: used for login processes * `dovecot`: used for Dovecot internal processes * `vmail`: used for user mail access Distinct system users with distinct privileges are required for security. See [[link,system_users_used_by_dovecot]]. ### Network Connectivity and Firewall Rules Ensure Proxies are directly accessible to end users and are placed behind transparent load balancers as described in the [[link,product_description]]. Proxies MUST be able to: * Connect to all local-site Backends * Access the Cassandra database used for [[link,geodb]] * Communicate with Proxy pools in other sites (for multi-site configurations) Backends MUST be able to access: * [[link,palomar_storage,storage provider]] * Cassandra database for BOTH [[link,geodb]] and [[link,palomar_storage_dictmap]] Proxies and Backends MUST be able to access your [[link,userdb]] and [[link,passdb]] for user authentication and configuration retrieval. Cluster Controller MUST be able to access Cassandra for [[link,geodb]]. #### Firewall Rules ::: info This table lists the default ports for ALL Dovecot Pro services. Local configurations may differ. ::: | Application | Direction | Port | Explanation | | ----------- | --------- | ---- | --------------------- | | Proxy | Inbound | 110 | POP3 access, STARTTLS | | Proxy | Inbound | 143 | IMAP access, STARTTLS | | Proxy | Inbound | 465 | Submission service, SSL | | Proxy | Inbound | 587 | Submission service, STARTTLS | | Proxy | Inbound | 993 | IMAP access, SSL | | Proxy | Inbound | 995 | POP3 access, SSL| | Proxy | Inbound | 4190 | ManageSieve, STARTTLS | | Proxy | Outbound | 110 | POP3 to backend | | Proxy | Outbound | 143 | IMAP to backend | | Proxy | Outbound | 587 | Submission service to backend | | Proxy | Outbound | 4190 | ManageSieve to backend | | Proxy | Outbound | 9042 | Cassandra access | | Proxy | Outbound | 9142 | Cassandra access, SSL | | Backend | Inbound | 110 | POP3 access | | Backend | Inbound | 143 | IMAP access | | Backend | Inbound | 587 | Submission service | | Backend | Inbound | 4190 | ManageSieve access | | Backend | Outbound | 9042 | Cassandra access | | Backend | Outbound | 9142 | Cassandra access, SSL | | Cluster Controller | Inbound | 8443 | Management API | | Cluster Controller | Outbound | 9042 | Cassandra access | | Cluster Controller | Outbound | 9142 | Cassandra access, SSL | ::: info Storage Consult your storage vendor for required storage access ports. ::: ### Time Synchronization Dovecot REQUIRES synchronized time across all components. Use a time sync service such as `systemd-timesyncd` or `ntpd` to avoid issues like [[link,error_time_moved_backwards]]. See [[link,time_synchronization]]. ## Dovecot Pro Components With your understanding of Dovecot Pro and the prerequisites in place, you're ready to begin installing and configuring each Dovecot Pro component. This guide outlines one suggested path — installing and configuring components individually. *This is a suggestion, not a requirement.* Broader Dovecot concepts (e.g., configuration syntax, repository setup) are introduced once and assumed throughout. This guide assumes Dovecot Pro will handle IMAP and LMTP traffic. Support for additional protocols is out of scope. ::: info NOTE This guide describes configuration of a single Palomar site. Multi-site setups are out of scope. ::: ### Proxy and Backend Shared Configuration Dovecot is configured via `/etc/dovecot/dovecot.conf`. Configuration can be centralized in this file (RECOMMENDED for clarity and ease of support) or split into multiple included files. See [[link,settings_syntax]] for syntax details. ::: tip Use [[man,doveconf]] to inspect how Dovecot has actually parsed the configuration, helpful if it seems like some change isn't effective. ::: ::: danger IMPORTANT All Dovecot configurations MUST include: * [[setting,dovecot_config_version]] as the first setting * [[setting,dovecot_storage_version]] ::: See [[link,summary_settings]]. #### Logging See [[link,logging]] for logging configuration. #### Service Configuration Service settings, including process limits and session reuse, are controlled via the [[setting,service]] configuration. Dovecot Pro defaults to high-performance service settings. Modifications to this mode are typically unnecessary. See [[link,service_configuration]] for more details. #### Statistics and Metrics Dovecot exports internal [[link,event_design,events]], referred to as "metrics". You can configure which metrics to expose via [[link,event_filter]]. To enable default metrics: ```doveconf[dovecot.conf] @metric_defaults = proxy # For Proxy @metric_defaults = backend # For Backend ``` For further details, see [[link,stats]]. ##### OpenMetrics To enable [OpenMetrics](https://openmetrics.io/) support, configure an [[setting,inet_listener]] for the stats service: ```doveconf[dovecot.conf] service stats { inet_listener http { port = 9900 } } ``` ##### Events Export You can export events using [[setting,event_exporter]]. See [[link,event_export]] for details. ```doveconf[dovecot.conf] # Create a JSON log exporter event_exporter log-export { driver = log format = json time_format = rfc3339 } # Export the metacache_user_clean_finished metric which is part of # @metric_defaults=backend using the log-export configured above. metric metacache_user_clean_finished { exporter = log-export } ``` #### Security Best Practices ::: warning This is a non-exhaustive list of security considerations. ::: ##### Networking / Listening Ports * [[setting,listen]]: Configures listening IP addresses * [[setting,login_trusted_networks]]: Defines trusted IP addresses. * Backends must trust IP addresses of local site Proxies. In multi-site environments, Proxies must trust connections from remote site Proxies. ##### Authentication Avoid using [[setting,auth_allow_cleartext]], which allows insecure authentication from any source. Instead, restrict plaintext authentication to trusted networks using [[setting,login_trusted_networks]] and enforce TLS-secured connections between all nodes. ##### Storing Secrets Passwords and secrets should be stored in root-readable-only files. Typically `dovecot.conf` is world-readable. Although it could be set readable only by root, this might cause issues in some situations, such as trying to execute [[man,dovecot-lda]] or [[man,doveadm]] as non-root. Instead, store secrets via environment variables. For example, to store the authentication master password for a Backend: ```doveconf[dovecot.conf] passdb static { fields { password = $ENV:MASTER_PASSWORD } } ``` To securely set the environment variables, use the `Environment` setting in a systemd drop-in file, which is readable only by root. See the [systemd documentation](https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html). Alternatively, include a root-readable file: ```doveconf[dovecot.conf] !include_try dovecot-secrets.conf ``` If unreadable, this inclusion is silently skipped. ### Proxies #### Installation Proxies are configured as part of the base Dovecot software. ##### Required Dovecot Packages ::: warning Proxies must understand proxying-related Dovecot features, especially `doveadm` commands. Thus, packages like FTS are required even if the Proxy itself does not process mail. ::: Install Dovecot Pro from the repository listed under your OS in the [[link,release_notes]]. Minimum required package list: ``` dovecot-pro-core dovecot-pro-cassandra-plugin dovecot-pro-cluster dovecot-pro-fts dovecot-pro-imapd dovecot-pro-lmtpd dovecot-pro-lua dovecot-pro-obox dovecot-pro-pigeonhole ``` #### Configuration ::: info See the [Proxy and Backend Shared Configuration](#proxy-and-backend-shared-configuration) section above for general Dovecot requirements. ::: ##### Proxy Authentication Authentication configuration — generally tied to an installation's existing IDM and user databases — is often the most complex part of a Dovecot setup. ::: warning NOTE Dovecot Pro does not provide IDM or user databases. The customer must supply these systems. Dovecot Pro is designed only to integrate with these systems. ::: See: * [[link,authentication]]: Overview of Dovecot authentication * [[link,passdb]]: Databases that authenticate users * [[link,userdb]]: Not used by Proxies * [[link,auth_caching]] * [[link,palomar_ox_abuse_shield]] Dovecot natively supports a variety of authentication databases (e.g., [[link,auth_ldap]]). If local authentication requires an unsupported database, or requires customization for the local environment, the [[link,auth_lua]] driver should be used. ###### Proxying to Backends [[link,passdb]] must return the `proxy=yes` extra field and specify how to authenticate to Backends. There are two supported methods: ##### Cluster See [[link,palomar_proxy_configuration]] for configuring Palomar for Proxy, including the monitoring users. ##### Doveadm [[link,doveadm]] is a useful protocol for executing Dovecot administration commands. Some of these are "mail commands" that work on user data. The cluster service also executes some of these commands internally. If these commands are run on the proxy, they are automatically proxied to the user's correct backend. See [[link,palomar_doveadm]]. To expose commands via HTTP, refer to [[link,doveadm_http_api]]. ##### HAProxy If HAProxy (or compatible load balancer) is used in front of the Proxies, see [[link,palomar_configuration]] for necessary trust configuration. ##### Mail Plugins Some mail plugins offer doveadm commands that can be proxied to Backends. Enable these commands on Proxies by loading the plugins: [[setting,mail_plugins,obox quota fts fts_dovecot]] ##### Protocols Configure enabled protocols: [[setting,protocols,imap pop3 lmtp submission managesieve]] ##### LMTP By default, Dovecot Pro's LMTP service listens on port 24. ##### Cassandra & GeoDB See [[link,palomar_configuration_geodb]]. ##### SSL/TLS Configuration See [[link,ssl]] for configuring SSL/TLS on Proxies. ### Backends #### Installation Backends are also configured as part of the base Dovecot Pro software installation. ##### Required Dovecot Packages Install Dovecot Pro from the repository listed under your OS in the [[link,release_notes]]. Minimum required package list: ``` dovecot-pro-core dovecot-pro-cassandra-plugin dovecot-pro-cluster dovecot-pro-fts dovecot-pro-imapd dovecot-pro-lmtpd dovecot-pro-lua dovecot-pro-obox dovecot-pro-pigeonhole dovecot-pro-sqlite ``` #### Configuration ::: info See the [Proxy and Backend Shared Configuration](#proxy-and-backend-shared-configuration) section above for general Dovecot requirements. ::: ##### Authentication Backend authentication is determined by how the Proxy is configured to authenticate against the Backend. See [Proxy Authentication](#proxy-authentication). See also: * [[link,authentication]]: Overview of the authentication system * [[link,passdb]]: Databases that authenticate users * [[link,userdb]]: Returns mostly extra (user-related) fields * [[link,auth_caching]] ##### Palomar (Cluster) Refer to [[link,palomar_backend_configuration]] for configuring Palomar for the Backend role. ::: tip Remember to configure the monitoring users and userdb extra fields. ::: ##### Doveadm See [[link,palomar_doveadm]] for how to configure doveadm for Backends. ##### FTS Settings Full Text Search (FTS) configuration details are available at: * [[link,palomar_backend_fts]] * [[plugin,fts-dovecot,Guide to configure fts-dovecot]] ##### Mail Settings For more details please refer to [[link,obox_configuration]]. Key settings include: * [[setting,mail_home]] * [[setting,metacache_max_space]] ##### Mail Plugins Dovecot Pro relies heavily on its plugin system. The following plugins are mandatory for Dovecot Pro: ```doveconf[dovecot.conf] mail_plugins = obox fts fts_dovecot ``` To view all available plugins, see the "Dovecot Core -> Plugins" and "Pro Plugins" lists in the documentation sidebar. ###### Quota To prevent excessive storage usage by end users, it is recommended to configure a quota. See [[plugin,quota]] for details. ##### Protocols Configure enabled protocols: [[setting,protocols,imap pop3 lmtp submission managesieve]] ##### SSL/TLS To enable SSL/TLS encryption and configure Certificate Authorities, see [[link,ssl]]. ##### Namespace/Mailbox Configuration Enable default INBOX namespace and English language mailbox names with [[setting,mailbox_special_use]] flags added: ```doveconf[dovecot.conf] @mailbox_defaults = english ``` To configure non-default namespaces, refer to [[link,namespaces]]. ##### IMAP See [[link,imap_server]]. ##### LMTP The LMTP service listens on port 24 by default. For additional details, see [[link,lmtp]]. You may want to adjust [[setting,postmaster_address]]. ##### Sieve To enable Sieve filtering capabilities, see [[link,sieve_installation]]. #### Cluster Controller The [[link,cluster_controller]] component manages the Palomar site's cluster state. Each site must run one Controller, which handles: * [[link,controller_health_check,health checks]] * [[link,controller_load_balancing,load balancing]] * Evacuation automation * [[link,palomar_rest_api,REST API]] access While a Controller's failure does not cause immediate system issues, it should be restored promptly. ##### Deployment Methods See [[link,cluster_controller_installation]]. ##### Configuration See [[link,cluster_controller_configuration]]. ##### Monitoring See [[link,cluster_controller_monitoring]]. ##### Troubleshooting If issues arise during installation or setup, check the logs for error messages and ensure all dependencies are operational. ##### Best Practices For optimal performance and scalability, follow best practices for health checks, user management, and more. A full list of recommendations is available at [[link,palomar_administration]]. ## Troubleshooting and Debugging See [[link,pro_troubleshooting]]. ## Support (SLA) See [[link,sla]]. ## System Testing After deploying the basic system, perform initial verification tests to ensure correct operation. Testing is essential to verify that each component is properly integrated. Refer to [[link,testing]] for guidance on performing: * Basic Dovecot service tests * Authentication and user login verification * Backend and Proxy functionality tests Use dedicated test accounts to avoid impacting (potential) production users. It is also beneficial to maintain test users in your production system for future debugging and validation. Once these tests have been done, you should test moving users with [[man,doveadm-cluster-user,batch backend move]] command and ensure that everything still works. ## Administration ::: warning NOTE This is not a comprehensive administration guide. It provides a quick reference to basic and essential Dovecot Pro administration concepts. ::: Dovecot administration can be done using [[link,doveadm]] utility. It can also be configured to provide JSON API, see [[link,doveadm_http_api]]. After changing configuration files, apply changes with the [[doveadm,reload]] command. ### User Administration Dovecot has no concept of internal users, so there are no direct user data manipulation commands. However, Dovecot Pro does provide user-related tools: * [[man,doveadm-auth]]: Test user authentication * [[man,doveadm-user]]: Display user information and attributes * [[man,doveadm-pw]]: Generate user password hashes * [[man,doveadm-kick]]: Disconnect users * [[man,doveadm-obox]]: Manage user data (including deleting data from system) for the obox mailbox format ### Cluster Administration Use [[man,doveadm-cluster]] commands to manage the Palomar cluster. ### Mailbox Administration Use [[man,doveadm-mailbox]] commands for mailbox management. These allow full control over user mailboxes. For example, you can use [[doveadm,mailbox list]] to list all mailboxes for a user. ### Mail Administration Dovecot provides various mail administration commands: * [[man,doveadm-search]]: Search for mails within in user mailboxes * [[man,doveadm-fetch]]: Retrieve metadata on individual messages * [[man,doveadm-expunge]]: Permanently delete messages * [[man,doveadm-copy]] and [[man,doveadm-move]]: Transfer mail between mailboxes ## Events Dovecot supports [[link,event_design,events]] for logging and metric generation. These events provide insights into system behavior without requiring verbose or debug-level logging. They also allow Dovecot operations data to be machine processed for analysis and storage. For example, to log failed authentication attempts with events: ```doveconf[dovecot.conf] event_exporter log { format = json time_format = rfc3339 } metric auth_failures { exporter = log filter = event=auth_request_finished AND (NOT success=yes) } ``` See also: * [[link,stats]] * [[link,event_filter]] * [[link,event_export]] ### Recommended Metrics See [[link,recommended_metrics]] on which metrics we recommend. ## Optimizations Once the system is fully deployed and validated, consider applying performance optimizations. A (non-comprehensive) collection of common optimization practices is provided in [[link,dovecot_optimization]]. These include tuning for speed, resource efficiency, and service robustness. ## Congratulations! If you have reached this point, you should now have a basic functioning Palomar deployment. Dovecot Pro offers many features not covered in this getting started guide. Explore the full documentation or contact your Account Manager to learn more about advanced capabilities and integrations. # Dovecot Pro Software Repository Dovecot Pro is a commercial software product of [Open-Xchange](https://www.open-xchange.com/), and access and use of the software requires a commercial license. The software repository is located at: https://software.open-xchange.com/. ## Repository Access Repository access is available only by using a customer-specific username and password. ::: warning Open-Xchange reserves the right to suspend a repository account if an excessive number of servers accessing the repository is exceeded. A warning email is sent to the account owner before this happens. ::: For problems with repository access in a production environment, contact [[link,sla,Open-Xchange Support]]. For non-production issues, please refer to your dedicated Open-Xchange account manager or [[link,professional_services,Professional Services]] contact. ## Signing Keys Packages are signed with the [Open-Xchange Buildkey](https://oxpedia.org/wiki/index.php?title=Importing_OX_Buildkey). Visit that page for details on key verification. # Upgrading from OX Dovecot Pro 2.3.x to 2.3.14 ## Max Bucket ID Safe Shrinking ::: info Only needed for obox + fs-dictmap installations ::: To support Cassandra max bucket ID safe shrinking behavior, `dovecot-dict-cql.conf.ext` must get updated. The map for `shared/dictmap/$user/mailboxes/$mailbox_guid/max_bucket` must include the writetime of the last `max_bucket` update. This mapping update is downwards compatible and can be done independently of upgrading OX Dovecot Pro. It is not a schema update but rather fetching additional, already available, information from Cassandra using the built-in writetime functionality. The issue solved by this change is that in a fs-dictmap installation (e.g., Cassandra+Scality), the `max_bucket` ID never shrinks. Buckets are used to prevent partitions in Cassandra becoming too big (each bucket is sized to keep 10,000 mails). If a user receives a huge amount of mails and fills multiple buckets, the `max_bucket` ID is incremented. If most of these mails are deleted again, this now larger `max_bucket` ID stays. A big `max_bucket` ID means one Cassandra SELECT per bucket < `max_bucket`. This happens whenever a folder is accessed for the first time in the metacache (after cleanup or backend change) and all the mails of this folder are listed. Thus, this change means there could be less Cassandra SELECTs overall. This fix is automatically applied per user after a user's folder has been accessed for the first time. In order to prevent race conditions, the writetime of the last `max_bucket` ID is taken into account. This is why the change to the Dovecot Cassandra mapping configuration is necessary. The change of the mapping is downwards compatible so rollbacks to earlier versions are not complicated by this change. Before 2.3.14, the `max_bucket` ID never shrunk, which means that there could be inefficient mailboxes with a higher `max_bucket` ID than actual filled buckets. To be informed about shrinking, the `fs_dictmap_max_bucket_changed` event can be monitored. # Upgrading from OX Dovecot Pro 2.3.x to Dovecot Pro 3.0.x ## Dovecot Pro ### Configuration Changes ### Product Changes * The Director architecture has been deprecated and removed. Dovecot Pro 3.x only supports the new Dovecot Pro Palomar architecture. * See [[link,palomar_director_transition]]. * AWS S3 Storage no longer can use object listings. Instead, [[link,dictmap]] must be used. * See [[link,aws_s3_listings_migration]]. * sdbox and mdbox are no longer supported for NFS installations. Dovecot Pro 3.x only supports the obox mailbox format. Dovecot Pro 2.3.x NFS/dbox installations MUST migrate users to obox for 3.x. * See [[link,obox_nfs,Obox: NFS]]. ### Added Features #### Cassandra Parameters See [[link,sql_cassandra]]. | Parameter | Notes | | --------- | ----- | | `log_retries` | Parameter was added. | #### Settings * [[setting,metacache_forced_refresh_interval]] ### Removed Features | Feature | Replacement | | ------- | ----------- | | License Plugin | Plugin has been removed and the `license_checksum` setting is marked obsolete. | #### Dictmap Settings Dictmap configuration has been replaced by [[link,dictmap_settings]]. | Parameter | Description | | --------- | ----------- | | `cleanup-uncertain` | Previously, this parameter needed to be explicitly enabled. It is now called [[setting,fs_dictmap_cleanup_uncertain]], which is enabled by default. | | `max-parallel-iter` | Previously the default was `1`. This parameter has been replaced by the [[setting,fs_dictmap_max_parallel_iter]], which defaults to `10`. now. | #### Obox Parameters See [[setting,obox]]. | Parameter | Description | | --------- | ----------- | | `absolute_timeout_msecs` | Use `absolute_timeout` instead. | | `connect_timeout_msecs` | Use `connect_timeout` instead. | | `delete_timeout_msecs` | Use `delete_timeout` instead. | | `read_timeout_msecs` | Use `read_timeout` instead. | | `slow_warn_msecs` | Use `slow_warn` instead. | | `timeout_msecs` | Use `timeout` setting instead. | | `write_timeout_msecs` | Use `write_timeout` setting instead. | ### Changed Features #### Default Settings | Setting | Old Default | New Default | Notes | | ------- | ----------- | ----------- | ----- | | [[setting,fts_dovecot_mail_flush_interval]] | 0 | 10 | | | [[setting,fts_dovecot_max_triplets]] | 0 | 200 | | #### Renamed Settings | Old Setting | New Setting | | ----------- | ----------- | | `metacache_disable_bundle_list_cache` | [[setting,metacache_bundle_list_cache]] | | `metacache_disable_secondary_indexes` | [[setting,metacache_secondary_indexes]] | | `obox_refresh_index_once_after` | [[setting,metacache_refresh_index_once_after]] | | `obox_rescan_mails_once_after` | [[setting,metacache_rescan_mails_once_after]] | | `obox_no_pop3_backend_uidls` | [[setting,obox_pop3_backend_uidls]] | | `obox_dont_use_object_ids` | [[setting,obox_use_object_ids]] | #### Service Defaults ##### IMAP Hibernation [[link,imap_hibernation]] is now enabled by default. ##### metacache UNIX socket listener New default: ```doveconf[dovecot.conf] service metacache { unix_listener metacache { mode = 0660 group = $default_internal_group } } ``` ### Event Changes #### Events | Event | Change | | ----- | ------ | | `fs_object_write_uncertain` | Event was added. | #### Use Global ACL Files instead of Global ACL Directories To migrate the ACL directories into their respective files you have to do the following: 1. Create a new consolidated [[link,acl_global_file]]. 2. For each subdirectory in the currently configured ACL directory, add a line starting with the mailbox name followed by the appropriate content. 3. Change the `vfile` parameter to the new ACL file. 4. Remove the old ACL directory parent. ### Doveadm #### doveadm metacache pull Added [[doveadm,metacache pull]] command. # Upgrading from OX Dovecot Pro 2.3.x to Dovecot Pro 3.1.x ::: info This page is intended as a summarization of the tasks necessary to move from the deprecated OX Dovecot Pro 2.3.x releases to Dovecot Pro 3.1.x. It combines and summarizes these two pages: * [[link,upgrading-2.3-pro-to-3.0]] * [[link,upgrading-3.0-pro-to-3.1]] Those two pages remain the canonical source for the upgrade instructions to 3.0.x and 3.1.x. Refer to those pages for further details on changes for each major version. ::: ## Dovecot Pro ### Product Changes * The Director architecture has been deprecated and removed. Dovecot Pro 3.x only supports the new Dovecot Pro Palomar architecture. * See [[link,palomar_director_transition]]. * AWS S3 Storage no longer can use object listings. Instead, [[link,dictmap]] must be used. * See [[link,aws_s3_listings_migration]]. * sdbox and mdbox are no longer supported for NFS installations. Dovecot Pro 3.x only supports the obox mailbox format. Dovecot Pro 2.3.x NFS/dbox installations MUST migrate users to obox for 3.x. * See [[link,obox_nfs,Obox: NFS]]. ### Configuration Changes ### Added Features #### Cassandra Parameters See [[link,sql_cassandra]]. | Parameter | Notes | | --------- | ----- | | `log_retries` | Parameter was added. | #### Settings * [[setting,metacache_forced_refresh_interval]] ### Changed Features #### Default Settings | Setting | Old Default | New Default | Notes | | ------- | ----------- | ----------- | ----- | | [[setting,mail_prefetch_count]] for obox | 0 | 10 | | | [[setting,mail_fsync]] for obox | optimized | never | | | [[setting,mail_sort_max_read_count]] for obox | 0 | 100 | | | [[setting,mail_cache_fields]] | flags | flags hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order | | | [[setting,mail_always_cache_fields]] | | flags hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order | | | [[setting,mail_uid]] | | vmail | | | [[setting,mail_gid]] | | vmail | | | [[setting,mail_temp_dir]] | /tmp | /dev/shm/dovecot | | | [[setting,verbose_proctitle]] | no | yes | | | [[setting,import_environment]] `{ MALLOC_MMAP_THRESHOLD_ }` | | 131072 | | | [[setting,fts_dovecot_mail_flush_interval]] | 0 | 10 | | | [[setting,fts_dovecot_max_triplets]] | 0 | 200 | | #### Renamed Settings | Old Setting | New Setting | | ----------- | ----------- | | `metacache_disable_bundle_list_cache` | [[setting,metacache_bundle_list_cache]] | | `metacache_disable_secondary_indexes` | [[setting,metacache_secondary_indexes]] | | `obox_refresh_index_once_after` | [[setting,metacache_refresh_index_once_after]] | | `obox_rescan_mails_once_after` | [[setting,metacache_rescan_mails_once_after]] | | `obox_no_pop3_backend_uidls` | [[setting,obox_pop3_backend_uidls]] | | `obox_dont_use_object_ids` | [[setting,obox_use_object_ids]] | #### Service Settings The default service settings have been changed: * imap-login, pop3-login, submission-login, managesieve-login: Defaults to [[link,login_processes_high_performance,high performance mode]]: * [[setting,service_process_limit,%{system:cpu_count}]] * [[setting,service_process_min_avail,%{system:cpu_count}]] * [[setting,service_restart_request_count,unlimited]] * imap, pop3, lmtp, submission, managesieve, doveadm: Defaults to reusing processes: [[setting,service_restart_request_count,1000]] * imap, pop3, submission: Add service-specific default [[setting,process_shutdown_filter,event=mail_user_session_finished AND rss > 20MB]] * imap: Default to [[setting,service_process_limit,10240]]. * lmtp: Default to [[setting,service_process_limit,512]]. * lmtp: Add default [[setting,inet_listener]] to port 24. * auth: Default to [[setting,service_client_limit,16384]]. * dict-async: Default to [[setting,service_vsz_limit,2 G]]. * Default to [[setting,default_vsz_limit,1 G]]. * auth: auth-userdb socket's group changed to [[setting,default_internal_group]] * anvil: `anvil-auth-penalty` socket is disabled by default (mode=0) - see [[link,auth_penalty]] for enabling it back. * anvil: `anvil` socket is now accessible by [[setting,default_internal_group]]. ##### IMAP Hibernation [[link,imap_hibernation]] is now enabled by default. ##### metacache UNIX socket listener New default: ```doveconf[dovecot.conf] service metacache { unix_listener metacache { mode = 0660 group = $default_internal_group } } ``` #### Lua HTTP API #### Lua Authentication #### Shared Mailboxes If you had SQL or Cassandra based [[setting,acl_sharing_map]], the performance wasn't optimal. A new [[setting,acl_dict_index]] setting was added to improve this, which is enabled by default, and needs changes. First, add a new index to SQL/CQL: ```sql CREATE INDEX user_shares_from_user ON user_shares (from_user); -- because we search for from_user when rebuilding ACLs ``` And add a new dict_map for the indexed reverse lookups: ```doveconf[dovecot.conf] dict_server { dict acl { #dict_map shared/shared-boxes/user/$to/$from { # ... #} dict_map shared/shared-user-boxes-rev/$from/$to { sql_table = user_shares value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } } } ``` ### Removed Features | Feature | Replacement | | ------- | ----------- | | License Plugin | Plugin has been removed and the `license_checksum` setting is marked obsolete. | #### Dictmap Settings Dictmap configuration has been replaced by [[link,dictmap_settings]]. | Parameter | Description | | --------- | ----------- | | `cleanup-uncertain` | Previously, this parameter needed to be explicitly enabled. It is now called [[setting,fs_dictmap_cleanup_uncertain]], which is enabled by default. | | `max-parallel-iter` | Previously the default was `1`. This parameter has been replaced by the [[setting,fs_dictmap_max_parallel_iter]], which defaults to `10`. now. | #### Obox Parameters See [[setting,obox]]. | Parameter | Description | | --------- | ----------- | | `absolute_timeout_msecs` | Use `absolute_timeout` instead. | | `connect_timeout_msecs` | Use `connect_timeout` instead. | | `delete_timeout_msecs` | Use `delete_timeout` instead. | | `read_timeout_msecs` | Use `read_timeout` instead. | | `slow_warn_msecs` | Use `slow_warn` instead. | | `timeout_msecs` | Use `timeout` setting instead. | | `write_timeout_msecs` | Use `write_timeout` setting instead. | ### Event Changes #### Events | Event | Change | | ----- | ------ | | `fs_object_write_uncertain` | Event was added. | #### Use Global ACL Files instead of Global ACL Directories To migrate the ACL directories into their respective files you have to do the following: 1. Create a new consolidated [[link,acl_global_file]]. 2. For each subdirectory in the currently configured ACL directory, add a line starting with the mailbox name followed by the appropriate content. 3. Change the `vfile` parameter to the new ACL file. 4. Remove the old ACL directory parent. ### Doveadm #### doveadm metacache pull Added [[doveadm,metacache pull]] command. # Upgrading from Dovecot Pro 3.0.x to Dovecot Pro 3.1.x ## Dovecot Pro ::: danger Dovecot v3.1.x Palomar GeoDB schema is incompatible with v3.0.x. To upgrade, you must stop the whole Palomar cluster, recreate the GeoDB schema, and then upgrade all of the Dovecot proxies and backends. This will move users into different backends, so it can be an expensive operation, best done at a time when there is less user traffic. Alternatively you can set up a new v3.1.x cluster and slowly move users between the clusters. You should also take a backup of the v3.0.x schema, so you can easily roll back to v3.0.x in case the upgrade fails. ::: ### Required Admin Actions ### Configuration Changes ### Added Features #### Settings * [[setting,cassandra_log_retries]] ### Changed Features #### Default Settings | Setting | Old Default | New Default | Notes | | ------- | ----------- | ----------- | ----- | | [[setting,mail_prefetch_count]] for obox | 0 | 10 | | | [[setting,mail_fsync]] for obox | optimized | never | | | [[setting,mail_sort_max_read_count]] for obox | 0 | 100 | | | [[setting,mail_cache_fields]] | flags | flags hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order | | | [[setting,mail_always_cache_fields]] | | flags hdr.date hdr.subject hdr.from hdr.sender hdr.reply-to hdr.to hdr.cc hdr.bcc hdr.in-reply-to hdr.message-id date.received size.virtual imap.bodystructure mime.parts hdr.references hdr.importance hdr.x-priority hdr.x-open-xchange-share-url pop3.uidl pop3.order | | | [[setting,mail_uid]] | | vmail | | | [[setting,mail_gid]] | | vmail | | | [[setting,mail_temp_dir]] | /tmp | /dev/shm/dovecot | | | [[setting,verbose_proctitle]] | no | yes | | | [[setting,import_environment]] `{ MALLOC_MMAP_THRESHOLD_ }` | | 131072 | | | [[setting,fs_azure_trailing_slash_workaround]] | yes | no | Up to Dovecot Pro 3.0.3 [[link,azure_user_sas]] and [[link,azure_service_sas]] based storage authentication made an extra `/` being appended to the object names. Upgrading from versions smaller than 3.0.3 to 3.1.X will make objects in storage being inaccessible for Dovecot Pro if this workaround is not enabled. | #### Service Settings The default service settings have been changed: * imap-login, pop3-login, submission-login, managesieve-login: Defaults to [[link,login_processes_high_performance,high performance mode]]: * [[setting,service_process_limit,%{system:cpu_count}]] * [[setting,service_process_min_avail,%{system:cpu_count}]] * [[setting,service_restart_request_count,unlimited]] * imap, pop3, lmtp, submission, managesieve, doveadm: Defaults to reusing processes: [[setting,service_restart_request_count,1000]] * imap, pop3, submission: Add service-specific default [[setting,process_shutdown_filter,event=mail_user_session_finished AND rss > 20MB]] * imap: Default to [[setting,service_process_limit,10240]]. * lmtp: Default to [[setting,service_process_limit,512]]. * lmtp: Add default [[setting,inet_listener]] to port 24. * auth: Default to [[setting,service_client_limit,16384]]. * dict-async: Default to [[setting,service_vsz_limit,2 G]]. * Default to [[setting,default_vsz_limit,1 G]]. * auth: auth-userdb socket's group changed to [[setting,default_internal_group]] * anvil: `anvil-auth-penalty` socket is disabled by default (mode=0) - see [[link,auth_penalty]] for enabling it back. * anvil: `anvil` socket is now accessible by [[setting,default_internal_group]]. #### Lua HTTP API #### Lua Authentication #### Shared Mailboxes If you had SQL or Cassandra based [[setting,acl_sharing_map]], the performance wasn't optimal. A new [[setting,acl_dict_index]] setting was added to improve this, which is enabled by default, and needs changes. First, add a new index to SQL/CQL: ```sql CREATE INDEX user_shares_from_user ON user_shares (from_user); -- because we search for from_user when rebuilding ACLs ``` And add a new dict_map for the indexed reverse lookups: ```doveconf[dovecot.conf] dict_server { dict acl { #dict_map shared/shared-boxes/user/$to/$from { # ... #} dict_map shared/shared-user-boxes-rev/$from/$to { sql_table = user_shares value_field dummy { } key_field from_user { value = $from } key_field to_user { value = $to } } } } ``` # Upgrading from Dovecot Pro 3.1.x to Dovecot Pro 3.1.2 [[setting,@fs_defaults,nfs]] and [[setting,@fts_fs_defaults,nfs]] in earlier versions did not include the `metawrap` fs. This meant that any objects written with the configuration did not include any metadata. When using [[setting,dovecot_config_version,3.1.2]] the `metawrap` fs is added, which adds the metadata. ::: danger This change makes the existing objects unreadable. If you have stored any mail or index objects with the old `@fs_defaults=nfs` or `@fs_fts_defaults=nfs` configuration, you will need to perform data migration. ::: ::: warning If the `metawrap` fs is not added, objects will not have any metadata. This can cause problems mainly if index files ever need to be rebuilt, which happens sometimes due to various reasons. Most importantly the email's "received timestamp" (IMAP INTERNALDATE) will be lost, and it'll be assigned as `1970-01-01`. ::: # Upgrading from Dovecot Pro 3.1.x to Dovecot Pro 3.1.5 ## Dovecot Pro ### Changed Setting Defaults These changes don't take effect until [[setting,dovecot_config_version]] is changed to `3.1.5`. | Setting | Old Default | New Default | Notes | |-------- | ----------- | ----------- | ----- | | `push_notification_ox/http_client_request_max_attempts` | `1` | `2` | | | `push_notification_ox/http_client_request_timeout` | `1min` | `2s` | | # Upgrading from Dovecot Pro 3.1.x to Dovecot Pro 3.2.x ## Dovecot Pro ### Changed Setting Defaults These changes don't take effect until [[setting,dovecot_config_version]] is changed to `3.2.0`. | Setting | Old Default | New Default | Notes | | ------- | ----------- | ----------- | ----- | | `service/fs-auth/client_limit` | 0 | 16384 | | | `service/metacache-worker/restart_request_count` | 1 | 1000 | | | `service/metacache-worker/process_limit` | 0 | 500 | | | `service/metacache/client_limit` | 0 | `$SET:service/auth/service_client_limit` | | | `@cluster_defaults/backend/service/cluster/process_min_avail` | 0 | 1 | | | `@cluster_defaults/proxy/service/cluster/process_min_avail` | 0 | 1 | | | `cluster_geodb/dict_proxy_idle_timeout` | `0` | `1min` | Only within the [[setting,cluster_geodb]] filter; the global [[setting,dict_proxy_idle_timeout]] default is unchanged | | `@metric_defaults/proxy/metric` | | Adds proxy_session_established | | | `@fs_dictmap_defaults/cassandra/obox_track_copy_flags` | `no` | `yes` | | | [[setting,fs_azure_user_sas_user_bound]] | `no` | `yes` | | | [[setting,fts_message_max_size]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,fts_search_read_fallback]] | `yes` | `no` | | | [[setting,fts_dovecot_prefix]] | `no` | `3-` | | | [[setting,last_valid_gid]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,last_valid_uid]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,lazy_expunge_only_last_instance]] | `no` | `yes` | | | [[setting,mail_attachment_detection_options]] | | `add-flags content-type=!application/signature`
(except for mbox, imapc, maildir) | | | [[setting,mail_access_groups]] | | [[setting,default_internal_group]] | | [[setting,mail_cache_max_header_name_length]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,mail_cache_max_headers_count]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,mail_sort_max_read_count]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,mail_vsize_bg_after_count]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,passdb_default_password_scheme]] | `PLAIN` | `CRYPT` | | [[setting,sieve_quota_script_count]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,sieve_quota_storage_size]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | [[setting,submission_max_recipients]] | | 0 is not allowed anymore to mean unlimited
use `unlimited` instead | | `passdb_passwd_file/passdb_default_password_scheme` | `PLAIN` | `CRYPT` | | `passdb_sql/passdb_default_password_scheme` | `PLAIN` | `CRYPT` | | `service/doveadm/service_extra_groups` | [[setting,default_internal_group]] | | | `service/imap/service_extra_groups` | [[setting,default_internal_group]] | | | `service/imap-urlauth-worker/service_extra_groups` | [[setting,default_internal_group]] | | | `service/indexer-worker/service_extra_groups` | [[setting,default_internal_group]] | | | `service/lmtp/service_extra_groups` | [[setting,default_internal_group]] | | | `service/pop3/service_extra_groups` | [[setting,default_internal_group]] | | | `service/submission/service_extra_groups` | [[setting,default_internal_group]] | | | `service/managesieve/service_extra_groups` | [[setting,default_internal_group]] | | | `obox/mailbox_list_index_include_inbox` | no | yes | See [[setting,mailbox_list_index_include_inbox]] | | `@mailbox_defaults/english/namespace/inbox/mailbox/Drafts/mailbox_auto` | `no` | `subscribe` | | | `@mailbox_defaults/english/namespace/inbox/mailbox/Junk/mailbox_auto` | `no` | `subscribe` | | | `@mailbox_defaults/english/namespace/inbox/mailbox/Sent/mailbox_auto` | `no` | `subscribe` | | | `@mailbox_defaults/english/namespace/inbox/mailbox/Trash/mailbox_auto` | `no` | `subscribe` | | | `unix_listener/anvil-auth-penalty/group` | | [[setting,default_internal_group]] | The default `mode` is still `0` to disable anvil-auth-penalty, so this change shouldn't matter. | | `service/indexer-worker/service_restart_request_count` | [[setting,service_restart_request_count]] | `1000` | | | [[setting,sieve_max_cpu_time]] | `0` (unlimited) | `30s` | ### Added Features #### Site Reachability Checks When configured with multiple sites, proxies need to execute site-reachability checks for the other sites. See [[link,palomar_site_reachability]] for more details. | Feature | Notes | | ------- | ----- | | [[setting,cluster_proxy_check_sites]] setting | Setting was added | ### Removed Features | Feature | Notes | | ------- | ----- | | [[setting,acl_global_path]] setting | See [[link,upgrading_2_4_acls]]. | # Upgrading Dovecot Read the [[link,release_notes]] to see if there are any important changes between releases. ## File Formats Since v3.0.0 release, upgrading won't silently change configuration (defaults). Either the old configuration is preserved, or startup fails asking you to upgrade the configuration file. The defaults are changed only when [[setting,dovecot_config_version]] setting is changed. Similarly since v3.0.0 release, upgrading won't do any backwards incompatible changes to storage files. If the release no longer supports an old storage file format, the startup fails instead. The new file formats are used only when [[setting,dovecot_storage_version]] setting is changed. ## Dovecot Pro v2.3 and later * [[link,upgrading-2.3-pro-to-2.3.14]] * [[link,upgrading-2.3-pro-to-3.0]] * [[link,upgrading-3.0-pro-to-3.1]] # Palomar: Transition from OX Dovecot Pro 2.3.x Architecture ::: warning This document describes one method, that has successfully been performed in production systems, for transitioning to Palomar from director based clusters. Another method that may fit your needs is a [[link,migration]]. For additional guidance about your transition and your specific needs please contact Open-Xchange for consultation. **All configuration and steps below should be thoroughly tested on a staging or development platform before deployment in production.** ::: ## Upgrade to latest 2.3.x release All Dovecot infrastructure should be on the latest release of the 2.3.x branch. ## Configure backend and proxy servers See [[link,palomar_configuration]]. At this time make sure that the [[link,passdb]] configuration on proxy servers contains the `host` setting. This setting allows the Palomar capable proxy servers to continue to proxy through directors. ## Upgrade to Pro 3 Dovecot backends and proxies will need to be updated to Dovecot Pro 3. Make sure that the dovecot-pro-cluster package is installed. ## Build director hash to Palomar user mapping ::: warning Avoid running the migration after backends have recently been added, removed or vhost changed. Also avoid such backend changes after the migration script. Otherwise users' backends may significantly change from the director mappings. Please also note that director map created in the first step is only valid for a time. That default time is 15 minutes (director_user_expire setting). After this time expired the transition tools fall back to consistent director hashing on their own. ::: 1. Create map of users from director ``` director_server:$ doveadm -f json director status > directors.json director_server:$ doveadm -f json director map > director_user_map.json ``` 2. Create a list of all users and save it to a file called usrlist.txt (Only needed to process all users at once (4.2a) 3. Gather above lists to a proxy server 4. Populate geodb with users information based on director output and the configured Palomar cluster. 1. Gather information on the cluster and director setup ``` # Decompress required scripts proxy_server:$ gunzip /usr/share/doc/dovecot-pro-cluster/scripts/migrate_start.py.gz # Generate output/configuration file for transition proxy_server:$ python3 /usr/share/doc/dovecot-pro-cluster/scripts/migrate_start.py \ --director-info directors.json \ --director-map-info director_user_map.json \ --dns-socket /run/dovecot/dns-client \ -p -o /tmp/output.json ``` 2. a) Process all users at once and update information in geodb ``` # Decompress required scripts proxy_server:$ gunzip /usr/share/doc/dovecot-pro-cluster/scripts/migrate_finish.py.gz # Populate geodb with user site information (site and backend) proxy_server:$ python3 /usr/share/doc/dovecot-pro-cluster/scripts/migrate_finish.py \ -c /tmp/output.json -f /tmp/extra-users.list \ --cassandra-nodes \ --cassandra-keyspace \ --cassandra-batch-size-limit 100 ``` 2. b) Configure [[setting,cluster_director_transition_config]] to point to `/tmp/output.json` for all proxies to set users' target backends. This way geodb will only be updated once users log in. Not for all users provided via `/tmp/extra-users.list` like in 2a). ``` # Place /tmp/output.json on all backends under /etc/dovecot/transition.json # Configure all proxies to use the transition configuration echo "cluster_director_transition_config=/etc/dovecot/transition.json" >> /etc/dovecot/dovecot.conf ``` 5. Check a user to confirm that backend is consistent from director and Palomar. Please note that for Palomar the user need to log in once via Palomar routing. (Alternatively run `proxy_server:$ doveadm cluster user access -u `) ``` director_server:$ doveadm director status proxy_server:$ doveadm cluster user status ``` ## Enable Palomar Your Dovecot installation is now ready for Palomar. The next steps will transition your routing from a Director-based architecture to a Proxy-based architecture. - Remove the `host` [[link,passdb_extra_fields,extra field]] from the proxy [[link,passdb]]. - Restart Dovecot. After some time, the Controller will begin moving users around to balance your cluster. It is also worth mentioning that enabling Dry Run mode for Controller features at this stage can be helpful. This will log the actions the Controller would take without actually performing them. # Lawful Intercept: Management API Dovecot Pro's Lawful Intercept system provides a generic management API for interception-related services. Currently, this API is only used by [[link,intercept-utimaco]]. ## Configuration Options ## Example Configuration See [[link,intercept-utimaco-config]]. ## API (v1) The Intercept Management API provides a generic internal interface for exchanging interception-related information between Dovecot and other systems that are part of the interception infrastructure. This section describes version 1 of the of the Intercept API. The only application of this API is currently to allow SMTP servers to check whether a certain user is under surveillance. When surveilled, the API will return additional information that a SMTP interception module needs to be able to submit an event to the Utimaco X3 event receiver. ### Terminology - *Surveillance Database*: The database containing information about the users targeted for surveillance. The Utimaco X1 is used to manage the records in this database. The Intercept API has only read access. - *Utimaco X1*: A surveillance management API run by the e-mail provider. Lawful intercept warrants are managed by Utimaco though this interface. - *Utimaco X3*: A surveillance event submission interface run by Utimaco. This is where the interception software run by the e-mail provider will submit captured surveillance events. ### Protocol Structure All messages are exchanged over HTTP, preferably protected by a TLS layer. For Utimaco, the base URL path is `/utimaco/v1`. The only allowed HTTP method is `POST`. The API request method name is provided as an additional path element: `/utimaco/v1/` The Intercept API uses JSON objects for both requests and responses. All request and normal response messages MUST have MIME content-type `application/json; charset=utf-8`. API errors produced by the server use the `application/problem+json` MIME content-type as defined in [[rfc,7807]]. This is a standard JSON format for API errors. ### Authentication The authentication of the client (and server) is currently assumed to take place in the SSL layer. ### Methods #### `surveillance` This method is used to check whether a user is currently under surveillance. The method returns the surveillance status. Additional information is returned when surveillance is active for the indicated user. This method does not verify whether the user exists in the user database: it only checks whether this user is listed in the surveillance database. Therefore, a user that does not exist at all is equivalent to an existing user that is not currently under surveillance. ##### Parameters The surveillance method has the following mandatory parameters: - `userId`: The user identifier (username) of the user. In some cases this is equivalent to the user's primary e-mail address, but it may also be a username without a domain part. ##### Response The response for the surveillance method has the following fields: - `status`: Indicates whether the user is currently under surveillance. The following values can be returned: - `ignored`: this user is to be ignored for surveillance purposes. - `surveilled`: this user is currently under surveillance. - `uuid`: The universally unique identifier created for the this surveillance activity. This value is an opaque string of at most 38 octets. This value is used in the Utimaco X1 and X3 protocols as the target identifier. - `created`: This is the unix timestamp for the moment when the surveillance record was created. This is a JSON number. The unix timestamp is always represented in UTC. - `x3URL`: The HTTPS URL of the Utimaco X3 event submission service. Fields other than `status` are only returned when the queried user is under surveillance. ##### Examples ::: code-group ```[Request] POST /utimaco/v1/surveillance HTTP/1.1 Host: provider.example.com:7172 Content-Length: 36 Content-Type: application/json; charset="utf-8" { "userId": "harrie@example.com" } ``` ```[Response] HTTP/1.1 200 OK Date: Sun, 04 Sep 2016 18:56:22 GMT Content-Length: 137 Content-Type: application/json; charset="utf-8" { "status": "surveilled", "uuid": "389bb10d136acc57392000009a857bf2", "started": 1473014291, "x3URL": "https://10.168.3.1:4443/li" } ``` ::: ::: code-group ```[Request] POST /utimaco/v1/surveillance HTTP/1.1 Host: provider.example.com:7172 Content-Length: 34 Content-Type: application/json; charset="utf-8" { "userId": "theo@example.com" } ``` ```[Response] HTTP/1.1 200 OK Date: Sun, 04 Sep 2016 19:45:59 GMT Content-Length: 25 Content-Type: application/json; charset="utf-8" { "status": "ignored" } ``` ::: # Intercept Driver: FS (filesystem) Driver name: `fs` * [[setting,intercept_buffer_max_size]] isn't currently supported. FS driver writes intercepted sessions to a [[link,fs]]. The file begins with [[setting,intercept_fs_header_line]] followed by the protocol traffic in Dovecot rawlog file format. For example: ``` rip=127.0.0.1 service=imap user=8b80216185b851ce9b2c7f6c4a53e16a 1732198510.211817 O: 1.1 OK [CAPABILITY IMAP4rev1 ...] Logged in 1732198510.211843 I: 1.2 APPEND "inbox" "22-Feb-2008 17:06:23 +0200" {87+} ... 1732198510.211846 O: 1.2 OK [APPENDUID 1732198510 1] Append completed (0.003 + 0.000 + 0.002 secs). 1732198510.211848 I: 1.3 select INBOX ... ``` ## Variables The following [[link,settings_variables]] are supported by `intercept_fs_*` settings: | Variable | Description | | -------- | ----------- | | \`user\` | user@domain | | \`crypted_user\` | user@domain encrypted via [[setting,intercept_crypted_user]] | | \`protocol\` | imap/pop3/lmtp | | \`local_ip\` | local IP | | \`remote_ip\` | remote IP | | \`local_port\` | local port | | \`remote_port\` | remote port | | \`home\` | user's home directory | | \`session\` | session ID | ## Configuration Options ## Example Configuration ```doveconf[dovecot.conf] intercept fs { fs posix { prefix = /tmp/intercept/%{crypted_user}/%{protocol}- } # TODO: dictmap example # Add a header to the log header_line = rip=%{remote_ip} protocol=%{protocol} crypted_user=%{crypted_user} # Flush log and create a new one every this often rotate_interval = 5min # Rotate the log at midnight (server's local timezone) rotate_at_midnight = yes } intercept_debug = yes ``` # Intercept Driver: Pine Driver name: `pine` ## Configuration Options ## Example Configuration ```doveconf[dovecot.conf] intercept pine { host = 127.0.0.1 buffer_dir = /tmp buffer_max_size = 100M } protocol intercept-proxy-imap { intercept_pine_port = 10143 } protocol intercept-proxy-pop3 { intercept_pine_port = 10110 } protocol intercept-proxy { ssl_client_ca_file = /usr/local/etc/dovecot/intercept-proxy.crt } ``` # Intercept Driver: Utimaco Driver name: `utimaco` The Utimaco LI framework is based on surveillance events, rather than capturing full protocol logs. These events are always related to manipulations of an e-mail message; login attempts are not captured. In the Dovecot context, messages can be delivered through LMTP, retrieved from the server using POP3/IMAP, or stored in a mailbox using IMAP (APPEND). Each of these scenarios is subject to Utimaco surveillance. The Utimaco driver has an additional service called utimaco-x1. This service implements the Utimaco X1 surveillance management protocol. Using this service, Utimaco can configure which users are targeted for surveillance. Surveillance targets are stored in a MySQL surveillance database and are identified by a UUID identifier. This identifier is assigned by Dovecot and used by Utimaco to refer to targets in the X1 management protocol. Once surveillance events are recorded, they are submitted using the Utimaco X3 handover protocol. Several event parameters are passed for each event and the target UUID is used to identify the user to which this event belongs. ## Configuration Options ## Example Configuration ::: code-group ```doveconf[dovecot.conf] ### Intercept Proxy (Utimaco) intercept utimaco { } # Time zone used by the intercept proxy. The Utimaco X3 protocol uses time # stamps without time zone, so this setting is likely necessary to configure # the time zone that the receiving Utimaco LI provider expects. #intercept_tz = :Europe/Berlin service intercept-proxy { unix_listener intercept-proxy { group = mode = 0666 user = } } ### Intercept Plugins protocol lmtp { # The lda_intercept plugin captures delivered messages. mail_plugins { lda_intercept = yes } } protocol lda { # The lda_intercept plugin captures delivered messages. mail_plugins { lda_intercept = yes } } protocol imap { # The mail_intercept plugin captures all saved messages. For IMAP, this # means that messages uploaded with the APPEND command are captured. mail_plugins { mail_intercept = yes } # The imap_intercept plugin captures the full protocol exchange between # client and server. The intercept-proxy uses this data stream to extract # messages or message fragments that are retrieved using the FETCH command. mail_plugins { imap_intercept = yes } } protocol pop3 { # The pop3_intercept plugin captures the full protocol exchange between # client and server. The intercept-proxy uses this data stream to extract # messages or message fragments that are retrieved using the RETR and TOP # commands. mail_plugins { pop3_intercept = yes } } ### Intercept API protocols { intercept-api = yes } service intercept-api { # Enable debug mode for the service #executable = intercept-api -D # Listen on TCP port 7172 with SSL inet_listener ssl { port = 7172 ssl = yes } } ### Utimaco X1 protocols { utimaco-x1 = yes } intercept_utimaco_x1 { sql_driver = mysql mysql /var/run/mysqld/mysqld.sock { user = utimaco-x1 password = utimaco-x1-password dbname = li } } protocol utimaco-x1 { # SSL certificates for the X1 service ssl_server_cert = See [[link,intercept_box]]. ## Management API (intercept-api) Some LI service providers, such as Utimaco, require access to a [[link,intercept-api]] that allows management of surveillance targets. ## Common Settings # Legal This website is hosted by [Open-Xchange AG](https://www.open-xchange.com/). See [Impressum / Legal Notice](https://www.open-xchange.com/legal), [Terms of Use](https://www.open-xchange.com/terms-of-use), and [Privacy Policy](https://www.open-xchange.com/privacy) for further information. # cassandra-fix-buckets-too-high(1) - Shrink the maximum number of buckets to fit the given users existing emails ## SYNOPSIS **cassandra-fix-buckets-too-high.sh** *userid* ## DESCRIPTION This script takes a userid as an argument, opens each folder for that given user to find the bucket's current maximum value. It then finds the highest bucket number that has mails. If that's lower than the current maximum, update the maximum in Cassandra. ## SEE ALSO [[man,doveadm]], [[man,doveadm-dict]], [[man,cassandra-fix-buckets-too-low]] # cassandra-fix-buckets-too-low.sh(1) - Increase the maximum number of buckets to fit the given users existing emails ## SYNOPSIS **cassandra-fix-buckets-too-low.sh** [*OPTIONS*] *userid* ## OPTIONS **--update** : Without the **--update** option this script only prints necessary value changes for each inspected mailbox with a message outlining the individual values. Supply this option to change this value persistently. ## SEE ALSO [[man,doveadm]], [[man,doveadm-user]], [[man,doveadm-dict]], [[man,cassandra-fix-buckets-too-high]] # doveadm-cluster-backend(1) - Utility actions for Palomar backend ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster backend add [**-\-id** *id*] [**-\-site** *host*] *-\-self* | *name* **doveadm** [*GLOBAL OPTIONS*] cluster backend remove *-\-self* | *host* **doveadm** [*GLOBAL OPTIONS*] cluster backend update [**-\-status** *online|offline|standby*] [**-\-load-factor** *<0..100>*] *-\-self* | *host* **doveadm** [*GLOBAL OPTIONS*] cluster backend status *-\-self* | *host* **doveadm** [*GLOBAL OPTIONS*] cluster backend list **doveadm** [*GLOBAL OPTIONS*] cluster backend force-move start [**-\-id** *id*] *host* *percentage* *dest-host* [*dest-host* ...] **doveadm** [*GLOBAL OPTIONS*] cluster backend force-move update *host* *percentage* **doveadm** [*GLOBAL OPTIONS*] cluster backend force-move stop *host* ## DESCRIPTION **doveadm cluster backend** can be used to run actions that interact with and modify Palomar backends. ### Command specific options **-\-self** : Target the same host where the command is ran from. Uses `cluster_backend_name` setting as the host name. ## COMMANDS ### cluster backend add **doveadm** [*GLOBAL OPTIONS*] cluster backend add [**-\-id** *id*] [**-\-site** *host*] *-\-self* | *name* Adds a new backend to cluster. New backends are added in standby state. UUID should not be used unless you are re-adding the same backend. `name` : Must be a resolvable DNS name. Unresolvable DNS names and IPv4/v6 literal addresses will be rejected. ### cluster backend remove **doveadm** [*GLOBAL OPTIONS*] cluster backend remove *-\-self* | *host* Remove a backend from cluster. ### cluster backend update **doveadm** [*GLOBAL OPTIONS*] cluster backend update [**-\-status** *online|offline|standby*] [**-\-load-factor** *<0..100>*] *-\-self* | *host* Updates a backend's information. `--status` : See [BACKEND STATUS](#backend-status). Changing the status also resets the backend's force-move state. `--load-factor` : Load factor is the approximate amount of site load in percentage that this backend gets allocated. This value is not exact, and requires Palomar Cluster Controller to work correctly. Recommended values are 100, 75, 50, 25 and 0. Setting it to 0 will indicate that backend should be drained in Cluster Controller. ### cluster backend status **doveadm** [*GLOBAL OPTIONS*] cluster backend status *-\-self* | *host* Shows the current status of the backend: * site: Site name * id: UUID * host: Host name * status: See [BACKEND STATUS](#backend-status) * load_factor: See the `--load-factor` parameter above * user_count_approx: Approximate number of users in the backend. This is counted by listing users in metacache, which don't have `redirect_host` field. This may differ significantly from the number of users that are assigned to the backend in GeoDB users table. * force_move: Force-moving status ### cluster backend list **doveadm** [*GLOBAL OPTIONS*] cluster backend list [ **--site** *host* ] Lists all backends in this cluster, including other sites. You can use optional `--site` parameter to specify site to list. ## doveadm cluster backend force-move start **doveadm** [*GLOBAL OPTIONS*] cluster backend force-move start [**-\-id** *id*] *host* *percentage* *dest-host* [*dest-host* ...] Forcibly start moving users out of the backend while they are logging in. This should be used only when a regular [[doveadm,cluster user batch move backend]] move doesn't work (e.g. backend is down, or excessively overloaded). Because force-move doesn't actively move all users in the backend, the force-move never finishes by itself. The intent is that a force-move is started first with e.g. 10% as *percentage* and then (to prevent load spikes) slowly grown to 100% If the backend is still not responding, the backend should be marked offline. Normally the Controller does all this internally. The force-move works by getting a hash of the given *id* and username in the range 0..99, and comparing that to the given *percentage*. If the hash is below the percentage, the user will be moved to one of the *dest-host* during login. The picked *dest-host* is also based on the hash of the username. It also takes into account the destination backends' load factor. If the *id* is not given, a new unique UUID is generated. The force-moving is tracked entirely in GeoDB, so this command can be used on any of the proxies or backends. The source backend does not need to be running for the force-moving to work. The force-move state is cleared also when updating the backend's status with `doveadm cluster backend update --status`. ## doveadm cluster backend force-move update **doveadm** [*GLOBAL OPTIONS*] cluster backend force-move update *host* *percentage* Update a new percentage to an already started force-move. ## doveadm cluster backend force-move stop **doveadm** [*GLOBAL OPTIONS*] cluster backend force-move stop *host* Stop an already started force-move. This is similar to updating the percentage to 0, but it also clears out the ID and dest-host fields in GeoDB. ## BACKEND STATUS `online` : The backend is reachable and accepts connections. `offline` : The backend is unreachable. `standby` : The backend is reachable, but does not accept connections. ## SEE ALSO [[man,doveadm-cluster]] # doveadm-cluster-geodb(1) - Utility actions for Palomar GeoDB ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster geodb refresh ## DESCRIPTION **doveadm cluster geodb** can be used to run actions that interact with and modify Palomar GeoDB. ## COMMANDS ### cluster geodb refresh **doveadm** [*GLOBAL OPTIONS*] cluster geodb refresh Refreshes local caches from GeoDB. This is mainly intended for testing purposes. Usually this is not necessary to run, because cluster has been designed to work correctly even when caches aren't up-to-date. ## SEE ALSO [[man,doveadm-cluster]] # doveadm-cluster-kick(1) - Disconnect user connections from cluster ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster kick *user* ## DESCRIPTION **doveadm cluster kick** can be used to run disconnect user's connections from the cluster. ## SEE ALSO [[man,doveadm-cluster]] # doveadm-cluster-localdb(1) - Utility actions for Palomar local cache ::: warning These commands are intended for testing and debugging purposes only, they should not be normally used. ::: ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster localdb user status *user* **doveadm** [*GLOBAL OPTIONS*] cluster localdb user list [ *mask* ] ## DESCRIPTION **doveadm cluster localdb** can be used inspect Palomar local cache. ## COMMANDS ### cluster localdb user status **doveadm** [*GLOBAL OPTIONS*] cluster localdb user status *user* Displays locally cached information about a user. ### cluster localdb user list **doveadm** [*GLOBAL OPTIONS*] cluster localdb user list [ *mask* ] List users in local cache. ## SEE ALSO [[man,doveadm-cluster]] # doveadm-cluster-site(1) - Utility actions for Palomar site ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster site add [ **-\-id** **id** ] [ **-\-tag** *tag* ] [ **-\-load-balancer** *host* ] *name* **doveadm** [*GLOBAL OPTIONS*] cluster site remove *name* **doveadm** [*GLOBAL OPTIONS*] cluster site update [ **-\-status** *online|offline|standby|evacuate* ] [ **-\-load-balancer** *host* ] *-\-self* | *name* **doveadm** [*GLOBAL OPTIONS*] cluster site status *name* **doveadm** [*GLOBAL OPTIONS*] cluster site list **doveadm** [*GLOBAL OPTIONS*] cluster site force-move start [**-\-id** *id*] *name* *percentage* *dest-site* [*dest-site* ...] **doveadm** [*GLOBAL OPTIONS*] cluster site force-move update *name* *percentage* **doveadm** [*GLOBAL OPTIONS*] cluster site force-move stop *name* **doveadm** [*GLOBAL OPTIONS*] cluster site recover [**-\-id** *id*] *name* *percentage* ## DESCRIPTION **doveadm cluster site** can be used to run actions that interact with and modify Palomar sites. ## COMMANDS ### cluster site add **doveadm** [*GLOBAL OPTIONS*] cluster site add [**-\-id** *id*] [**-\-tag** *tag*] [**-\-load-balancer** *host*] *name* Adds a new site to cluster. Load balancer is the host or IP address where another site's proxy connects to do site to site connections. New sites are added in online state. UUID should not be used unless you are re-adding the same site. ### cluster site remove **doveadm** [*GLOBAL OPTIONS*] cluster site remove *name* Remove a site. This currently has no safety checks, so be sure to remove first all of the site's backends and remove it from all users' preferred sites. ### cluster site update **doveadm** [*GLOBAL OPTIONS*] cluster site update [**-\-status** *online|offline|standby|evacuate*] [**-\-load-balancer** *host*] *-\-self* | *name* Update site status and load balancer. The `--self` parameter can be used to target the local site. Changing the status also resets the site's force-move state. ### cluster site list **doveadm** [*GLOBAL OPTIONS*] cluster site list List all sites. ### cluster site reachability list **doveadm** [*GLOBAL OPTIONS*] cluster site reachability list [*src-site* [*dest-site*]] List reachability from src-site to dest-site. If no parameters are given all reachability is listed. ### cluster site reachability update **doveadm** [*GLOBAL OPTIONS*] cluster site reachability update *src-site* *dest-site* *reachable* Update site reachability from src-site to dest-site. *reachable* can be set to `yes` or `no`. ## doveadm cluster site force-move start **doveadm** [*GLOBAL OPTIONS*] cluster site force-move start [**-\-id** *id*] *name* *percentage* *dest-site* [*dest-site* ...] Forcibly start moving users out of the site while they are logging in. This works by getting a hash of the given *id* and username in the range 0..99, and comparing that to the given *percentage*. If the hash is below the percentage, the user will be moved to one of the *dest-site* during login. The picked *dest-site* is also based on the hash of the username. If the *id* is not given, a new unique UUID is generated. Forcibly start moving users out of the site while they are logging in. This should be used only when a regular [[doveadm,cluster user batch move site]] move doesn't work (e.g. site is down). Because force-move doesn't actively move all users in the site, the force-move never finishes by itself. The intent is that a force-move is started first with e.g. 1% as *percentage* and then (to prevent load spikes) slowly grown to 100% If the site is still not responding, the site should be marked offline. Normally the Controller does all this internally. The force-moving is tracked entirely in GeoDB, so this command can be used on any of the proxies or backends. The source site does not need to be accessible for the force-moving to work. The force-move state is cleared also when updating the site's status with `doveadm cluster site update --status`. ## doveadm cluster site force-move update **doveadm** [*GLOBAL OPTIONS*] cluster site force-move update *name* *percentage* Update a new percentage to an already started force-move. ## doveadm cluster site force-move stop **doveadm** [*GLOBAL OPTIONS*] cluster site force-move stop *name* Stop an already started force-move. This is similar to updating the percentage to 0, but it also clears out the ID and dest-site fields in GeoDB. ## doveadm cluster site recover **doveadm** [*GLOBAL OPTIONS*] cluster site recover [**-\-id** *id*] *name* *percentage* Start/stop recovering users to a site. When users with a preferred site *name* are logging in to a different site, the user is synchronously moved to the preferred site. Using *percentage* specifies the percentage of users are moved. The users are chosen based on *id* and *percentage* similarly as documented for `doveadm cluster site force-move start`. ## SITE STATUS Online : The site is reachable and accepts connections. Offline : The site is unreachable. Standby : The site is reachable, but does not accept connections. Evacuate : The site is being evacuated of all users. ## SEE ALSO [[man,doveadm-cluster]] # doveadm-cluster-tag(1) - Utility actions for Palomar tag ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster tag create [**-\-id** **id**] *name* **doveadm** [*GLOBAL OPTIONS*] cluster tag delete *name|id* **doveadm** [*GLOBAL OPTIONS*] cluster tag update [**-\-name** *name*] *name|id* **doveadm** [*GLOBAL OPTIONS*] cluster tag list ## DESCRIPTION **doveadm cluster tag** can be used to run actions that interact with and modify Palomar tags. ::: warning Currently there is no checks whether tags are being used or not. Changing a tag UUID, or removing a tag that is in use, can cause problems. ::: ## COMMANDS ### cluster tag create **doveadm** [*GLOBAL OPTIONS*] cluster tag create [**-\-id** *id*] *name* Creates a new tag for cluster. UUID can be provided, if not, it will be generated. ### cluster tag delete **doveadm** [*GLOBAL OPTIONS*] cluster tag delete *name|id* Remove a tag. This currently has no safety checks, so be sure to first remove all of the tag's sites. ### cluster tag update **doveadm** [*GLOBAL OPTIONS*] cluster tag update [**-\-name** *name*] *name|id* Change tag name. ### cluster tag list **doveadm** [*GLOBAL OPTIONS*] cluster tag list List all tags. ## SEE ALSO [[man,doveadm-cluster]] # doveadm-cluster-user(1) - Utility actions for Palomar users ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster user access [**-u** *user* | **-A** | **-f** *file* | **--no-userdb-lookup**] [**-i**] **doveadm** [*GLOBAL OPTIONS*] cluster user delete *user* **doveadm** [*GLOBAL OPTIONS*] cluster user move backend [**-\-direct**] *user* *dest-host* **doveadm** [*GLOBAL OPTIONS*] cluster user move site [**-\-direct**] [**-\-keep-preferred**] *user* *dest-site* **doveadm** [*GLOBAL OPTIONS*] cluster user move status **doveadm** [*GLOBAL OPTIONS*] cluster user batch move backend [**-\-id** *id*] [**-\-min-last-moved** *age*] [**-\-reason** *reason*] [**-\-max-parallel-moves** *n*] (**-\-count** *users* | **-\-all** [**-\-status** *offline*|*standby*]) *dest-host* [*dest-host* ...] **doveadm** [*GLOBAL OPTIONS*] cluster user batch move site [**-\-id** *id*] [**-\-min-last-moved** *age*] [**-\-preferred-site** *name*] [**-\-keep-preferred**] [**-\-reason** *reason*] [**-\-max-parallel-moves** *n*] (**-\-count** *users* | **-\-all** [**-\-status** *offline*|*standby*]) *dest-site* [*dest-site* ...] **doveadm** [*GLOBAL OPTIONS*] cluster user batch move stop **doveadm** [*GLOBAL OPTIONS*] cluster user batch move status **doveadm** [*GLOBAL OPTIONS*] cluster user status *user* ## DESCRIPTION **doveadm cluster user** can be used to run actions that interact with Palomar users. ## COMMANDS ### cluster user access **doveadm** [*GLOBAL OPTIONS*] cluster user access [**-u** *user* | **-A** | **-F** *file* | **--no-userdb-lookup**] [**-i**] Perform cluster lookup for the user (or users). Displays the host name or IP address of the backend which the user ended up. This command can be run from either a proxy or a backend. This command is also used internally to finish user moves. You can use the `-i` parameter to display backend's IP rather than host name. ### cluster user delete **doveadm** [*GLOBAL OPTIONS*] cluster user delete *user* Deletes a user record from GeoDB. ### cluster user move backend **doveadm** [*GLOBAL OPTIONS*] cluster user move backend [**-\-direct**] *user* *dest-host* Initiates moving user to a different backend. The move is added to the queue of user moves, and it will finish on background. This command only moves the user from the backend where it is run from, i.e. the command should be run on the user's current backend. `--direct` will update the user's new backend immediately to GeoDB without performing any user moving (kicking of existing sessions or flushing metacache). This is intended for testing and troubleshooting purposes only, and should not be normally used. ### cluster user move site **doveadm** [*GLOBAL OPTIONS*] cluster user move site [**-\-direct**] [**-\-keep-preferred**] *user* *dest-site* Initiates moving user to a different site. The move is added to the queue of user moves, and it will finish on background. This command only moves the user from the backend where it is run from, i.e. the command should be run on the user's current backend. `--direct` will update the user's new site immediately to GeoDB without performing any user moving (kicking of existing sessions or flushing metacache). This is intended for testing and troubleshooting purposes only, and should not be normally used. `--keep-preferred` disables changing the user's preferred site. This is used to temporarily move users to different sites, e.g. for load-balancing purposes. ## cluster user move status Output the status of the current user move queue. ### cluster user batch move backend **doveadm** [*GLOBAL OPTIONS*] cluster user batch move backend [**-\-id** *id*] [**-\-min-last-moved** *age*] [**-\-reason** *reason*] [**-\-max-parallel-moves** *n*] (**-\-count** *users* | **-\-all** [**-\-status** *offline*|*standby*]) *dest-host* [*dest-host* ...] Initiates moving a number of users to different backends which will finish in background. If the command is run again while a batch (backend or site) move is already in progress, the previous batch move is aborted. The user moves are equally distributed to the list of given destination backends. `--id` specifies a UUID for the move operation. By default a new ID is generated. The moving status is visible in GeoDB's move_* fields. `--min-last-moved` specifies a time interval (e.g. "1 hour") for the minimum age of the user's last-moved timestamp. This is used to avoid moving the same users too often. `--reason` specifies a human readable reason why the move is performed. This is visible in logs, [[event,cluster_user_batch_move_finished]] event and [[doveadm,cluster user batch move status]] output. `--max-parallel-moves` specifies the maximum number of user moves that can run in parallel for this batch move. By default there is no limit for the batch. Regardless of this parameter, the total number of parallel moves is limited by the \`cluster-user-move\` service's [[setting,service_process_limit]]. `--count` specifies the number of users to move. Alternatively, `--all` moves all the rest of the users in the backend. `--status` can be used to change the backend status after all users have been moved out. This can be used only together with the `--all` parameter. ### cluster user batch move site **doveadm** [*GLOBAL OPTIONS*] cluster user batch move site [**-\-id** *id*] [**-\-min-last-moved** *age*] [**-\-preferred-site** *name*] [**-\-keep-preferred**] [**-\-reason** *reason*] [**-\-max-parallel-moves** *n*] (**-\-count** *users* | **-\-all** [**-\-status** *offline*|*standby*]) *dest-site* [*dest-site* ...] Initiates moving a number of users to different sites which will finish in background. If the command is run again while a batch (backend or site) move is already in progress, the previous batch move is aborted. The user moves are equally distributed to the list of given destination sites. `--id` specifies a UUID for the move operation. By default a new ID is generated. The moving status is visible in GeoDB's move_* fields. `--min-last-moved` specifies a time interval (e.g. "1 hour") for the minimum age of the user's last-moved timestamp. This is used to avoid moving the same users too often. `--preferred-site` moves only users with a given preferred site. This is used by Controller to move users back to their preferred sites. `--keep-preferred` disables changing the users' preferred sites. This is used to temporarily move users to different sites, e.g. for load-balancing purposes. `--reason` specifies a human readable reason why the move is performed. This is visible in logs, [[event,cluster_user_batch_move_finished]] event and [[doveadm,cluster user batch move status]] output. `--max-parallel-moves` specifies the maximum number of user moves that can run in parallel for this batch move. By default there is no limit for the batch. Regardless of this parameter, the total number of parallel moves is limited by the \`cluster-user-move\` service's [[setting,service_process_limit]]. `--count` specifies the number of users to move. Alternatively, `--all` moves all the rest of the users in the backend. `--status` can be used to change the backend status after all users have been moved out. This can be used only together with the `--all` parameter. ## cluster user batch move stop Stop the currently running user batch move. ## cluster user batch move status Output the status of the currently running user batch move. ### cluster user status **doveadm** [*GLOBAL OPTIONS*] cluster user status *user* Displays status information of a user. ## SEE ALSO [[man,doveadm-cluster]] # doveadm-cluster(1) - Utility actions for Palomar ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] cluster *command* [*arguments*] ## DESCRIPTION **doveadm cluster** can be used to run actions that interact with and modify Palomar. ## COMMANDS ### **cluster tag** [[man,doveadm-cluster-tag]], Tag management commands ### **cluster site** [[man,doveadm-cluster-site]], Site management commands ### **cluster backend** [[man,doveadm-cluster-backend]], Backend management commands ### **cluster user** [[man,doveadm-cluster-user]], User management commands ### **cluster geodb** [[man,doveadm-cluster-geodb]], GeoDB management commands ### **cluster localdb** [[man,doveadm-cluster-localdb]], LocalDB management commands ### **cluster kick** [[man,doveadm-cluster-kick]], Disconnect user connections from cluster ## SEE ALSO [[man,doveadm]], [[man,dovecot-cluster,,7]] # doveadm-fscache(1) - Utility actions for Dovecot's local fscache storage ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] fscache *command* [*arguments*] ## DESCRIPTION **doveadm fscache** can be used to run actions that interact with and modify Dovecot's local fscache storage. ## OPTIONS ## COMMANDS ### fscache rescan **doveadm** [*GLOBAL OPTIONS*] fscache rescan [**-S** *socket_path*] [**-\-log-path** *log_path*] *path* [*max_age*] Scans data in the fscache to recalculate the used storage space. The *path* matches the [[setting,fs_fscache_path]] setting, while the *log_path* matches the [[setting,fs_fscache_log_path]]. The default *log_path* is to use \`fscache.log\` in the fscache root directory. If the **max_age** parameter is provided, files found with mtime older than this value are deleted from the cache. ## EXAMPLE Rescan fscache to update cached size. ```sh doveadm fscache rescan /path/to/fscache ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-obox]] # doveadm-metacache(1) - Utility actions for Dovecot's local metacache storage ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] metacache *command* [*arguments*] ## DESCRIPTION **doveadm metacache** can be used to run actions that interact with and modify Dovecot's local metacache storage. ## OPTIONS ## PRIORITIES There are 4 priorities for index files: 1. User root indexes (highest priority) 2. FTS indexes 3. INBOX and \\Junk folder indexes 4. other folders' indexes (lowest priority) ## COMMANDS ### metacache clean **doveadm** [*GLOBAL OPTIONS*] metacache clean [**-A** | **-u** *user* | **-F** *file* | **--no-userdb-lookup**] [**-S** *socket_path*] [**-d** *days*] [**-p** *min_priority*] [*namespace*] Cleans old indexes for given users. If the indexes have not been flushed yet this command will fail. **-d** : Cleans metacache only if it hasn't been modified for specified number of days. **-p** : Cleans metacache for given priority for the specified user(s). ### metacache flush **doveadm** [*GLOBAL OPTIONS*] metacache flush [**-A** | **-u** *user* | **-F** *file* | **--no-userdb-lookup**] [**-S** *socket_path*] [**-p** *min_priority*] [**-i**] [*namespace*] Flushes metacache to storage for the given user(s). **-p** : Only flush changes that have at least min_priority. See PRIORITIES for the various priorities you can use. **-i** : Only flush important changes. ### metacache flushall **doveadm** [*GLOBAL OPTIONS*] metacache flushall [**-a** *metacache_socket_path*] [**-f** *userdb_field*] [**-i**] [*user mask*] Flush all matching users to storage. If no mask is specified, everything is flushed. ::: warning This can be an expensive and long operation. ::: **-a** : Specify alternative metacache socket. Not usually needed. **-f** : Use given field to match userdb. By default it's username **-i** : Only flush important changes. ### metacache list **doveadm** [*GLOBAL OPTIONS*] metacache list [ **-a** *metacache_socket_path* ] [ **-f** *userdb_field* ] [ **-W** ] [ **-\-keyvalues** ] [ *user mask* ] List current metacache for matching users. If no mask is specified, lists all users' metacache. If `--keyvalues` is given, the matching users' key-value database is written. Otherwise, output will contain - The primary username - Alternative usernames, if configured by returning user\_\* extra fields from userdb - This corresponds to the metacache_upload_interval setting. - Filesystem device where the user is located in. Filesystems are separately tracked by metacache, although currently support for multiple filesystems doesn't work as well as it could. - Disk space used by index files of this priority in metacache. - UNIX timestamp of when the index files of this priority were last accessed in metacache. - "none" means the index files have no changes done locally since they were downloaded. "unimportant" means there are some changes, but nothing that couldn't be regenerated if the server crashed. "important" means that there are changes that would be lost in case of a server crash. Currently the only important change is flag changes. - Last service that accessed this user. Note that metacache clean and flush operations (via metacache-worker or doveadm) won't update this field. - Currently calculated weight when these indexes are cleaned up. Smaller numbers are cleaned up before larger numbers. Sorting the list output (with \|sort -n) by this field will show the order in which the indexes would be cleaned. The cleanup weights are recalculated whenever the indexes are being accessed. **-a** : Specify alternative metacache socket. Not usually needed. **-f** : Use given field to match userdb. By default it's username. **-W** : If set, warns if the userdb field is not found. ### metacache refresh **doveadm** [*GLOBAL OPTIONS*] metacache refresh [**-A** | **-u** *user* | **-F** *file* | **--no-userdb-lookup**] [**-S** *socket_path*] [*namespace*] Force refreshing metacache for the given user(s) the next time it's opened. The refresh is done for the user root index and all the folders. ### metacache pull **doveadm** [*GLOBAL OPTIONS*] metacache pull [**-A** | **-u** *user* | **-F** *file* | **--no-userdb-lookup**] [**-S** *socket_path*] [**--latest-only**] [**--clean**] *source_backend_host* Pull all metacache for given user(s) from source backend host. **--clean** : Metacache is cleaned for the user(s) that have been successfully pulled. Cleaning is done asynchronously on the server after the client has already exited. **--latest-only** : Pulling fails if there are newer bundles in storage than at source backend host. ### metacache remove **doveadm** [*GLOBAL OPTIONS*] metacache remove [**-a** *metacache_socket_path*] *user mask* Remove metacache for matching users from metacache process. Mask is required parameter. **-a** : Specify alternative metacache socket. Not usually needed. ### metacache rescan **doveadm** [*GLOBAL OPTIONS*] metacache rescan [**-a** *metacache_socket_path*] Triggers an explicit metacache rescan, which makes sure the disk space usage tracked by metacache process matches what really exists on filesystem. **-a** : Specify alternative metacache socket. Not usually needed. ### metacache status **doveadm** [*GLOBAL OPTIONS*] metacache status [**-a** *metacache_socket_path*] [**--roots** | **--oldest-safe-timestamp**] [**-b**] Print statistics about metacache usage. **--roots** : Group the results by storage device instead than by time **--oldest-safe-timestamp** : Output the oldest safe timestamp. Any indexes accessed before that may or may not be corrupted, but indexes after that are known not to be corrupted. **-b** : Force the result to be shown in bytes. ### metacache update userdb **doveadm** [*GLOBAL OPTIONS*] metacache update userdb [**-a** *metacache_socket_path*] *username* *userdb_field* *value* Update alternative usernames (user\_\* fields) in **doveadm metacache list** output. ### metacache unpack **doveadm** [*GLOBAL OPTIONS*] metacache unpack [**--bundle-name** *bundle_name*] *bundle_file* *destination_dir* Unpack given bundle from storage to a given directory. **--bundle-name** : The bundle name to use. By default, tries to extract name from the bundle. ## EXAMPLE ```sh doveadm metacache flush -u user@domain ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-obox]] # doveadm-obox(1) - Utility actions for Dovecot's obox mailbox format ## SYNOPSIS **doveadm** [*GLOBAL OPTIONS*] obox *command* [*arguments*] ## DESCRIPTION **doveadm obox** can be used to run actions that interact with and modify Dovecot's obox mailbox format. ## OPTIONS ## COMMANDS ### obox user delete **doveadm** [*GLOBAL OPTIONS*] obox user delete [**-A** | **-u** *user* | **-F** *file* | **--no-userdb-lookup**] [**-S** *socket_path*] Delete all data associated with a user from obox storage and metacache. Additionally, `doveadm metacache remove` should be executed after this command is performed. ::: info Data in fscache, and userdb information is not removed. ::: ::: warning This command can erase ALL data associated with a user! ::: ::: warning If [[link,dictmap]] is used, the same user must not be created back within [[setting,fs_dictmap_delete_timestamp]]. Otherwise new Cassandra writes will have timestamps that are still older than the deleted keys, which causes the writes to be ignored. ::: ### obox user wait **doveadm** [*GLOBAL OPTIONS*] obox user wait [**-A** | **-u** *user* | **-F** *file* | **--no-userdb-lookup**] [**-S** *socket_path*] [-t *secs*] Wait until there are no more sessions (imap, lmtp, etc.) accessing the user. If there are still sessions after *secs* seconds, fail with exit code 65. ## EXAMPLE Delete all data for user 'bob'. ```sh doveadm obox user delete -u bob ``` ## SEE ALSO [[man,doveadm]], [[man,doveadm-metacache]] # dovecot-cluster(1) - How Palomar works ## DESCRIPTION Cluster's main job is to direct users into specific backends to distribute the load and provide high availability for the cluster. Same user's concurrent connections should go to the same backend. Otherwise the IMAP connections' states may look different, which may confuse user/client. For high availability, there needs to be an eventual automatic failover to move users from broken backends to working ones. Cluster tries to optimize where a new connection goes. For storage optimization, user should be redirected to the backend where it already has its indexes in metacache. For cluster optimization, users should be distributed in a way that all backends have approximately equal load (IO, memory, CPU). For best high availability, users should be moved away from a broken backend immediately. The backend may be broken only for some seconds, in which case it would take longer to move users than to just do nothing. A broken network connection could trigger a site failover, but that needs to be balanced with preventing a huge load spike that would take down the whole cluster if it's done too rapidly. If the network connection is up again after a few minutes, the site failover may not have gotten very far at all. ## GEODB Cluster tracks the state in a GeoDB (e.g. Cassandra). This way Dovecot doesn't have to be responsible for keeping the state in sync. The GeoDB will also make Cluster work across multiple sites by using the same shared state. The GeoDB schema is designed to support split brain situation, i.e. when the split brain merges and state becomes resyncronized, the cluster won't become a chaos of rapidly moving users between backends/sites. ## LOCALDB This is intended for caching GeoDB state to reduce lookups. ## SEE ALSO [[man,doveadm-cluster]] # fname-parse.pl(1) - Parse type and creation time from a bundle filepath ## SYNOPSIS **fname-parse.pl** [*filename*] ## DESCRIPTION Parse given filename(s) and output the appropriate file type and creation time. You can supply the filename as a single parameter or via stdin. It's also possible to feed the logs with paths in them directly via stdin. Output is a tab-separated line containing the filepath the type and the timestamp. Example: ```bash fname-parse.pl bundle.5e6205ad.42fb6.f05e5a10ad05625e0dbf0000b70eb21c.host bundle.5e6205ad.42fb6.f05e5a10ad05625e0dbf0000b70eb21c.host bundle-base 2020-03-06 09:11:25 ``` Supported types are: - `bundle-self` - `bundle-diff` - `bundle-base` - `fts` - `mail` - `unknown` ## SEE ALSO [[man,doveadm]], [[man,doveadm-metacache]] # obox-mail-path.sh(1) - Get object path or object ID for a given IMAP UID ## SYNOPSIS **obox-mail-path.sh** [*OPTIONS*] *user* *mailbox* *imap-uid* ## DESCRIPTION This script inspects the user's mailbox to retrieve the object from the given IMAP UID. It then returns the object's path or ID depending on the supplied option. If anything can not be found it will return an appropriate error message. ## OPTIONS **--objectid** : By default this script returns the object path for the given UID. Supplying **--objectid** will return the object ID instead. ## SEE ALSO [[man,doveadm]], [[man,doveadm-mailbox]], [[man,doveadm-dump]] # obox-user-iter.sh(1) - Print all object name paths for the user ## SYNOPSIS **obox-user-iter.sh** *username* [*storage-user*] ## DESCRIPTION This script uses the [[doveadm,mail fs iter]] to inspect all of the available files and directories for a given user and/or storage user. ## SEE ALSO [[man,doveadm]], [[man,doveadm-mail-fs]] # obox-user-objects.sh(1) - Fetch all user's objects from obox and print their object IDs in storage as yaml ## SYNOPSIS **obox-user-objects.sh** [*OPTIONS*] *user*[@*domain*] [*storage-user*] ## DESCRIPTION This script simplifies the inspection of the given user's objects. It prints all indexes, mailbox - including guids, indexes and buckets - as well as fts objects. Optionally the guids can be mapped to names if the appropriate option is set. ## OPTIONS **-g** : Pass this option to map guids to usernames. ## SEE ALSO [[man,doveadm]], [[man,doveadm-mailbox]], [[man,doveadm-dict]] # recover-mailbox.sh(1) - Recover folders that exist in Cassandra but are missing in Dovecot's index files ## SYNOPSIS **recover-mailbox.sh** *userid* [*OPTIONS*] ## DESCRIPTION This script detects whether there are any folders that exist in Cassandra, but are missing in Dovecot's index files. If "recover" parameter is given, these folders are added to the index. Since some of the folders may already have been recreated (especially INBOX and other autocreated folders), the result may be that there are both "INBOX" and "INBOX-recovered-lost-folder-1234". This script also merges these folders together. ## OPTIONS **recover** : By default only the missing folders are printed. The script exits with status code 0 if there are no missing folders, 1 if there are missing folders. If **recover** is supplied, also force-resync the user and merge the recovered folders. The script exits with 0 if there was nothing to be done or if the recovery was successful. A non-0 exit code means an internal error occurred and the recovery was not successful. ## SEE ALSO [[man,doveadm]], [[man,doveadm-fetch]], [[man,doveadm-force-resync]], [[man,doveadm-mailbox]], [[man,doveadm-mail-fs]] # scality-keys.pl(1) - Take 160bit hex-encoded Scality IDs as input and output the object type ## SYNOPSIS **scality-keys.pl** [*id* ...] ## DESCRIPTION Parse given Scality ID(s) and output the appropriate object type. You can supply the ID(s) as command line parameters or via stdin. ## SEE ALSO [[man,doveadm]], [[man,doveadm-obox]] # storage-objectid-migrate-index.sh(1) - Migrate indexes from the specified user into the configured object storage ## SYNOPSIS **storage-objectid-migrate-index.sh** *username* ## DESCRIPTION This script runs [[doveadm,mail fs iter]] commands to retrieve fts, user, as well as mailbox indexes and [[man,doveadm-dict]] to migrate them to the configured object storage. This script is intended to be used with the [[link,path_based_object_storages]] setting. All written object IDs are empty. The user should not be accessed while this migration script is being run. Also, avoid any background index bundle changes during the script run by running [[doveadm,metacache,flush]] for the user first. ## SEE ALSO [[man,doveadm]], [[man,doveadm-dict]], [[man,doveadm-mail-fs]] # storage-objectid-migrate-mails.sh(1) - Migrate mails from the specified user into the configured object storage ## SYNOPSIS **storage-objectid-migrate-mails.sh** *username* ## DESCRIPTION This script runs [[doveadm,mail fs iter]] commands to iterate all available directories for the specified user and [[man,doveadm-dict]] to migrate them to the configured object storage, making sure all housekeeping metadata is in order. This script is intended to be used with the [[link,path_based_object_storages]] setting. All written object IDs are empty. ## SEE ALSO [[man,doveadm]], [[man,doveadm-dict]], [[man,doveadm-mail-fs]] # uncertain-delete.pl(1) - Fix "success is uncertain, not deleting object ID" errors ## SYNOPSIS **uncertain-delete.pl** [*OPTIONS*] *dict_path* *object_id* ## DESCRIPTION This script can be used to fix up [[link,obox_troubleshooting_success_is_uncertain_not_deleting_object_id]] errors by checking if it actually succeeded in Cassandra or not. If not, the Scality object is deleted. It's possible to give path & object ID as parameters. It's also possible to feed the error logs directly to stdin. Giving *--head* parameter causes it to check from Scality first with HEAD if the object really exists before issuing DELETE. This allows differentiating between whether the object actually exists in Scality or not, which might be useful to know. ## OPTIONS **--head** : Check first whether object exists in the object storage before attempting to remove it. ## SEE ALSO [[man,doveadm]], [[man,doveadm-dict]] # Palomar: Administration ## REST API Reference - Browse OpenAPI specification - Download OpenAPI specification ::: todo OpenAPI specification has to be reviewed and completed. ::: ## Site Operations ### Adding a New Site Use [[doveadm,cluster site add]] to create a site. New sites start in `online` status. Provide a **site name** (required), and optionally a **tag** and **load-balancer** host used for inter-site proxying. The **UUID/ID** should only be supplied when re-adding a previously removed site (otherwise, it is autogenerated by default). #### Parameter Rules & Guidance - **Name (required):** Must match the [[setting,cluster_local_site]] used by your Proxies/Backends and the controller’s [[setting,CLUSTER_SITE]]. Mismatches will break routing for that site. - **Load balancer (optional):** Required only if the site exposes an external LB for cross-site connections; it’s the hostname/IP where other sites’ proxies connect. - **Tag (optional):** Used to shard/match users and backends to the site. - **ID/UUID (optional):** Auto-generated; specify **only** when re-adding the same site. #### Typical Workflow 1. Ensure the **controller** is running and connected to Cassandra (GeoDB) and that the keyspace/tables exist or auto-init is enabled. 2. Add the site: `doveadm cluster site add --load-balancer lb.dc1.example.com DC1` (tag optional) ::: warning Important Palomar requires a front LB for proxy ingress; it must be transparent or speak **HAProxy PROXY v2**. ::: ### Modifying a Site You can update **status**, **load balancer**, and (if necessary) **name**. ::: danger WARNING If you rename, it **must** continue to match [[setting,cluster_local_site]] on all servers in that site or the site stops operating. ::: - Update status/LB: `doveadm cluster site update --status {online|offline|standby|evacuate} [--load-balancer HOST] NAME` (or `--self`). Changing status also clears any active force-move. - Status meanings: **online** (accepts connections), **offline** (unreachable), **standby** (reachable, doesn’t accept connections), **evacuate** (migrating users out). ### Site Rebalance When **Backend Load Balancing** is enabled, **cluster controller** automatically rebalances load using a Z-score-based index. It evaluates backend load once per minute and moves users in batches; by default, each user stays on a backend for at least one hour to avoid thrashing. This duration is configurable with [[setting,HOST_LOAD_BALANCE_MIN_COOL_TIME_SECS]] controller setting. Automatic balancing waits until enough Prometheus samples have been collected before beginning to move users. For planned rebalances **between sites**, you can use site batch move from controller API to trigger moving all or a percentage of users to one or more destination sites. For emergency rebalances **between sites**, you can use **site force-move** to drain a percentage of users from one site to one or more destination sites (hash-based selection). Start/update/stop are supported, and the state is tracked in GeoDB. ### Setting Site Features Feature states can be toggled per-site via the **controller UI** or **API**. States: `on`, `dryrun`, `off`. Settings are persisted in GeoDB (`cluster_settings` table). By default features are **disabled**; if the table doesn’t exist, all features are treated as **enabled** for backward compatibility. UI changes affect only the local site. #### Backend Health Auto Handling If **enabled**, the controller automatically offlines broken hosts and/or moves users away based on failure ratios and cooldowns (e.g., [[setting,HOST_FAILURE_RATIO]], [[setting,HOST_FAILURE_MIN_LOGINS]], [[setting,HOST_FAILURE_COOL_TIME_SECS]]). If **disabled**, the controller will not take backends offline or move users due to health issues. #### Backend Load Balancing If **enabled**, the controller moves users to even load using Z-scores and thresholds like [[setting,HOST_LOAD_BALANCE_SCORE_DELTA_THRESHOLD_RATIO]], [[setting,HOST_LOAD_BALANCE_MIN_SAMPLES]], and [[setting,HOST_LOAD_BALANCE_MIN_COOL_TIME_SECS]]. If **disabled**, no automatic moves occur. #### Metrics Export If **enabled**, the controller exports Prometheus metrics; if **disabled**, the `/metrics` endpoint won’t serve data. ## Proxy Operations ### Adding a New Proxy Proxies within the same site have identical configuration. Adding a new proxy can be done by just launching a new proxy server and adding it into the load balancer's proxy pool. Dovecot doesn't explicitly keep track of the proxies. However, they usually show up in the `proxy_dest_stats` table in GeoDB. It may be useful to manually remove those rows eventually. ## Removing a Proxy Remove the proxy server from the load balancer's proxy pool. Wait for a while so at least some of the connections finish on their own. Shutdown the server to forcibly disconnect the rest of the connections. ## Backend Operations ### Adding a New Backend [[doveadm,cluster backend add]] adds a new Backend. On the Backend host, `--self` usually suffices; [[setting,cluster_local_site]] and [[setting,cluster_backend_name]] are taken from config and the backend is added as **standby**. Use UUID only when re-adding. (Backend ID is auto-generated otherwise.) Additionally, the backend **must** be added by a **resolvable hostname** (not raw IP). Ensure all Proxies/Backends share the same **doveadm TCP** settings ([[setting,doveadm_port]], [[setting,doveadm_password]]) and that **monitoring users** (e.g., `probe-%{backend_host}`) are configured on both Proxy and Backend as documented. ### Changing Backend Status [[doveadm,cluster backend update]] `--status` changes a backend status between offline/standby/online. * After controller determines that an `offline` backend is online again, it changes the status automatically to `online`. * `standby` backends are not automatically touched. * Neither `offline` nor `standby` backends receive any new connections. Existing connections are not kicked/moved, so normally backends shouldn't be set `standby` before the users are moved out. ### Changing Load-Factor for Backend [[doveadm,cluster backend update]] `--load-factor` changes load-factor for a backend. This can be used to (temporarily) reduce load from backend. Normally, load should always be set to `100`. This is primarily used by the controller. This setting is not accurate, so setting it to `99` or `78` will not have the expected effect. Recommended values are `100`, `50`, and `0` for draining the host. ### Evacuating Backend You can evacuate a backend by setting its load-factor to `0` with [[doveadm,cluster backend update]] `--load-factor 0`. Controller will notice this and start moving users to other backends. There is also the evacuate button to trigger immediate move of all users to other backends. [[changed,cluster_user_move_all_added]] After all the users have been moved away, controller changes the backend status to `standby` so no more users can log in. Note that the evacuation moves only the active users away that exist in the backend's metacache. Users that aren't in metacache at the time of move are still assigned to the backend. If the backend status is changed to `online`, the assigned users can again log into the backend. If you need a backend evacuation without controller, you can use [[doveadm,cluster user batch move backend]] `--all --status standby` to immediately move all users to other backend(s). ::: warning This command exits without waiting for the moves to complete. ::: ::: warning Immediate evacuation methods can potentially increase the load on the source backend significantly if many backends are pulling metacache from it at the same time. ::: After evacuation is complete, shutdown Dovecot to make sure all sessions are gone. Finally, set the status of the backend to `standby` to signify that the backend is not usable for connections. ### Removing a Backend * Start [[link,palomar_backend_evacuate,evacuating the server]] * Wait for no users to exist in the backend ([[doveadm,who]]) * Optionally remove the server completely ([[doveadm,cluster backend remove]]) ### Backend Overloaded Controller attempts to prevent backend from becoming overloaded by [[link,palomar_automatic_load_rebalancing,automatically moving users out]], but this may not always happen fast enough. To make it happen faster, you can [[link,palomar_backend_load_factor,change backend load-factor]] to a smaller number or even to 0 to remove all users from the backend. ### Disabling Automation #### Disabling Controller Automation Outside Kubernetes (e.g., Docker Compose), use **site features** to disable automation: - Set **Backend Health Auto Handling** and/or **Backend Load Balancing** to `off` (or `dryrun`) via the UI/API. - The controller UI is available on the **controller-api** service to make these changes. ## User Operations ### Checking User Status [[doveadm,cluster user status]] shows the current status for a user. ### Accessing User [[doveadm,cluster user access]] accesses a backend as a given user and prints which backend it was. This command can also cause a connection to the other site. This command is mainly used internally, but may be helpful also for debugging. ### Moving Users to Another Backends [[doveadm,cluster user move backend]] moves the given user to the given backend. [[doveadm,cluster user batch move backend]] moves a number of users to the given backends. ::: warning This command exits without waiting for the move to complete. ::: ### Moving User to Another Site [[doveadm,cluster user move site]] moves the given user to the given site. ::: warning This command exits without waiting for the move to complete. ::: ## Autoscaler Controller supports autoscaling. There are two autoscalers to choose from: ### StaticAutoScaler This is the default scaler, and returns number of backends in site. ### LuaAutoScaler This scaler calls method `get_desired_number_of_backends(site)` and expects it to return number of desired backends. ## Managing Controller Features Controller offers feature control via the admin UI or HTTP API. The features that can be switched 'on', 'dryrun' or 'off' are: - "Backend Health Auto Handling": Automatically take backends down or bring them back up based on backend Z-score explained in [[link,controller_health_check]] - "Backend Load Balancing": Automatically move users between backends to distribute load as explained in [[link,controller_load_balancing]] - "Metrics Export": Collect dovecot statistics and export them to Prometheus. If this feature is disabled, not metric is exported in response to Prometheus scraping of `/metrics` HTTP endpoint. Feature settings are recorded in a table (`cluster_settings`) in GeoDB and are disabled by default. If the table is not present, all features are enabled for backward-compatibility. To manage feature settings via the admin page, navigate to `Site features` page from the left pane. Note that you can only change feature settings of the local site via controller admin UI. To manage the features via the controller API, see OpenAPI documentation. ## Monitoring - **Controller → Prometheus:** Metrics export must be **enabled** at the site level - **Readiness for auto-balancing:** Automatic balancing waits until [[setting,HOST_LOAD_BALANCE_MIN_SAMPLES]] are collected to avoid premature balancing decisions. - **What to collect:** Follow the **Recommended Metrics** for Backends (mail/FTS/index I/O, metacache, cluster user-move counters, etc.). ### Monitoring Recommended Metrics #### Sum Of Users In Backends This metric tracks the total number of users currently distributed across backend hosts. ```shell sum by (host) (last_over_time(dovecot_cluster_controller_host_users[$__interval])) ``` #### Backend-Check Finished With Status Online This metric counts how many backend health checks ended successfully with status online per host and instance. ```shell sum by(backend_host, instance) (rate(dovecot_cluster_backend_check_finished_total{status="online"}[$__rate_interval:])) ``` #### Backend-Check Finished With Status Offline This metric counts how many backend health checks ended with status offline per host and instance, indicating unavailable backends. ```shell sum by(backend_host, instance) (rate(dovecot_cluster_backend_check_finished_total{status="offline"}[$__rate_interval])) ``` #### Backend-Check Failures By Host This metric calculates the ratio of backend check failures compared to total backend checks per instance, giving a failure rate percentage. ```shell sum by(instance) (rate(dovecot_cluster_backend_check_failure_total[$__rate_interval:])) / sum by(instance) (rate(dovecot_cluster_backend_check_finished_total[$__rate_interval:])) ``` ## Logging - **Controller:** JSON logs from API, scheduler/workers, Prometheus poller, Redis, and init-actions (e.g., `redis-wait`), which aid startup/operational visibility. - **Proxy/Backend:** Structured logs covering auth/routing (Proxy) and storage/IMAP/POP/LMTP operations (Backend). ## Examples ### Create a Site ```shell # create site with cross-site LB and shard tag doveadm cluster site add --load-balancer lb.dc1.example.com --tag dc1-shard-a DC1 ``` ### Gracefully Evacuate a Site (Planned Maintenance) #### site batch move ```shell curl -X POST -H "Content-Type: application/json" -d '{"percentage": "20", "dest_site_names": ["site2", "site3"]}' http://controller_api_host:controller_api_listening_port/v1/sites//batch_move_users ``` ### Forcibly Evacuate a Site (Unplanned Maintenance) ```shell # start moving a controlled percentage of users away from DC1 into DC2/DC3 doveadm cluster site force-move start DC1 25 DC2 DC3 # later, increase percentage (e.g., 60%) doveadm cluster site force-move update DC1 60 # stop when done doveadm cluster site force-move stop DC1 ``` ### Add a Backend from a Host ```shell # run on the backend host after configuring cluster_local_site and cluster_backend_name doveadm cluster backend add --self ``` ## Doveadm Commands # Palomar: Load Rebalancing If enabled, [[link,cluster_controller]] can perform automatic load balancing based on collected data from backends. Briefly, a load index is assigned to all backends called [[link,cluster_controller_zscore,Z-score]]. If backends have too big of a variation in load, trigger moving a batch of users between the backend with the highest load and the backend with the lowest load. The difference in load that triggers the balancing is set by [[setting,HOST_LOAD_BALANCE_SCORE_DELTA_THRESHOLD_RATIO]]. Every minute load is checked for all backends and users are moved to achieve a uniform load across site. Users stay on the same backend for at least an hour to prevent moving users too often. At the start and end of a batch user move Dovecot emits [[event,cluster_user_batch_move_started]] and [[event,cluster_user_batch_move_finished]] respectively. To safeguard the site from making too early decisions about load, automatic load balancing is deferred until a sufficient amount of data is collected by Prometheus (on the controller). The value of this minimum number of data samples can be tweaked with [[setting,HOST_LOAD_BALANCE_MIN_SAMPLES]]. By default, it's set to `3000` samples which would roughly take 12 hours to collect. # Palomar: Logging ## Cluster Controller [[link,cluster_controller]] consists of various components that provide logging information specific to their respective responsibilities: - Controller API: Log information related to API endpoint that interact with GeoDB and cluster statistics metrics. - Controller Scheduler: Log information related to Celery tasks being scheduled to available workers. - Controller Prometheus: Log standard Prometheus information. - Controller Redis: Log standard Redis information. - Controller Worker (high priority): Log Celery tasks assign and executed on this worker type. - Controller Worker (low priority): Log Celery tasks assign and executed on this worker type. Useful logs will be printed for each components if an Init Containers is needed prior to start main containers (i.e redis-wait on Controller API). Controllers use JSON logging. ## Proxies [[link,palomar_proxy]] log information such as connection attempts, authentication successes or failures, and routing decisions. Dovecot Proxies use structured log formatting. ## Backends [[link,palomar_backend]] log mail storage operations such as mailbox access, message retrieval, and synchronization. Dovecot Backends use structured log formatting. # Palomar: Provisioning ## Users ### Site Selection To explicitly assign a primary site to a user, you can use the [[doveadm,cluster user move site]] command. ::: warning Use the `--direct` parameter to set the site only and not trigger an actual site move. ::: ### Backend Selection To explicitly assign a backend to a user, you can use the [[doveadm,cluster user move backend]] command. ::: warning Use the `--direct` parameter to set the backend only and not trigger an actual backend move. ::: # OX Abuse Shield [OX Abuse Shield](https://www.open-xchange.com/products/ox-abuse-shield/) is the authentication policy server used with Dovecot Pro. ::: info OX Abuse Shield is a separately licensed product from Dovecot Pro, but the two products are commonly packaged together. Contact [Open-Xchange](https://www.open-xchange.com/about-ox/contact-us/mail-productivity/) for further information on OX Abuse Shield, if it is not already part of your Dovecot Pro license. ::: ## Description OX Abuse Shield protects against threats in internet-connection authentication systems including portals, webmail, IMAP and POP, SMTP and any other protocol. It comes with numerous features and integration options to provide reliable security and extend existing protections for authentication abuse including anti-brute-force, compromised account detection and suspicious login detection. Because OX Abuse Shield is based on a scriptable policy engine, it provides complete flexibility to adapt to individual needs and regulations. Dovecot Pro comes with full integration of OX Abuse Shield, and is the supported method to do authentication abuse prevention. ## Documentation & Configuration ### OX Abuse Shield * https://documentation.open-xchange.com/components/weakforce-core/2.12/ * https://documentation.open-xchange.com/components/wforce-documentation/2.12/ * https://oxpedia.org/wiki/index.php?title=AppSuite:OX_Abuse_Shield ### Dovecot Pro * [[link,auth_policy,Authentication Policy]] # Dovecot Backend ## Object Storage Format For Dovecot Pro, and the obox mailbox format, the Backend is connected to the object storage where users' mail data is stored. As a user connects to Dovecot to read mails, the user's mail indexes are fetched from the object storage and cached in a local file system. The mail indexes are updated locally while the user modifies the mailbox. The modified local indexes are uploaded back to object storage in the background every 5 minutes, except for LMTP mail deliveries. With LMTP, the indexes are uploaded on each 10th mail (see [[setting,obox_max_rescan_mail_count]]) to avoid unnecessary object storage writes. The index updates for LMTP deliveries don't contain anything that can't be recreated from the mails themselves. Backends are stateless; if the server crashes the only thing lost for logged-in users are the recent message flag updates. When a user logs in the next time to another Backend, the indexes are fetched again from the object storage to local cache. Because LMTP mail deliveries don't update indexes immediately, the email objects are also listed once for each accessed folder to find out if there are any newly delivered mails that don't yet exist in the index. ### Caching Backends attempt to do as much as possible within the local cache to minimize object storage I/O. The larger the local cache the less object storage I/O there is. Typically, each Backend should have at least 2 MB of local cache allocated for each active user (e.g. if there are 100,000 users per Backend who are receiving mails or who are accessing mails within 15 minutes, there should be at least 200 GB of local cache on the Backend). It's important that the local cache doesn't become a bottleneck, so ideally it would be using SSDs. Alternatives are to use in-memory disk (tmpfs) or filesystem on SAN that provides enough disk IOPS. NFS should not be used for the local cache. Dovecot never uses fsync when writing to the local cache, so after a server crash the cache may be inconsistent or corrupt. This is why the caches should be deleted at server bootup, although Dovecot internally attempts to keep track of crashes and won't open an index that was potentially corrupted. ## Full Text Search (FTS) Dovecot's Backend is responsible for indexing messages for use with Full Text Search when a message is delivered to a mailbox. When an indexing back end is not present, searching falls back to slow and sequential searches through all message headers or text. For commercial grade email, this is unacceptable performance for the end user. Thus, a search indexing backend is a requirement for Dovecot Pro. Additionally, for storage backends that do not provide fast sequential access to message data (e.g. object storage), it is critically important to perform searches through a global index. On-demand message body searches will simply not be possible for larger mailboxes otherwise. Dovecot's standard IMAP SEARCH TEXT/BODY parameters use the FTS indexes. Searches through message headers benefit from Dovecot's fast message index cache implementation, which often contains the necessary information. Optionally, header searches can also be done from FTS indexes. Triggers for FTS indexing are configurable. It can be started on demand, as a batch job, or automatically when new messages arrive. For the best mix of performance and user experience, indexing on delivery is the best option. The indexing takes place when the user may not even be interacting with the system, and spreads the load across delivery time rather than during the peak periods of the day when users may be performing the most mailbox search actions. Dovecot Pro provides the [[plugin,fts-dovecot]] to perform the indexing and searching of mail messages. This plugin is a Pro-only feature that does the actual indexing and efficient storage of indexed data, and it is specifically designed for use and optimization with object storage. The Pro engine uses the Dovecot Core FTS library to perform common search and indexing features: | Feature | Summary | | ------- | ------- | | Normalize | Unify saved form of text as much as possible. | | Stemming | Reduce words to their basic form. | | Detect Language | Detect language of processed text to more accurately apply other filters and features. | | Skip Stop Words | A configurable list of words (per language) not to be indexed. | | Skip Bad Characters | Non-language characters, base64 data, HTML tags, etc. will not be indexed. | | Decompound | Index compunded words separately. | | Attachment Search | Allow data in text-based attachments to be indexed. | The Pro FTS engine provides a feature-rich system that is entirely integrated within the Dovecot Pro platform, with no need for additional storage systems or dedicated indexing nodes. # Cluster Controller See [[link,cluster_controller]]. # Palomar: GeoDB ## Key Features of GeoDB GeoDB organizes cluster state data into several object types: ### Site A site contains multiple Backends. ### Backend A Dovecot Backends entity with status, statistics and load factor. ### Family Features A set of Cluster Controllers features that can be enabled, disabled, or DryRun (enabled for logging purposes only). ## Dependency on Cassandra GeoDB depends on Cassandra as its primary data store. However, ScyllaDB has also been tested and confirmed to be compatible with GeoDB, offering users an alternative. ## Deployment Solutions for Cassandra ### Manual It is recommended to install your own Cassandra cluster with your specific business requirements and use it for both Dovecot fs-dictmap and Cluster Controller. These settings should be set: * [[setting,CASSANDRA_SERVERS]] * [[setting,CASSANDRA_LOAD_BALANCING_POLICY]] *(optional)* ### Kubernetes Cluster Controller's Kubernetes deployment offers a minimal deployment of either Cassandra or ScyllaDB databases. ::: warning It is not recommended to use this for production use, as it is a single node installation without replication or high availability considerations. ::: To disable this managed database deployment set `database.enabled = false` in the helm variables. ### Docker Compose The Docker-compose deployment method does not support Cassandra and it is expected that a running Cassandra is available. ## Cassandra Keyspace for GeoDB The keyspace used by Controller is set in [[setting,CASSANDRA_KEYSPACE]]. You normally don't need to create the keyspace beforehand because deployment automation should take care of that. If you've opted out of automatic database initialization, then you'll need to create the keyspace and all the tables needed for Controller to work. # Dovecot Proxy # Palomar: Redis Controller needs a working Redis cluster for both task scheduling and runtime cache storage. All supported [[link,cluster_controller_installation]] options provide a built-in Redis cluster deployment. # Storage The Palomar architecture requires a highly available, distributed storage system for operation. This page lists the supported storage options for Dovecot Pro. ::: warning Important "Storage Support" in the context of Dovecot Pro refers to the storage systems defined in the Product Definition and covered under the Dovecot Pro SLA. If a storage system is not listed here, it is NOT SUPPORTED by Dovecot/OX. An SLA agreement cannot be provided unless one of the storage systems listed below is in use. Note: Not all storage systems have the same level of support. The different support levels are described below in detail. ::: ## Mailbox Format Dovecot Pro's [[plugin,obox,obox mailbox format]] is the **ONLY** mailbox format supported in Palomar. ### Migration from \*dbox on Dovecot Pro 2.3 Customers using [[link,dbox]] on Dovecot Pro 2.3 MUST migrate users to obox on 3.x. There is no support for direct physical mailbox conversion of dbox to obox. ## Storage Systems ::: warning There are no licensing cost differences between Premium and Basic storage systems. ::: ### Premium Storage Support #### Scality sproxyd (RING) Vendor website: [Scality](https://www.scality.com/ring/) sproxyd is the only Pro-supported geo-redundant (multi-site) capable solution. All sizing and setup for a Scality system is handled by Scality. Release Notes will identify the specific version of RING that was tested against. #### AWS S3 Vendor website: [AWS](https://aws.amazon.com/s3/) ::: warning IMPORTANT This support option is for the S3 service **as provided by AWS on their platform**. This is not generic S3 API support (see below). ::: AWS S3 is supported in a single region, although use of multiple availability-zones in that region with Palomar is acceptable. The Dovecot Pro customer is responsible for working with AWS to ensure sufficient operational limits are configured for their storage bucket(s) (e.g., IOps and ingress/egress limits). Dovecot Pro supports [IAM](https://aws.amazon.com/iam/) (both v2 and v4 signatures). Dovecot Pro uses (and tests) these specific [[link,aws_s3_api,S3 API commands]]. Release Notes will identify: * The month & year the S3 service was tested against * The region where the testing occurred * A link to the active documentation at the time testing occurred ### Basic Storage Support #### "AWS S3 Compatible" Uses AWS's S3 implementation as the reference behavior. (E.g., see [[link,aws_s3_api,AWS S3 API commands]] for the specific commands used.) "AWS S3 compatible API" is defined as a storage system that complies with the behavior identified and tested as part of Dovecot Pro "AWS S3" Premium Support. #### Microsoft Azure Vendor website: [Microsoft Azure](https://azure.microsoft.com/en-us/products/storage/blobs) [[link,azure_api,Microsoft's Azure blob storage API]] is supported. ::: danger Microsoft Azure, as a public cloud service, requires authentication of every request. Dovecot Pro has implemented User SAS authentication for the Blob Storage requests. Best efforts will be used to support this method, but testing may not occur for every Dovecot Pro release. OX certifies that it will maintain support for at least one authentication system for Azure, but that system may change in the future based on vendor support and other considerations. ::: Release Notes will identify: * The month & year we last tested against the Azure service * The region where the testing occurred * A link to the active documentation at the time testing occurred #### NFS ::: danger WARNING Dovecot Pro only supports NFS on installations with less than 250,000 users UNLESS specific additional NFS SLA support is added to the license. ::: Site replication is vendor-specific. NFSv3 is known to work. NFSv4 will probably work, but the Dovecot team does not have any specific production information. Storage/filesystem performance is not guaranteed. Any NFS system is customer provided and not supported by OX. OX *cannot* provide sizing information on NFS. If a customer wants sizing information, they should work with a storage vendor that has expertise. OX can provide [[link,professional_services,Professional Services]] support that can suggest optimizations, but these are non-binding recommendations specific to a customer and not general requirements. ## Dictmap For all _object storage_ installations, [[link,dictmap]] is **REQUIRED**. ### CQL Storage Dovecot stores and retrieves fs-dictmap information using CQL (Cassandra Query Language). **CQL protocol version 4 is recommended and is the version that is currently tested against.** This database MUST be configured to be multi-node and highly available as part of Palomar. #### Apache Cassandra Website: [Apache Cassandra](https://cassandra.apache.org/) Apache Cassandra is the traditional service used with Dovecot, and has been successfully used in production in a variety of installations for many years. OX tests at least one version of Apache Cassandra for every Pro release. OX does not support configuration or operation of Cassandra. OX may provide Cassandra recommendations, but these are not binding. Support for Cassandra can be pursued through 3rd parties, such as [DataStax](http://www.datastax.com/). Release Notes will identify: * The specific version of Cassandra that was tested and confirmed working #### ScyllaDB ::: warning OX does not currently test against ScyllaDB. OX MAY include testing as part of the release process in future Dovecot Pro releases. ::: Website: [ScyllaDB](https://www.scylladb.com/) ScyllaDB claims to be [fully compatible with CQL protocol version 4](https://github.com/scylladb/scylladb/blob/master/docs/dev/protocol-extensions.md). The customer is responsible for determining if this statement is accurate. Dovecot Pro does not use or support any ScyllaDB extensions to the CQL protocol. OX does not support configuration or operation of ScyllaDB. OX may provide ScyllaDB recommendations, but these are not binding. Support for ScyllaDB can be pursued through 3rd parties, such as via [ScyllaDB](https://www.scylladb.com/). #### Managed CQL Services Various managed CQL services are available. OX does not support configuration or operation of any specific managed services, and cannot provide recommendations or operational advice. ## Mail Data Access OX can only support mail data access if customer uses Dovecot provided APIs (i.e. [[link,doveadm]] commands; scripts shipped with Pro packages). OX CANNOT support direct modification of mail storage, for either NFS or object storage solutions. [[man,doveadm-fs]] commands can be used for debugging and fixing as instructed by Dovecot, but not as a regular way to access mails. # Palomar: Configuration This page describes the Dovecot config necessary to implement the [[link,palomar_architecture]]. ::: warning If you are upgrading from OX Dovecot Pro 2.3.x, see [[link,palomar_director_transition]]. ::: ::: info It is recommended to use [[setting,@cluster_defaults,proxy]] and [[setting,@cluster_defaults,backend]]. Using these settings will set these settings by default: ::: ::: details Click to show proxy settings ```doveconf[dovecot.conf] auth_master_socket_path = cluster-auth-master auth_socket_path = cluster-userdb lmtp_proxy = yes login_socket_path = cluster service doveadm { unix_listener doveadm-cluster-http { mode = 0600 type = http user = $SET:default_internal_user } } service auth { unix_listener auth-master { user = $SET:default_internal_user } } service cluster { unix_listener cluster-auth-master { mode = 0600 } unix_listener cluster-userdb { mode = 0666 } unix_listener login/cluster { mode = 0666 } } dict_server { dict cluster-geodb { driver = sql sql_driver = cassandra cassandra { keyspace = geodb } # (dict_maps stripped out) } } cluster_geodb { dict proxy { idle_timeout = 1min name = cluster-geodb socket_path = dict-async } } cluster_localdb { dict proxy { name = cluster-localdb socket_path = dict-async } } service health-check { executable = script -p health-check.sh inet_listener reachability { port = 53069 } } metric lmtp_rcpt_finished_failure { filter = event=smtp_server_transaction_rcpt_finished AND category=lmtp AND NOT error="" AND NOT enhanced_code=5.* metric_group_by dest_host { } } metric lmtp_rcpt_finished_success { filter = event=smtp_server_transaction_rcpt_finished AND category=lmtp AND error="" metric_group_by dest_host { } } metric proxy_session_failure { filter = event=proxy_session_finished AND error_code=* AND NOT error_code=proxy_dest_connection_limit AND NOT error_code=proxy_dest_redirected AND NOT error_code=auth_nologin_referral metric_group_by dest_host { } } metric proxy_session_success { filter = event=proxy_session_established metric_group_by dest_host { } } metric site_reachability_reachable { filter = event=cluster_site_reachability_check_finished AND reachable="yes" AND error="" metric_group_by host { } } metric site_reachability_unreachable { filter = event=cluster_site_reachability_check_finished AND reachable="no" AND error="" metric_group_by host { } } metric site_reachability_failure { filter = event=cluster_site_reachability_check_finished AND NOT error="" metric_group_by host { } } ``` ::: ::: details Click to show backend settings ```doveconf[dovecot.conf] auth_master_socket_path = cluster-auth-master auth_socket_path = cluster-userdb lmtp_proxy = yes login_socket_path = cluster service doveadm { unix_listener doveadm-cluster-http { mode = 0600 type = http user = $SET:default_internal_user } } service auth { unix_listener auth-master { user = $SET:default_internal_user } } service cluster { unix_listener cluster-auth-master { mode = 0600 } unix_listener cluster-userdb { mode = 0666 } unix_listener login/cluster { mode = 0666 } } dict_server { dict cluster-geodb { driver = sql sql_driver = cassandra cassandra { keyspace = geodb } # (dict_maps stripped out) } } cluster_geodb { dict proxy { idle_timeout = 1min name = cluster-geodb socket_path = dict-async } } metacache_pull { dict proxy { name = cluster-geodb socket_path = dict-async } } cluster_localdb { dict proxy { name = users socket_path = metacache-users } } ``` ::: ## Load Balancers Palomar requires a layer of load balancers to balance traffic ingress to the [[link,palomar_proxy]]. ::: warning Requirements The load balancer MUST either be transparent (keeps the original client IP visible) or it MUST support [HAProxy PROXY V2](http://git.haproxy.org/?p=haproxy.git;a=blob_plain;f=doc/proxy-protocol.txt;hb=HEAD) protocol. ::: Round-robin distribution of incoming connections to the pool of available site proxies is a common setup. More advanced traffic-management can be done as well, although specific configuration details for the load balancer is site-dependent and is out-of scope for this documentation. ### Example ::: details load-balancer: [HAproxy](https://www.haproxy.org/) configuration example ```[haproxy.conf] # haproxy.conf # # Sample Configuration for a Palomar load balancing setup using software # (HAproxy) load balancing # # Sample assumptions: # - Incoming traffic will be balanced to 2 proxies, located at 192.168.1.10 # and 192.168.1.11 defaults mode tcp log global option dontlognull retries 3 timeout http-request 10s timeout queue 1m timeout connect 10s timeout client 1m timeout server 1m timeout http-keep-alive 10s timeout check 10s maxconn 128000 listen lmtp bind 0.0.0.0:24 mode tcp balance roundrobin server hac-dc1-proxy2 192.168.1.11:24 check send-proxy-v2 server hac-dc1-proxy1 192.168.1.10:24 check send-proxy-v2 listen pop3 bind 0.0.0.0:110 mode tcp balance roundrobin server hac-dc1-proxy2 192.168.1.11:110 check send-proxy-v2 server hac-dc1-proxy1 192.168.1.10:110 check send-proxy-v2 listen imap4 bind 0.0.0.0:143 mode tcp balance roundrobin server hac-dc1-proxy2 192.168.1.11:143 check send-proxy-v2 server hac-dc1-proxy1 192.168.1.10:143 check send-proxy-v2 listen sieve bind 0.0.0.0:4190 mode tcp balance roundrobin server hac-dc1-proxy2 192.168.1.11:4190 check send-proxy-v2 server hac-dc1-proxy1 192.168.1.10:4190 check send-proxy-v2 listen submission bind 0.0.0.0:587 accept-proxy mode tcp balance roundrobin server hac-dc1-proxy2 192.168.1.11:587 check send-proxy-v2 server hac-dc1-proxy1 192.168.1.10:587 check send-proxy-v2 ``` ::: ## Dovecot Proxy [[link,palomar_proxy,Dovecot Proxies]] authenticate the user, convert to internal user ID (if needed), and redirect to the Dovecot Backend. ### Installation A Dovecot Proxy requires the **dovecot-pro-cluster** package. ### Configuration Documentation on cluster settings can be found [below](#palomar-configuration-settings). ```doveconf[dovecot.conf] # Name of the proxy's local site cluster_local_site = DC1 # Include all the required settings for running in cluster proxy mode @cluster_defaults = proxy @metric_defaults = proxy ``` #### GeoDB / LocalDB #### HAProxy If HAProxy (or compatible) load balancer is used in front of Proxies: * [[setting,haproxy_trusted_networks]] needs to trust the HAProxy servers' IP addresses. * [[setting,inet_listener_haproxy,yes]] needs to be set for all listeners that accept HAProxy connections, possibly in a different port. For example: ```doveconf[dovecot.conf] service imap-login { inet_listener imap-haproxy { haproxy = yes port = 1143 } } ``` #### Trusted Networks Dovecot Proxy IPs/networks that must be trusted (via [[setting,login_trusted_networks]]): * Dovecot Proxies in other sites. If user connection is going to a wrong site, the proxy will connect to the correct site's proxy (via the load balancer). * cluster-backend-test service connects to the local proxy. This is based on the first IP address in `service imap-login { inet_listener }`, which defaults to the [[setting,listen]]. Typically this is `127.0.0.1` or `::1`. ```doveconf[dovecot.conf] login_trusted_networks = 127.0.0.1 ::1 192.168.1.0/24 ``` #### Doveadm #### Monitoring Backends/Users Palomar requires "test" accounts to be configured so that backends can be monitored. The test username is recommended to use `%{backend_host}`, which expands to the tested backend. This way if there is a problem with the test user, it affects only a single backend. Both the proxy and the backend need a passdb, which can authenticate the test users. They could be in the same passdb as the real users, or they can have a separate passdb. In the latter case, it should be placed as the first passdb to catch the test users. ```doveconf[dovecot.conf] cluster_backend_test_username = probe-%{backend_host} cluster_backend_test_password = # shared password # Passdb configuration for monitoring users first: passdb test-accounts { args = /etc/dovecot/cluster-test-accounts.passwd fields { proxy = y password = # shared password } driver = passwd-file } # Passdb for the real users: #passdb ldap { # ... #} ``` See: * [[setting,cluster_backend_test_username]] * [[setting,cluster_backend_test_password]] #### Site reachability checks If Palomar is configured with multiple sites the proxies on each site execute site-reachability checks for the other sites. This way Palomar knows if there are TCP connections possible to the other sites and can determine the reachability state of sites. Ensure load balancer allows incoming connections to the proxies' health-check port. See `doveconf service/health-check/inet_listener/reachability/port` for the port (default 53069). See [[link,health_checking]] for more details on the health-checking Service. The results of the reachability checks are written to GeoDB `proxy_dest_stats` table and include all three `site_reachability_` metrics([[setting,@cluster_defaults,proxy]]). These metrics are interpreted by controller, which takes action and updates the sites reachability based on this data. ## Dovecot Backend [[link,palomar_backend,Dovecot Backends]] perform all work related to protocol commands and interfaces with the storage. ### Installation A Dovecot Backend requires the **dovecot-pro-cluster** package. ### Configuration Documentation on cluster settings can be found [below](#palomar-configuration-settings). ```doveconf[dovecot.conf] # Name of the backend (same as in geodb) cluster_backend_name = hac-dc1-be3 # Name of the backend's local site cluster_local_site = DC1 # Include all the required settings for running in cluster backend mode @cluster_defaults = backend @metric_defaults = backend ``` #### GeoDB / LocalDB #### Doveadm #### Monitoring Users Each backend must receive test user logins from proxies. The users can be in the same passdb as the real users, or they can have a separate passdb. In the latter case, it should be placed as the first passdb to catch the test users. ```doveconf[dovecot.conf] # Passdb configuration for monitoring users first: passdb { args = /etc/dovecot/cluster-test-accounts.passwd driver = passwd-file } # Passdb for the real users: #passdb ldap { # ... #} # Backends use this to avoid moving the test user to other backends cluster_backend_test_username = probe-%{backend_host} ``` Depending on the configuration, the test users may also need explicit [[link,userdb]] configuration so they can successfully log in. See: * [[setting,cluster_backend_test_username]] * [[setting,cluster_backend_test_password]] ## Cassandra You need to setup a Cassandra namespace for Palomar. ::: details Cassandra Setup ```cql create table if not exists tags ( id uuid, tag text, primary key ((id)) ); create table if not exists sites ( id uuid, name text, tag uuid, load_balancer text, status text, force_move_id uuid, force_move_percentage int, force_move_dest text, primary key ((id)) ); create table if not exists site_reachability ( src_site_id uuid, dest_site_id uuid, reachable int, primary key ((src_site_id), dest_site_id) ); create table if not exists backends ( id uuid, site_id uuid, load_factor int, host text, status text, status_reason text, user_count_approx int, last_moved_from text, last_moved_to text, move_id uuid, move_counter_cur int, move_counter_max int, force_move_id uuid, force_move_percentage int, force_move_dest text, primary key ((site_id), id) ); create table if not exists backend_stats ( site_id uuid, id uuid, key text, value double, type text, primary key ((site_id), id, key) ); create table if not exists proxy_dest_stats ( proxy_site_id uuid, proxy_host text, dest_host text, key text, value double, type text, primary key ((proxy_site_id), dest_host, proxy_host, key) ); create table if not exists user_sites ( username text, site_id uuid, backend_id uuid, preferred_site int, metacache_last_host text, primary key ((username), site_id), ); create table if not exists cluster_settings ( section text, site_id uuid, backend_id uuid, setting_name text, setting_value text, primary key ((section), site_id, backend_id, setting_name), ); ``` ::: ## Settings ### Palomar Core Configuration ### Cluster Controller See [[link,cluster_controller_settings]]. # Palomar: Cluster Controller Chart
Parameter Description Type Default
{{ k }} {{ v.type }}
::: warning No data: Did not download schema (missing GITLAB_TOKEN) ::: # Palomar: Cluster Controller Cluster Controller is the Palomar component that manages the cluster state for a given site. Think of it as the "brain" of your Palomar cluster — it continuously tracks the health and activity of all mail Backends, and makes decisions about where users should be located, automatically responding to problems. While it uses proxying statistics to assess system health, it does not directly monitor the backends themselves. Each Cluster site has to have **one** Cluster Controller running. The Controller provides health checks, load balancing, evacuation automation, and API access to GeoDB. If the Cluster Controller goes down, there is no immediate impact to the cluster (mail continues to flow normally), but it needs to be brought back as soon as possible to maintain automation and monitoring capabilities. ::: warning Cluster Controller will not provide automation to more than its home site. Every Palomar site requires a Cluster Controller to be running. ::: ## Installation See [[link,cluster_controller_installation]]. ## Architecture The Cluster Controller consists of several components that work together to manage your mail cluster. ```mermaid %%{init: {'theme': 'dark'}}%% flowchart TD subgraph Legend [Legend] direction LR L1[User Interface] ~~~ L2[Compute Layer] ~~~ L3[Data Layer] ~~~ L4[Backends Layer] end Legend ~~~ CLUSTER_ADMIN CLUSTER_ADMIN([Dovecot Cluster Administrator]) --> FRONTEND[Frontend] CLUSTER_ADMIN --> REST_API subgraph ClusterController [Cluster Controller] direction TB FRONTEND REST_API[REST API] CELERY_TASKS[Celery Tasks] REDIS[(Redis)] PROMETHEUS[(Prometheus)] FRONTEND --> REST_API REST_API --> CELERY_TASKS REST_API --> REDIS CELERY_TASKS --> REDIS CELERY_TASKS --> PROMETHEUS end REST_API --> CASSANDRA[(Cassandra)] REST_API --> DOVECOT_BACKENDS[Dovecot Backends] CELERY_TASKS --> CASSANDRA CELERY_TASKS --> DOVECOT_BACKENDS PROMETHEUS --> DOVECOT_BACKENDS style FRONTEND fill:#a8d5ba,stroke:#333,color:#000 style REST_API fill:#87ceeb,stroke:#333,color:#000 style CELERY_TASKS fill:#87ceeb,stroke:#333,color:#000 style CASSANDRA fill:#f4a460,stroke:#333,color:#000 style REDIS fill:#f4a460,stroke:#333,color:#000 style PROMETHEUS fill:#f4a460,stroke:#333,color:#000 style DOVECOT_BACKENDS fill:#dda0dd,stroke:#333,color:#000 style L1 fill:#a8d5ba,stroke:#333,color:#000 style L2 fill:#87ceeb,stroke:#333,color:#000 style L3 fill:#f4a460,stroke:#333,color:#000 style L4 fill:#dda0dd,stroke:#333,color:#000 ``` ### What Each Component Does | Component | What It Does | Why It Matters | | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | | **Frontend (Web UI)** | Browser-based dashboard showing cluster status, Backend health, and controls for manual operations | Allows administrators to monitor the cluster and perform operations without using the API directly | | **REST API** | HTTP endpoints for all Controller operations | Enables automation, scripting, and integration with other systems | | **Celery (Scheduler & Workers)** | Triggers background tasks on a schedule (every 5-60 seconds depending on the task). Execute the actual work: checking health, moving users, calculating load scores. | Ensures continuous monitoring even when no administrator is watching. The "muscle" that carries out all automated operations | ### Data Stores The Cluster Controller requires one external service and includes two bundled services: **External Service (Customer-Provided):** | Store | What It Stores | What Happens If It's Down | | --------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------- | | **Cassandra (GeoDB)** | Permanent cluster state: which sites exist, which Backends are in each site, user locations, feature flag settings | Controller cannot function - all state is lost. Must be highly available. | **Bundled Services (Included with Controller Deployment):** | Store | What It Stores | What Happens If It's Down | | -------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | **Redis** | Temporary data: task queue, cached metrics, ongoing move tracking | Tasks stop executing, UI shows stale data. Controller recovers automatically when Redis returns. | | **Prometheus** | Time-series metrics from all Backends: CPU, memory, login success/failure rates | Health checking and load balancing become blind - no automatic decisions can be made. Manual operations still work. | Redis and Prometheus are provided via the Helm chart or Docker Compose deployment and shouldn't be replaced with external instances. ### Site Reachability Monitoring Site reachability monitoring is performed by the cluster plugin running in Dovecot proxies. ::: warning The reachability feature is currently only visible in the UI and can be accessed via the API — no automatic action is taken. ::: ## Background Tasks The Controller runs several automated tasks that keep your cluster healthy. These tasks run continuously in the background without administrator intervention. The background task lifecycle is briefly described by below diagram. ```mermaid %%{init: {'theme': 'dark', 'themeVariables': { 'primaryColor': '#861BE4', 'primaryTextColor': '#FFFFFF', 'primaryBorderColor': '#a855f7', 'lineColor': '#6b21a8', 'secondaryColor': '#1a0a2e', 'tertiaryColor': '#0E0D10', 'actorBkg': '#861BE4', 'actorBorder': '#a855f7', 'actorTextColor': '#FFFFFF', 'signalColor': '#6b21a8', 'signalTextColor': '#FFFFFF', 'noteBkgColor': '#1a0a2e', 'noteTextColor': '#FFFFFF', 'activationBorderColor': '#a855f7', 'activationBkgColor': '#9833FF', 'labelBoxBkgColor': '#1a0a2e', 'labelTextColor': '#FFFFFF'}}}%% sequenceDiagram participant Beat as Celery Beat
(Scheduler) participant Redis as Redis
(Queue) participant Worker as Celery Worker participant Prom as Prometheus participant DB as Cassandra participant Backend as Dovecot Backend Beat->>Redis: Schedule task (every Xs) Redis->>Worker: Dequeue task Worker->>DB: Check feature flags alt Feature Enabled Worker->>Prom: Query metrics Worker->>DB: Read/Update state Worker->>Backend: Execute action (doveadm) else Feature Disabled Worker->>Worker: Skip (raise Ignore) end ``` Scheduled / automatically triggered tasks: | Task | How Often | What It Does | | --------------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | `cache_metrics` | Every 5 seconds | Fetches fresh metrics from Prometheus and caches them in Redis. This makes the Web UI responsive and ensures other tasks have current data. | | `scrape_stats` | On demand | Automatically triggered each time Prometheus scrapes the Controller API - `/metrics` endpoint, ensuring up-to-date stats are collected. | | `check_user_moves` | Every 5 seconds | Monitors ongoing user migrations. If a move gets stuck (Backend not responding), it retries or escalates to a force-move. | | `rebalance_sites` | Every 60 seconds | Analyzes load across all Backends. If one Backend is significantly more loaded than others, moves some users to balance the load. | | `check_Backend_health` | Every 60 seconds | Checks if Backends are healthy by looking at login and mail delivery success rates. Automatically evacuates users from failing Backends. | | `evacuate_zero_load_factor_hosts` | Every 60 seconds | Moves users off Backends that have been marked for decommissioning (load_factor = 0). | | `check_site_reachability` | Every 60 seconds | Tests connectivity to remote sites in multi-site deployments. | | `delete_stale_data` | Every 24 hours | Cleans up orphaned records in the database (e.g., statistics for Backends that no longer exist). | ::: tip What if a task fails? Individual task failures are logged but don't kill the Cluster Controller. The task will be retried on the next scheduled run. The Controller continues running because these failures are often temporary (e.g., network, brief service outages). Persistent failures usually indicate a problem with an external service (Prometheus, Cassandra, or a Backend). Check the Cluster Controller logs for details. **Important for health checking:** Just because the Cluster Controller process is up doesn't mean it's successfully executing the tasks you expect. Monitor the logs to verify that scheduled tasks are completing successfully. ::: ## Feature Flags All automated behavior is controlled by feature flags. For example, health checking can be enabled or disabled independently. This gives you fine-grained control over what the Controller does automatically versus what requires manual intervention. ### Why Feature Flags? When you first deploy a Controller or make significant changes, you may want to: - **Observe** what the Controller would do without actually doing it (DryRun mode) - **Disable** automation for specific Backends during maintenance - **Enable** automation gradually, starting with less critical sites ### Flag Hierarchy Feature flags are defined at three levels: Global, Site, and Backend. Precedence is top-down — once a feature is disabled at a higher level, lower-level settings cannot re-enable it. ```mermaid %%{init: {'theme': 'dark', 'themeVariables': { 'primaryColor': '#6366f1', 'primaryTextColor': '#f8fafc', 'primaryBorderColor': '#818cf8', 'lineColor': '#94a3b8', 'secondaryColor': '#1e293b', 'tertiaryColor': '#0f172a', 'background': '#0f172a', 'mainBkg': '#1e293b', 'nodeBorder': '#475569', 'clusterBkg': '#1e293b', 'clusterBorder': '#475569', 'titleColor': '#f8fafc', 'edgeLabelBackground': '#1e293b'}}}%% flowchart LR Global["GLOBAL (default for entire cluster)"] Site["SITE (override for one site)"] Backend["BACKEND (override for one Backend)"] Global -->|overridden by| Site Site -->|overridden by| Backend classDef primary fill:#6366f1,stroke:#818cf8,stroke-width:2px,color:#f8fafc classDef secondary fill:#3b82f6,stroke:#60a5fa,stroke-width:2px,color:#f8fafc classDef accent fill:#8b5cf6,stroke:#a78bfa,stroke-width:2px,color:#f8fafc class Global primary class Site secondary class Backend accent ``` ::: todo API endpoint for Backend feature flags configuration doesn't exist yet ::: **Example**: You enable load balancing globally, but disable it for a specific Backend that you're troubleshooting. The rest of the cluster continues to balance automatically while that one Backend is excluded. ### Available Features | Feature | What It Controls | When to Disable | | --------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------- | | `MetricsExport` | Whether the Controller collects and exports metrics. Required for all other features. | Rarely - disabling this blinds the Controller | | `BackendHealthAutoHandling` | Automatic detection of failing Backends and user evacuation | During planned maintenance when you expect temporary failures | | `BackendLoadBalancing` | Automatic movement of users to balance load across Backends | When you want manual control over user placement | ### Feature States | State | What Happens | | ------------ | --------------------------------------------------------------------------------------- | | **Enabled** | Full automation - the Controller acts on its decisions | | **Disabled** | No automation - the feature doesn't run at all (default) | | **DryRun** | The Controller makes decisions and logs them, but doesn't execute. Perfect for testing. | ::: tip Recommended Workflow 1. Start with only the **MetricsExport** feature enabled, and verify metrics are flowing 2. Enable features in **DryRun** mode and review logs 3. Once you're confident, switch to **Enabled** ::: Feature flags can be managed via the Controller API or the Controller Web UI under "Site Features". ## Load Balancing Load balancing ensures users are distributed evenly across your Backends. Without it, some Backends might become overloaded while others sit idle - leading to poor performance for some users and wasted capacity. When `BackendLoadBalancing` feature is disabled on the Backend level then this Backend is not a part of (load)balancing. ### How It Works Every 60 seconds, the Controller: 1. **Retrieves metrics**: The Controller queries usage metrics (CPU, memory, metacache pressure) from Prometheus. Prometheus is populated by the scrape_stats task, which scrapes GeoDB rather than the Backends directly. 2. **Calculates a score** for each Backend indicating how loaded it is relative to others 3. **Finds the most imbalanced pair** - the most loaded and least loaded Backends 4. **Moves users** from the overloaded Backend to the underloaded one (if the imbalance exceeds a threshold) ```mermaid flowchart TD Start([Every 60 seconds]) GetScores["Calculate load score
for each Backend"] FindPair["Find most loaded and
least loaded Backends"] CheckDelta{"Is the difference
significant enough?"} MoveUsers["Move some users from
overloaded → underloaded"] Done([Wait for next cycle]) Skip([No action needed]) Start --> GetScores GetScores --> FindPair FindPair --> CheckDelta CheckDelta -->|"Yes (delta > threshold)"| MoveUsers CheckDelta -->|"No"| Skip MoveUsers --> Done Skip --> Done ``` ### The Z-Score: Measuring "How Loaded" The Cluster Controller uses a statistical measure called Z-score to compare Backends fairly. The Z-score tells you how far a Backend is from the average: - **Z-score > 0**: Backend is more loaded than average - **Z-score < 0**: Backend is less loaded than average - **Z-score = 0**: Backend is exactly at average The formula combines multiple metrics (memory, CPU, metacache) into a single score, so a Backend with high memory but low CPU is compared fairly against one with low memory but high CPU. ### When Load Balancing Skips a Backend A Backend is excluded from load balancing if: - It's not online (status is `offline` or `standby`) - It has a user move already in progress - It was recently involved in a move ([[setting,HOST_LOAD_BALANCE_MIN_COOL_TIME_SECS]]) - There isn't enough historical data to calculate a reliable score ([[setting,HOST_LOAD_BALANCE_MIN_SAMPLES]]) - It's failing health checks (if lmtp or login failure > [[setting,HOST_FAILURE_RATIO]]) ### Configuration | Setting | What It Controls | | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- | | [[setting,HOST_LOAD_BALANCE_SCORE_DELTA_THRESHOLD_RATIO]] | How different two Backends must be before moving users. Higher = less sensitive. | | [[setting,HOST_LOAD_BALANCE_MIN_COOL_TIME_SECS]] | How long to wait before moving the same user again. Prevents thrashing. | | [[setting,HOST_LOAD_BALANCE_MIN_SAMPLES]] | Minimum data points needed before trusting a Backend's score. New Backends need time to gather data. | ## Health Checking Health checking automatically detects and responds to failing Backends. When a Backend starts failing (e.g., rejecting logins, failing to deliver mail), the Controller moves users away before they're significantly impacted. ### How It Works Every 60 seconds, the Controller: 1. **Fetches statistics** for each Backend: how many logins succeeded vs failed, how many LMTP mail deliveries succeeded vs failed 2. **Calculates failure rates**: What percentage of operations are failing? 3. **Takes action** based on how severe the failures are ```mermaid flowchart TD Start([Every 60 seconds]) FetchMetrics["Get login and delivery
statistics from Prometheus"] ForEach["Check each Backend"] CalcRate["Calculate failure rate:
failures ÷ total attempts"] CheckSevere{"Failure rate
> 90%?"} CheckHigh{"Failure rate
> 10%?"} Evacuate["CRITICAL: Evacuate all users, when no users then set Backend OFFLINE"] MovePartial["WARNING: Move some users
to healthy Backends"] Healthy["Backend is healthy
No action needed"] Start --> FetchMetrics FetchMetrics --> ForEach ForEach --> CalcRate CalcRate --> CheckSevere CheckSevere -->|Yes| Evacuate CheckSevere -->|No| CheckHigh CheckHigh -->|Yes| MovePartial CheckHigh -->|No| Healthy ``` ### Failure Thresholds | Condition | What Happens | | --------------------------------- | --------------------------------------------------------------------------------------------------------- | | **> 90% failures** | Backend is critically failing. All users are evacuated. When no users are left, status is set to OFFLINE. | | **> 10% failures** (configurable) | Backend is degraded. Some users are moved away to reduce load and see if it recovers. | | **< 10% failures** (configurable) | Backend is healthy. No action taken. | ::: warning Cluster Controller for the critical failure case try to move 20% of original number of users instead of current amount to avoid taking too long for the Backend to be evacuated. ::: ### Recovery While a Backend is offline, proxies are periodically checking when it comes back online. When the health check succeeds, the Controller automatically brings the Backend back online. Users can then be moved back by normal load balancing. ### Catastrophe Protection What if many Backends fail at once (e.g., a network issue affecting half your data center)? Moving all users to the remaining Backends could overload them, making the situation worse. The Controller has built-in protection: - If more than 30% (configurable) of Backends would be taken offline, automatic evacuations stop - A critical alert is raised for manual intervention - The administrator can then assess the situation and decide how to proceed ::: warning When Catastrophe Protection Triggers Check the Controller logs immediately. This usually indicates a serious infrastructure problem (network outage, storage failure, etc.) rather than individual Backend issues. ::: ### Configuration | Setting | What It Controls | | ---------------------------------------------- | -------------------------------------------------------------------------------------- | | [[setting,HOST_FAILURE_RATIO]] | Failure rate threshold for moving users. Lower = more sensitive. | | [[setting,HOST_FAILURE_MIN_LOGINS]] | Minimum attempts before making decisions. Prevents overreacting to small sample sizes. | | [[setting,HOST_FAILURE_COOL_TIME_SECS]] | Minimum time in seconds between moving users from a host with failing logins. | | [[setting,HOST_FAILURE_BACKEND_NUM_THRESHOLD]] | Maximum percentage of Backends that can fail before catastrophe protection kicks in. | ## Manual Operations While the Controller automates most operations, sometimes you need manual control - for planned migrations, emergency evacuations, or testing. ### Batch Move Users Gradually migrates a percentage of users from one site to other sites. The Cluster Controller sends a request to the Backend to move users (doveadm [[doveadm,cluster user batch move backend]] command). If [[setting,HOST_FAILURE_COOL_TIME_SECS]] is set the `min-last-moved` parameter is added to doveadm command. This is used to avoid moving the same users too often. ::: todo Add reference to the OpenAPI batch move users post ::: **Use cases:** - Planned data center migration over several days - Gradually shifting load to a new site - Reducing capacity at one site before maintenance ### Force Move Users Immediately moves a percentage of users in a single operation. Faster than batch move but more disruptive. ::: todo Add reference to the OpenAPI force move users post ::: **Use cases:** - Emergency evacuation when a site is failing - Quick capacity rebalancing - Testing migration procedures ### Manual Rebalance Triggers (via REST API request) an immediate load rebalancing cycle without waiting for the 60-second schedule. ::: danger REST API See [[link,palomar_rest_api]] for the complete API reference. ::: **Use cases:** - After adding new Backends that need users - After maintenance when you want immediate redistribution - Testing load rebalancing behavior ## API Endpoint The Controller API provides programmatic access to all Controller functions. You can: - Create, read, update, and delete sites and Backends - Query cluster statistics and metrics - Trigger manual operations - Manage feature flags The API also exposes an OpenMetrics endpoint for monitoring systems to scrape Controller metrics. ::: danger REST API See [[link,palomar_rest_api]] for the complete API reference. ::: ## Web UI The Controller includes a browser-based administration interface. Access it by navigating to your Controller's HTTP endpoint (default port 8080). The UI provides: - **Dashboard**: Overview of all sites and their health status - **Backend list**: Detailed status of each Backend with real-time metrics - **Feature flags**: Toggle automation features on/off - **Operations**: Trigger manual moves and rebalancing - **Site reachability**: View connectivity status between sites ## Administration See [[link,palomar_administration]]. # Cluster Controller: Installation ::: warning To install cluster controller you need to first [[link,palomar_configuration,setup Palomar]]. ::: Cluster Controller requires either: * a Kubernetes cluster * a Docker environment ## High Availability Cluster controller is not required to be highly available itself. (In fact, it can't be HA as it is REQUIRED that only a single instance is running in a site at one time.) However, controller is required to optimize Palomar performance so maximum availability of the service should be the goal. Thus, installation of controller should be done in such a way to ensure maximum availability of the component. ## Node Sizing We recommend setting up a highly-available Kubernetes cluster with at least 2 worker nodes to ensure proper availability and resilience for the Cluster controller service. Alternatively, as a fallback option, you can deploy a single-node Kubernetes cluster using Minikube or a similar tool, OR run the service on a single machine with Docker Compose. In both scenarios, each node should have **at least 4 CPU cores and 8 GB of memory**. ## Pre-Requisites The Controller relies on a few external services. - NoSQL Database (Cassandra) - In-Memory Key-Value Store (Redis) ### Cassandra Controller requires Cassandra as a NoSQL database to store the GeoDB database, which tracks cluster state and other essential data. ::: tip The Cassandra dependency can be automatically provided by the Controller deployment methods. Otherwise, the Controller can be configured to connect to an external Cassandra database instead. ::: See [[link,geodb]], or more generally [[link,dovecot_pro_cassandra]]. ###### Redis Controller requires a Redis cluster for task scheduling and runtime cache storage. ::: tip The Redis dependency can be automatically provided by the Controller deployment methods. Otherwise, the Controller can be configured to connect to an external Redis database instead. ::: See [[link,palomar_redis]]. ## Kubernetes Installation You need to use [Helm package manager](https://helm.sh) to install cluster controller chart. ::: info See [[link,kubernetes_support]] for details on Kubernetes version support. Any recent version of Helm should be OK. ::: ### Installation Steps #### Repository Authentication Before installing the helm chart, you will need to make sure you have access to the Open-Xchange container registry and have your helm logged in. ```console helm registry login registry.open-xchange.com ``` This step is needed once. After a successful login, helm will not normally need to be re-authenticated. #### LittleRed Kubernetes operator for Redis If using Redis deployed within the Cluster Controller Chart, you need to make sure you have [LittleRed operator](https://github.com/littlered-operator/littlered) installed and available within you kubernetes cluster. Cluster Controller has been tested with version 0.2.1 but any newer version should also be fine. #### Chart Configuration Create `global.yaml` and `controller.yaml` files for your site. See [[link,controller_chart]] for values applicable for this chart, with `global.yaml` containing the parameters starting with `global.` (that will be shared with other charts in the future) and `controller.yaml` with the other controller-specific parameters. ::: info NOTE Cluster controller expects to be deployed in a dedicated Kubernetes namespace. ::: #### Chart Install To install, run: ```console helm install oci://registry.open-xchange.com/dovecot-pro/charts/controller --version -f global.yaml -f controller.yaml -n ``` Example: ```console helm install controller oci://registry.open-xchange.com/dovecot-pro/charts/controller --version 3.0.0 -f global.yaml -f controller.yaml -n dovecot ``` If everything goes well, you should now have a functional controller. ### Rollback You can use Helm package manager to rollback to a previous working version of your Cluster Controller chart. First, you need to identify the revision number of the release you want to rollback to. You can list all the previous releases of your Helm chart with: ```console helm history ``` Once you have identified the revision number you want to revert to, you can perform the rollback with: ```console helm rollback ``` After executing the rollback, you can verify that the rollback was successful by checking the status of the release: ```console helm status ``` ## Docker Compose Installation Experimental Even though the primary method to install cluster controller is on Kubernetes managed deployments, It is possible to install it via docker compose as well. All the files needed for this installation method are bundled in a traditional package included in dovecot-pro repositories. The package does not have any dependencies against docker or docker compose and it's left for the administrator to choose their preferred method of installing them. ::: warning Dependencies - **Docker**: Any recent version should be sufficient. - **Docker Compose**: The provided `systemd` unit file uses the `docker compose` command (v2), which is the plugin integrated with the Docker CLI from the official Docker repository. While the standalone `docker-compose` might also work, it has not been tested and is not supported. ::: The package includes a compose file along with extra configuration files needed to run various services need for controller. A systemd unit file is also included that invokes the docker compose file to to start or stop all containers. ### Installation Steps #### Repository Authentication Before installing the controller compose package, you will need to make sure you have access to the Open-Xchange container registry and have your docker logged in. ```console docker login registry.open-xchange.com ``` This step is needed once. After a successful login, docker will not normally need to be re-authenticated. #### Package Install Install `dovecot-pro-controller-compose` package from Dovecot Pro repositories. Once installed, all the configuration files will be located at `/etc/dovecot-pro-controller-compose` and the docker-compose.yml file with other scripts used in deployment will be located at `/usr/share/dovecot-pro-controller-compose/`. #### Cluster Configuration The controller configuration file is located at `/etc/dovecot-pro-controller-compose/controller_config`. Please refer to [[link,cluster_controller_settings]] for all available options. Review and apply any necessary changes. #### Deployment Variables Apart from cluster controller's configuration options, there are various deployment variables that can be tweaked to customize deployment. An example `example.env` file is included with the compose package (located in /etc/dovecot-pro-controller-compose directory) that contains a list of key-value pairs for all these deployment variables: | Variable Name | Description | Default | | ------------- | ----------- | ------- | | `CONTROLLER_IMAGE_URL` | URL of the registry used to pull the cluster controller image from. | `registry.open-xchange.com/dovecot-pro/controller` | | `CONTROLLER_IMAGE_TAG` | Docker image tag of the cluster controller version used. | `` | | `CONTROLLER_API_LOG_LEVEL` | Log level set for cluster controller API container. | `info` | | `CONTROLLER_WORKER_LOG_LEVEL` | Log level set for cluster controller worker container. | `info` | | `CONTROLLER_SCHEDULER_LOG_LEVEL` | Log level set for cluster controller scheduler container. | `info` | | `CONTROLLER_WORKER_LOW_PRIO_REPLICAS` | Number of replicas for controller worker performing low priority tasks. | `2` | | `CONTROLLER_WORKER_HIGH_PRIO_REPLICAS` | Number of replicas for controller worker performing high priority tasks. | `1` | | `REDIS_IMAGE_URL` | URL of the registry used to pull Redis image from. | `docker.io/library/redis` | | `REDIS_IMAGE_TAG` | Docker image tag of the Redis version used. | `8.6.3` | | `CONTROLLER_REDIS_REPLICAS` | Number of replicas for Redis containers. | `1` | | `PROMETHEUS_IMAGE_URL` | URL of the registry used to pull Prometheus image from. | `quay.io/prometheus/prometheus` | | `PROMETHEUS_IMAGE_TAG` | Docker image tag of the Prometheus version used. | `25.8.2` | | `CLUSTER_SITE_LOAD_BALANCER`| Site load balancer hostname in multi site deployments | | `CONFIG_PATH` | Path to user modifiable config files | `/etc/dovecot-pro-controller-compose` | | `ASSETS_PATH`| Path to docker compose files and scripts | `/usr/share/dovecot-pro-controller-compose` | Rename the example file to `dovecot-pro-controller-compose.env` or create a new file in the same folder with modified values. ```console cp /etc/dovecot-pro-controller-compose/example.env /etc/dovecot-pro-controller-compose/dovecot-pro-controller-compose.env ``` ::: danger Env file Overridden variables *must* be in `dovecot-pro-controller-compose.env` file otherwise the default values will be used. ::: #### Cassandra Initialization It is expected that there is an external Cassandra cluster running and the address of the server(s) is passed to controller in settings (refer to controller configuration described above). Therefore, the keyspace and all tables needed for Palomar to function need to have been correctly created for controller to function properly. It is possible, however, to enable automatic initialization of the database as part of the deployment. If enabled, the keyspace and necessary tables are created if missing from the database based on the parameters described in the table below. Most of these initialization parameters are a direct translation of some of Chart settings for Kubernetes deployments as described in [[link,controller_chart]]. For `docker-compose` installations these settings must be in the same config file as other settings outlined above. | Variable Name | Description | Default | | ------------- | ----------- | ------- | | `INIT_GEODB_SCHEMA` | Initialize the Cassandra schema (keyspace and tables) needed for Palomar. | `True` | | `CASSANDRA_DATACENTER_REPLICATIONFACTOR` | A sequence of data centers and their configured replication factor on the Cassandra cluster (can be a Python dict or list object). Each element in the sequence is a string containing datacenter and its replication factor separated by comma. | (
  "datacenter1:1",
  "datacenter2:2",
  "datacenter3:3",
) | | `CASSANDRA_GEODB_KEYSPACE` | Cassandra keyspace used for Palomar GeoDB. Must have the same value as [[setting,CASSANDRA_KEYSPACE]] controller setting. | `"d8s_cluster"` | | `INIT_SITE` | Should the site be created as well. If enabled, controller API is used to create a site with name taken from [[setting,CLUSTER_SITE]] controller setting. | `True` | | `DOMAIN` | Public FQDN of the cluster site load balancer. Used when creating the site if `INIT_SITE` is true. | `"d8s.test"` | | `DICTMAP_ENABLED` | Whether fs-dictmap is configured for Dovecot object storage. | `True` | | `INIT_DICTMAP_SCHEMA` | Initialize the Cassandra schema (keyspace and tables) used for fs-dictmap. | `True` | | `CASSANDRA_DICTMAP_KEYSPACE` | Cassandra keyspace used for fs-dictmap. | `"d8s_dovecot"` | | `CASSANDRA_AUTHENTICATION` | Cassandra credentials
{
  'module': 'cassandra.auth',
  'classname': 'PlainTextAuthProvider',
  'username': 'username',
  'password': 'password'
} | | `CASSANDRA_TLS_OPTIONS` | Cassandra connection TLS options
{
  'verify': True,
  # If not set, default location /etc/ssl/certs is used
  'cacert_file': "/path/to/file",
  'cacert_dir': "/path/to/dir/"
} | #### Start Container Start cluster controller either by invoking `docker compose` directly or by using the systemd service. ```console docker compose -f /usr/share/dovecot-pro-controller-compose/docker-compose.yml --env-file /etc/dovecot-pro-controller-compose/dovecot-compose-controller.env up ``` Or ```console systemctl start dovecot-cluster-controller ``` # Palomar: Cluster Controller Settings This page lists settings used by the [[link,cluster_controller]]. For Dovecot Core Palomar settings, see [[link,palomar_configuration_settings]]. ## Configuration Notes ### Default Configuration All deployment methods provide a default `controller.cfg` that should get you started and allow you to tweak settings based on your needs (e.g, configuration of an external Cassandra). ### Database [[link,geodb]] is automatically populated with local site information during installation for all deployment methods. You can also manually add new sites using Controller's admin UI or by making API calls to the Controller. ### Backend Initialization This is automated ONLY in Kubernetes deployments. For Docker Compose setups, please refer to [[link,palomar_administration]] section for details on how to populate backends into GeoDB. Alternatively, you can use Controller API linked above to add the backends. ## Monitoring There is no strict monitoring for Cluster Controller, but using standard methods to track the state of your containers or pods is recommended. Additionally, a basic UI is available on the controller-api container, allowing graphical interaction with Cluster Controller. ## Settings # Palomar: Cluster Controller UI Experimental ::: todo - Installation - Access - Authentication ::: # Recommended Metrics ## Dovecot Proxy ## Dovecot Backend ### Email IO metrics `@metric_defaults = backend` contains: `mail_read` : Number of email GET requests to HTTP-based object storage. See [[event,http_request_finished]]. `mail_write` : Number of email PUT requests to HTTP-based object storage. See [[event,http_request_finished]]. `mail_delete` : Number of email DELETE requests to HTTP-based object storage. See [[event,http_request_finished]]. ### FTS index IO/CPU metrics `fts_read` : Number of FTS object GET requests to HTTP-based object storage, including size of the objects. See [[event,http_request_finished]]. `fts_write` : Number of FTS object PUT requests to HTTP-based object storage, including size of the objects. See [[event,http_request_finished]]. `fts_delete` : Number of FTS object DELETE requests to HTTP-based object storage. This is normally very close to `fts_write`. See [[event,http_request_finished]]. `indexer_worker_indexing_finished` : Number of FTS indexing sessions, including the user space CPU usage. See [[event,indexer_worker_indexing_finished]]. ### Index IO metrics `@metric_defaults = backend` contains: `metacache_user_refresh_finished_refreshed_changed` : Number of mail sessions where user's metacache was refreshed by listing index objects in storage, and new changes were found. See [[event,metacache_user_refresh_finished]]. `metacache_user_refresh_finished_refreshed_unchanged` : Number of mail sessions where user's metacache was refreshed by listing index objects in storage, and metacache was already up-to-date. See [[event,metacache_user_refresh_finished]]. `metacache_mailbox_refresh_finished_refreshed_changed` : Number of mailbox accesses where metacache was refreshed by listing index objects in storage, and new changes were found. See [[event,metacache_mailbox_refresh_finished]]. `metacache_mailbox_refresh_finished_refreshed_unchanged` : Number of mailbox accesses where metacache was refreshed by listing index objects in storage, and metacache was already up-to-date. See [[event,metacache_mailbox_refresh_finished]]. `metacache_user_bundle_upload_finished` : Number of user index bundle uploads and the bundle sizes, grouped by bundle type. See [[event,metacache_user_bundle_upload_finished]]. `metacache_mailbox_bundle_upload_finished` : Number of mailbox index bundle uploads and the bundle sizes, grouped by bundle type. See [[event,metacache_user_bundle_upload_finished]]. `metacache_user_clean_finished` : Number of metacache cleans, grouped by `min_priority`. If you see these metrics grow much higher than usual, metacache may be too small. See [[event,metacache_user_clean_finished]]. `obox_mailbox_rescan_finished` : Number of mailbox accesses resulting in listing mail objects in storage. See [[event,obox_mailbox_rescan_finished]]. `obox_mailbox_rebuild_finished` : Number of mailbox accesses resulting in rebuilding the mailbox index, including listing mail objects in storage. See [[event,obox_mailbox_rebuild_finished]]. ### Cluster specific events `@metric_defaults = backend` contains: `cluster_user_batch_move_finished` : Number of user batch moves (to another backend) successfully finished. See [[event,cluster_user_batch_move_finished]]. `cluster_user_move_finished` : Number of user moves (to another group/site) successfully finished. See [[event,cluster_user_move_finished]]. `cluster_user_move_failed` : Number of user moves failed. See [[event,cluster_user_move_finished]]. ### Detailed mail access and delivery metrics ```doveconf[dovecot.conf] metric imap_commands { filter = event=imap_command_finished group_by tagged_reply_state { } group_by cmd_name { } } metric imap_commands_slow { # In some installations there may be too many slow commands to be worth logging these exporter = log-export filter = event=imap_command_finished AND (NOT cmd_name=IDLE) AND duration > 1min } metric lmtp_commands { filter = event=smtp_server_command_finished AND protocol=lmtp group_by cmd_name { } } metric push_notifications { filter = event=push_notification_finished } metric sieve_actions { filter = event=sieve_action_finished group_by action_name { } } metric smtp_commands { filter = event=smtp_server_command_finished AND protocol=smtp group_by cmd_name { } } metric unknown_commands { exporter = log-export filter = (event=imap_command_finished OR event=smtp_server_command_finished) AND cmd_name=unknown } ``` See also: - [[event,imap_command_finished]], - [[event,push_notification_finished]], - [[event,sieve_action_finished]], - [[event,smtp_server_command_finished]], - [[event,smtp_server_command_finished]] and ### Events to catch bugs/problems ::: info The following events are usually logged as errors/warnings in any case, thus the log-export will likely cause duplicate logging. However, they may be easier to parse and may provide additional details. ::: ```doveconf[dovecot.conf] metric fs_dictmap_dict_write_uncertain { filter = event=fs_dictmap_dict_write_uncertain AND (NOT cleanup=failed) exporter = log-export } metric fs_dictmap_dict_write_uncertain_failed { filter = event=fs_dictmap_dict_write_uncertain AND cleanup=failed exporter = log-export } metric fs_dictmap_object_lost { filter = event=fs_dictmap_object_lost exporter = log-export # Note: file_type=fts is only in v2.3.15+ group_by file_type { } } metric fs_dictmap_max_bucket_changed_iter { filter = event=fs_dictmap_max_bucket_changed AND reason=iter exporter = log-export } metric fts_dovecot_too_many_triplets { # v2.3.15+ filter = event=fts_dovecot_too_many_triplets exporter = log-export } metric mail_cache_new_field_indexed { # Helps to find out if mail clients start fetching a new header filter = event=mail_cache_decision_changed AND reason=add # If growth is detected, export the events to find out what header is added: #exporter = log-export } metric metacache_pull_finished { exporter = log-export filter = event=metacache_pull_finished and error="" group_by type { } } metric metacache_pull_finished_failure { exporter = log-export filter = event=metacache_pull_finished and not error="" group_by type { } } ``` See also: - [[event,fs_dictmap_dict_write_uncertain]], - [[event,fs_dictmap_max_bucket_changed]], - [[event,fs_dictmap_object_lost]], - [[event,fts_dovecot_too_many_triplets]], - [[event,mail_cache_decision_changed]] and - [[event,metacache_pull_finished]]. # Dovecot Pro Palomar Architecture Dovecot Pro's Palomar Architecture replaces the earlier director-based clustering with a modern, scalable, and resilient **cluster service**. This design enables: - **Load balancing** between Proxies and Backends - **User stickiness**, ensuring each user is routed consistently to the same Backend - **High availability** across Backends and multi-site environments - **Load redistribution**, allowing users to be actively balanced across Backends - **Multi-site support**, enabling clusters to span multiple physical or virtual locations The principal goal is to ensure that users are serviced by a single Backend at any given time, optimizing caching and performance. In split-brain scenarios — particularly relevant with object storage and multi-site configurations — **[[plugin,obox,obox]]** resolves conflicts by merging changes and synchronizing user and site data when connectivity is restored. ## Overview ![Cluster image](./images/palomar_multisite.png) ## Sites A "site" is a collection of co-managed servers controlled by a **Cluster Controller**. - A single Palomar deployment can contain multiple sites. - Multi-site support allows cross-site failover and load distribution. - Sites can be virtual (contained within a data center). - Geo-redundant sites are only supported with Scality (sproxyd) storage. ## Architecture Components ### Dovecot Proxy The Proxy handles initial client connections across IMAP, POP3, LMTP, Submission, ManageSieve, and doveadm protocols. Responsibilities include: - Authentication and userdb lookups - Identity normalization - TLS handshakes (if not handled upstream) - Routing users to Backends See: [[link,palomar_proxy]]. ::: info Proxies are stateless and rely on the cluster service to ensure each user is consistently directed to a single Backend. ::: ### Dovecot Backend The Backend executes session-level operations and communicates with storage. See: [[link,palomar_backend]]. ### Dovecot Cluster Controller Controller manages the cluster state for a site. See: [[link,cluster_controller]]. ### Shared Infrastructure ::: todo ::: ### Authentication ::: todo ::: ### Storage Palomar uses the **obox mailbox format**, which is designed for consistency, performance, and reliability. See: [[link,palomar_storage]]. ### GeoDB A globally shared database (typically **Cassandra**) that tracks user assignments to Backends and sites. Proxies and Backends consult GeoDB to ensure consistent routing. See: [[link,geodb]]. ### OX Abuse Shield (Optional) Integrates with the Proxy to enforce authentication policies and mitigate abuse. See: [[link,palomar_ox_abuse_shield]]. ### External Load Balancer Distributes incoming traffic into the Proxy tier. - Must preserve client IP transparency or support **HAProxy PROXY Protocol v2**. - Proxies must remain separate from load balancers. ## Functional Areas ### 1. Sites - Managed by one Cluster Controller. - Multiple Proxies and Backends register to the site. - Multi-site support provides geographic redundancy and load distribution. ### 2. Users & Routing - Palomar provides built-in functionality to manage users. - Routing decisions and Backend assignments are tracked in **GeoDB**. - Proxies consult GeoDB to route users consistently to the correct Backend. ### 3. Health Checking - Controllers detect Backend health using **test accounts** (e.g., `probe-%{backend_host}`) that simulate normal user access. - This ensures accurate detection of degraded or failed Backends. - For configuration, see: [[link,palomar_monitoring_users]]. ### 4. Administration Administration is available via both **doveadm cluster** commands and a **REST API** exposed by the Controller. Examples: - **Site operations**: `doveadm cluster site add`, `site init` - **Backend operations**: `backend add`, `backend update status/load factor`, `backend evacuate` The REST API provides similar functionality for automation and scripting. ### 5. Statistics - Controllers aggregate metrics for load balancing. - Automatic redistribution is triggered when the **Z-score difference** between Backends crosses a defined threshold. - Backends report success/failure metrics to **Prometheus** (part of the Controller service) for monitoring. ### 6. Balancing - Controllers can automatically rebalance users to even load across Backends. - Balancing respects **retention periods** (users remain on a Backend for at least one hour). - Prometheus sampling must reach a sufficient threshold before redistribution is activated. - See [[link,palomar_load_rebalancing]]. ## Logging See [[link,palomar_logging]]. # Dovecot Pro Full Text Search Plugin (`fts-dovecot`) ::: info It is recommended to use [[setting,@fts_fs_defaults]] with the corresponding storage provider. Using this setting will set various settings by default: ::: details Click to show sproxyd example ```doveconf[dovecot.conf] fts dovecot { fs fts-cache { } fs fscache { path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log size = 512 M } fs compress { } fs crypt { } fs dictmap { dict proxy { name = mails socket_path = dict-async } } fs sproxyd { } } ``` ::: Dovecot Pro Full Text Search (FTS) is a proprietary, Pro-only FTS plugin. It provides fast and compact indexing of search data. All Dovecot indexes, including FTS indexes, are stored in the same storage (including object storage) used to store the mail and index data. No separate permanent storage media is needed for the FTS indexes. The pre and post processing of input data and search terms heavily relies on the upper level fts-plugin and lib-language. Most of the configuration options affect lib-language functionality. The Dovecot FTS indexes are created and queried by a custom FTS engine. The FTS engine component is loaded into the Dovecot FTS plugin as an index driver and it processes text input from the FTS tokenizer and filter chains and search queries constructed by the FTS plugin. ## Configuration Detailed setting information can be found [below](#settings). Example configuration: ::: code-group ```doveconf[dovecot.conf (common)] mail_plugins { fts = yes fts_dovecot = yes } # Don't fall back to built-in search. fts_search_read_fallback = no # Proactively index mail as it is delivered or appended, not only when # searching. fts_autoindex = yes # Exclude mailboxes we do not wish to index automatically. # These will be indexed on demand, if they are used in a search. namespace inbox { inbox = yes mailbox spam { special_use = \Junk fts_autoindex = no } mailbox trash { special_use = \Trash fts_autoindex = no } mailbox .DUMPSTER { fts_autoindex = no } } # This chain of filters first normalizes and lowercases the text, then stems # the words and lastly removes stopwords. language_filters = normalizer-icu snowball stopwords # These tokenizers will preserve addresses as complete search tokens, but # otherwise tokenize the text into "words". language_tokenizers = generic email-address language_tokenizer_generic_algorithm = simple # Detected languages. Languages that are not recognized fall back to the # default language. language en { # English # the default for detection default = yes # This chain of filters will first lowercase all text, stem the words, remove # possessive suffixes, and remove stopwords. filters = lowercase snowball english-possessive stopwords } language fr { # French } ``` ```doveconf[dovecot.conf (obox)] mail_driver = obox mail_path = %{user | sha1 % 256 | hex(2)}/%{user} fs_s3_url = http://mails.s3.example.com/ obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_objectid_prefix = %{user}/mails/ #lock_path = /tmp # Set only without lazy_expunge plugin } fs s3 { } } metacache { fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs s3 { } } fts dovecot { fs fts-cache { } fs fscache { size = 512M # NOTE: Use a different directory than for obox fscache path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs s3 { } } ``` ```doveconf[dovecot.conf (local / nfs)] fts dovecot { fs posix { prefix = %{home}/fts/ } } ``` ::: ## Settings ::: info Dovecot Pro FTS engine relies on Dovecot core FTS libraries (and configuration) for several features, including filtering and tokenization. See: [[plugin,fts]]. ::: ## Events ## Consistency Checking In Dovecot Pro FTS driver there are `doveadm fts check` commands, which can be used to determine whether rescan is necessary. The FTS indexes can sometimes become out-of-sync with the actual mailbox. Some messages could be missing and some could be leaked. In theory it should not be possible to have missing mails in FTS, but there still seem to be some bugs left. Leaked messages (i.e. already deleted messages that still appear in FTS) are possible in case of unexpected crashes or storage errors. The consistency of FTS indexes can be checked using `doveadm fts check fast` and `doveadm fts check full` commands. These are intended to be run in e.g. nightly batch jobs. The "fast" check is expected to be run nightly for all the users in local metacache, since it doesn't access object storage. However, it might not always have all the information for giving a reliable answer whether the FTS indexes are synced or not, in which case some of the numbers may be either "?" or "123?". There is a `--refresh` parameter, which can be used to do the necessary object storage accesses to give reliable results. However, at that point it might be better to just run a "full" check instead. After all backends in the cluster have been upgraded to the new Dovecot version, make sure [[setting,dovecot_storage_version]] is `2.3.21` or higher. This allows per-folder results for the "fast" scan, which makes the scan more reliable and more detailed. After the setting is enabled, all the triplets in fts.S files still need to be refreshed for the per-folder result to work. This happens for newly written triplets automatically, but eventually it is necessary to use the `--refresh` parameter (or some other method) to add the missing information for older triplets. When these checks are run nightly, it's possible to find out quickly when something breaks. This means it's possible to fix the FTS indexes before users notice that search isn't finding some messages. It also makes it easier for Dovecot developers to find and fix any remaining FTS bugs, because we can be sure that the bug happened within the last 24 hours and all the logs are still available during that time. The idea for the nightly script is to: * Each backend runs `doveadm fts check fast` for all users that have recently been accessed in the metacache. * Sort the results so that users with the most missing messages are processed first. * Eventually also process users that don't have enough information locally, so they aren't skipped forever. * Start running `doveadm fts check full` for users to find exactly what differences there really are. * Run `doveadm fts rescan` followed by `doveadm index` to reindex users that have missing mails. This unfortunately for now requires reindexing all of the messages for the user. * If the full check revealed that the differences weren't actually due to missing messages, but for some other reason, store this information in a tracking database so the user can be skipped. Although once all the users with missing messages have been reindexed, the rest of the inconsistencies would be good to fix as well. `doveadm fts check fast` fields: | Field | Description | | ----- | ----------- | | autoindex | "yes" or "no" depending on whether the mailbox matches `fts_autoindex` settings. | | mailbox uidnext | The expected UID for the next message that is saved to the mailbox. This can be compared against the "fts highest uid"+1. | | fts highest uid | The highest UID in the mailbox that has been FTS indexed. | | mailbox total count | Total number of messages in the mailbox, also including messages that haven't even been attempted to be FTS indexed. | | expected fts count | Expected number of messages in FTS index, based on "fts highest uid" and the current mailbox state. | | fts count | Actual number of messages in FTS index. | | fts expunges | Number of messages marked as expunged in the fts.X file, but not yet purged from the FTS triplets. This is already included in the calculation to produce the "fts count" field, so it's only for informative/debugging purposes. | `doveadm fts check full` states: | State | Description | | ----- | ----------- | | synced | Message exists in both mailbox and in FTS. | | synced_expunged | Message doesn't exist in mailbox, but it's correctly marked as expunged in FTS (but not yet purged out of the triplets). | | missing | Message exists in mailbox, but is missing from FTS. It needs to be reindexed. | | unexpunged | Message exists in mailbox, but it was already marked as expunged in FTS, although it's not yet purged from triplets. This isn't supposed to happen. | | missing_unexpunged | Message exists in mailbox, but it was already marked as expunged in FTS and already purged from triplets. This really isn't supposed to happen. | | leaked | Message doesn't exist in mailbox, but it exists in FTS. The same message may be leaked multiple times in different triplets (they are not counted as "duplicate"). | | expunge_leaked | Message doesn't exist in mailbox or triplets, but it is marked as expunged in FTS. The messages were never removed from the fts.X file. There were various bugs that caused this to happen. | | duplicate | Message exists in mailbox, and multiple times in FTS. The first time is counted as "synced", "synced_expunged" or "unexpunged" while the other instances are "duplicate". | See [[man,doveadm-fts]] for detailed list of parameters and command exit codes. ## Technical Details ### Data Storage Engine Each account's mail is indexed into a small set of control files, and one or more triplets of files. The control files are: | File | Purpose | Description | | ---- | ------- | ----------- | | S | 'Stats' cache | Contains information about all of the triplets | | X | 'eXpunge' file | A list of mails to be expunged | | Y | 'expunged' file | A list of mails that have been expunged | Both X and Y grow by being appended to. When Y grows to sufficient size to indicate that the X file contains old stuff, the contents of Y will be subtracted from X, and Y will be deleted. This is automatic as part of an expunge. Each triplet contains of the following: | File | Purpose | Description | | ---- | ------- | ----------- | | D | 'Docindex', or index of documents | Contains { mailbox\_guid, uid, header/mime_part } info | | W | 'Wordlist' | Contains all the indexed words, and offsets into the L file | | L | 'docList' |Ccontaining lists of indices into the D file. | To perform a lookup of a word, find the L-offset for that word from the W file. From that offset in the L file, read the list of docidx (document index) values. From the D file, look up the { guid, uid, hdr/part } values. This sounds complicated, but if a word is not found, you don't need to touch the L and D files. If (AND) searching for multiple words, and one of the words is not in the W file, then you don't need to touch the L file. If (AND) searching, and the intersection of the lists in the L file is empty, then you don't need to touch the D file. These three files can be considered as 2 dimensional data, with W and D being the two axes, and L being the 2D region itself. Preferably in typical use the L files dominate the sizes. However, because deciding what is and isn't a "word" is hard, the W files also can grow very large. For storage planning, Product decision is to assume that no FTS file will exceed 500MB. Theoretically, they could grow past that size, but allowing non-sparse objects to be used in Scality (for obox) is a valid trade-off for better performance. ### Stats Caching Stats for each triplet are cached in the 'S' file - this includes the number of entities (documents (= headers + parts) for D, words for W, and matches for L files). Maxuid stats for every mailbox_guid in each triplet are also cached in the same file. This helps give fast answers to some common queries. ### FTS Caches By default FTS has no read or write caches. When indexing a new mail the FTS indexes are immediately written to the storage. With object storages this means quite a lot of write and delete operations. To optimize this, "fts-cache" was implemented for write caching. The fts-cache causes the last triplet to be kept in local metacache until one of the following happens: * fts.L file's size grows larger than [`fts_dovecot_min_merge_l_file_size`](#fts_dovecot_min_merge_l_file_size) (default: 128 kB) * The triplet has at least [`fts_dovecot_mail_flush_interval`](#fts_dovecot_mail_flush_interval) number of mails. * Metacache is flushed FTS is commonly also configured to use the [[link,obox_fscache,fscache]]- [[link,fs_wrappers,fs wrapper]], which caches reading of FTS triplets that were already saved to the object storage. It's recommended that FTS and email fscaches point to different directories. ### Lookups The precise techniques for doing lookups depends on whether it's an AND or an OR query. AND permits early aborts before any of the L file is even touched. OR invites no such optimization. ## Kuromoji Tokenizer ::: warning The kuromoji tokenizer is not distributed as part of the base Dovecot Pro package. This tokenizer requires separate licensing to use. Contact [[link,sla,Open-Xchange Support]] for further information. ::: This tokenizer is used for Japanese text. This tokenizer utilizes Atilika Kuromoji tokenizer library to tokenize Japanese text. This tokenizer also does NFKC normalization before tokenization, namely half-width and full-width character normalizations, such as: * Transform half-width Katakana letters to full-width * Transform full-width number letters to half-width * Transform those special letters (e.g, 1 will be transformed to 1, and 平成 to 平成) ### Stopwords We use the predefined set of stopwords which is recommended by Atilika. Those stopwords are reasonable and they have been made by tokenizing Japanese Wikipedia and have been reviewed by us. This set of stopwords is also included in the Apache Lucene and Solr projects and it is used by many Japanese search implementations. ### Settings #### `maxlen` Maximum length of token, before an arbitrary cut off is made. The default value for the kuromoji tokenizer is `1024`. #### `kuromoji_split_compounds` This setting enables "search mode" in the Atilika Kuromoji library. The setting defaults to enabled (i.e `1`) and should not be changed unless there is a compelling reason. To disable, set the value to `0`. ::: warning If this setting is changed, existing FTS indexes will produce unexpected results. The FTS indexes should be recreated in this case. ::: #### `id` Description of the normalizing/transliterating rules to use. See [Normalizer Format][normalizer-format] for syntax. Defaults to ``Any-NFKC`` which is quite good for CJK text mixed with Latin alphabet languages. It transforms CJK characters to full-width encoding and transforms Latin ones to half-width. The NFKC transformation is described above. ::: warning If this setting is changed, existing FTS indexes will produce unexpected results. The FTS indexes should be recreated in this case. ::: ### Configuration The `kuromoji` tokenizer should be added to [[setting,language_tokenizers]]. Configuration should be done via the `language_tokenizer_kuromoji` setting. Example: ```doveconf[dovecot.conf] language_tokenizers = generic email-address kuromoji language_tokenizer_kuromoji = maxlen=1024 ``` [normalizer-format]: https://unicode-org.github.io/icu/userguide/transforms/general/#transliterator-identifiers # Lawful Intercept: IMAP (`imap-intercept`) Plugin ::: warning Note This plugin is provided by [[link,intercept-framework,Dovecot Pro's Lawful Intercept Framework]]. ::: Intercept post-login IMAP session traffic. This plugin is configured for a Dovecot backend. ## Configuration ```doveconf[dovecot.conf] protocol imap { mail_plugins { imap_intercept = yes } } #imap_intercept_disconnect_after = 12h ``` The interception is enabled if [[link,userdb]] returns a non-empty [[setting,intercept]] extra field. ## Settings # Lawful Intercept: Intercept Box (`intercept-box`) Plugin ::: warning Note This plugin is provided by [[link,intercept-framework,Dovecot Pro's Lawful Intercept Framework]]. ::: The way this plugin is intended to be used is to configure MTA to send mails to a special intercept user via LMTP. This user has a Sieve script, which gets the intercepted user information from the email headers or in the [[setting_text,recipient_delimiter,+detail]] of the recipient address. The folder name is in format: ` `. These fields can be used in [[setting,intercept_box_path]]. The field contents are not validated in any way. ## Settings ## Example Configuration ```doveconf[dovecot.conf] protocol lmtp { # Generally, it is expected that userdb will return # "mail_location=intercept:" for users that need interception. mail_plugins { intercept_box = yes } } intercept_box { # POSIX interception fs posix { prefix = /tmp/intercept/%{user}/%{protocol}- } # TODO: dictmap example } intercept_box_crypt_key = secret intercept_box_crypt_cipher = aes-256-cbc intercept_box_path = %{crypted_user}/%{timestamp}.%{generate:guid128}.SMTP.%{type}.eml intercept_box_add_headers { X-Dovecot-Hash = /intercept/trace/%{crypted_user | substr(0,2)}/%{crypted_user | substr(2,3)}/ } ``` # Lawful Intercept: LDA (`lda-intercept`) Plugin ::: warning Note This plugin is provided by [[link,intercept-framework,Dovecot Pro's Lawful Intercept Framework]]. ::: Intercept [[link,lda]] or [[link,lmtp]] traffic. This includes only the message being delivered without any metadata. The message is intercepted even if a Sieve script forwards or discards the message. This plugin is configured for a Dovecot backend. ## Configuration ```doveconf[dovecot.conf] protocol lda { mail_plugins { lda_intercept = yes } } ``` The interception is enabled if [[link,userdb]] returns a non-empty [[setting,intercept]] extra field. # Lawful Intercept: Login (`login-intercept`) Plugin ::: warning Note This plugin is provided by [[link,intercept-framework,Dovecot Pro's Lawful Intercept Framework]]. ::: This plugin allows capturing of the entire IMAP, POP3 or ManageSieve session, including the authentication commands. This plugin is configured for a Dovecot proxy. ## Configuration ```doveconf[dovecot.conf] login_plugins { login_intercept = yes } ``` The interception is enabled if [[link,passdb]] returns a non-empty `intercept` [[link,passdb_extra_fields,extra field]]. ::: danger IMPORTANT NOTES - [[link,passdb]] ONLY, not [[link,userdb]] - Currently this fully works only when user is proxied, not on backends. However, it works also on a backend if all connections use SSL/TLS. ::: ## Debugging Normally the login-intercept plugin doesn't log much of anything even in error situations, because we want to avoid making visible which users are being intercepted. For debugging you need to enable [[setting,intercept_debug]]. # Lawful Intercept: Mail Storage (`mail-intercept`) Plugin ::: warning Note This plugin is provided by [[link,intercept-framework,Dovecot Pro's Lawful Intercept Framework]]. ::: This plugin can be used to intercept all saved, copied and moved messages. This includes only the message itself without any metadata. This plugin is configured for a Dovecot backend. In some cases it can be useful to capture messages that are saved to the user's mail storage. One application is that it provides a means to reliably capture messages that are saved using the IMAP APPEND command. This is necessary for certain backends (e.g., [[link,intercept-utimaco,Utimaco]]). ## Configuration ```doveconf[dovecot.conf] protocol imap { mail_plugins { mail_intercept = yes } } ``` The interception is enabled if [[link,userdb]] returns a non-empty [[setting,intercept]] extra field. # Message Hashing Plugin (`message-hashing`) This plugin calculates a hash for every attachment in a message (attachment determination done via istream-attachment-extractor code) and a hash for the entire message. This calculated data is emitted via named events, which can be collected and analyzed as needed. This plugin captures message saving via any method (LMTP/LDA, doveadm, IMAP APPEND). To restrict to a certain protocol, load the plugin in a protocol block instead of globally. ## Settings ## Events ## Example Configuration ::: warning This plugin requires the [[plugin,notify]] to be loaded. ::: ```doveconf[dovecot.conf] mail_plugins { notify = yes message_hashing = yes } message_hashing_hash_method = md5 message_hashing_min_attachment_size = 1 B ``` ## Debugging You can view message hashing information in the log by using [[setting,log_debug]]: ```doveconf[dovecot.conf] log_debug = event=message_hashing_msg_full OR event=message_hashing_msg_part ``` Example output: ```log Apr 21 19:11:39 imap(3752 foo): Debug: message-hashing: message part (06a9effc7cb6182578e876d0cce2b617, 7) Apr 21 19:11:39 imap(3752 foo): Debug: message-hashing: message part (c9269421e2389c0ca53bcf1854e49182, 8) Apr 21 19:11:39 imap(3752 foo): Debug: message-hashing: full message (8e8c6d47004d4e0a99f14d6cd788ee4f, 81) ``` # NFS Hostchange Plugin (`nfs-hostchange`) ::: warning This plugin is intended for use only with NFS installations. ::: This plugin is intended to keep mailbox list indexes (`dovecot.list.index*` files) stored locally under `/dev/shm`. If the user's backend has changed since previous access, the plugin automatically deletes any old `dovecot.list.index*` files from `/dev/shm`. Backends should also delete local mailbox list indexes that haven't been accessed for a long time, to avoid wasting memory for them. ## Configuration ```doveconf[dovecot.conf] # This stores mailbox list indexes in tmpfs rather than NFS. This makes moving # the users between backends more expensive though. It also needs a way to # delete the list indexes for users that have already moved to different # backends (this is what NFS Hostchange plugin does). mailbox_list_index_prefix = /dev/shm/dovecot/listindex/%{user | sha1 % 256 | hex(2)}/%{user}/dovecot.list.index mail_plugins { nfs_hostchange = yes } # Until all backends have been upgraded and most users accessed: nfs_hostchange_migration = yes ``` ## Settings ## Doveadm Commands ## Migration When first starting to use this plugin, `dovecot.list.index*` files don't exist locally anywhere yet. To avoid large NFS disk I/O spikes, the existing `dovecot.list.index*` files should be copied from NFS to local `/dev/shm` if they don't exist yet. [`nfs_hostchange_migration`](#nfs_hostchange_migration) setting is used to do this. If `nfs_hostchange_migration=yes`: * `stat(mail_index_path/dovecot.list.index.log)` is done to see if a backend without nfs_hostchange plugin has accessed the user. If the `stat()` succeeds to find the file, the local `mailbox_list_index_prefix/.lasthost` and `mailbox_list_index_prefix/dovecot.list.index*` are deleted. * If `mailbox_list_index_prefix/.lasthost` doesn't now exist, `mail_index_path/dovecot.list.index*` are copied to local `/dev/shm`. `mailbox_list_index_prefix/dovecot.list.index*` files are then deleted. Note that using the migration setting introduces the extra `stat()` call to NFS, so once most users have been accessed this setting should be disabled. There should be also a cronjob that deletes old users from the local `/dev/shm`. It should be done with `mailbox_list_index_prefix/.lasthost` locked. This plugin provides a `doveadm nfs usercache clean ` command, which can be used like: ```sh doveadm nfs usercache clean 7days /dev/shm/dovecot/00/testuser ``` Note that this needs to be run separately for each user. So first run a script that finds the old users based on the `.lasthost` file's access time. Then for each such user run the `doveadm nfs usercache clean` command to safely delete it. ## Technical Details ### Backend Tracking This plugin keeps track of the user's last hostname in `mail_index_path/.lasthost` file, which exists in NFS. That file's inode and modification time is stored in `mailbox_list_index_prefix/.lasthost` file, which exists locally under `/dev/shm`. Whenever the user logs in, `mail_index_path/.lasthost` is compared to `mailbox_list_index_prefix/.lasthost` to see if it has changed. If yes, delete `mailbox_list_index_prefix/dovecot.list.index*` files and rewrite the `mailbox_list_index_prefix/.lasthost` file. # Obox Plugin (`obox`) This plugin implements the obox mailbox format for Dovecot Pro. The obox mailbox format is the ONLY mailbox format that is supported for production use in Dovecot Pro. ::: tip Since obox is so important to Dovecot Pro/Palomar, and it is so complex, documentation has been expanded into its own section. See [[link,obox_configuration]] for further information. ::: # Lawful Intercept: POP3 (`pop3-intercept`) Plugin ::: warning Note This plugin is provided by [[link,intercept-framework,Dovecot Pro's Lawful Intercept Framework]]. ::: Intercept post-login POP3 session traffic. This plugin is configured for a Dovecot backend. ## Configuration ```doveconf[dovecot.conf] protocol pop3 { mail_plugins { pop3_intercept = yes } } ``` The interception is enabled if [[link,userdb]] returns a non-empty [[setting,intercept]] extra field. # POP3 UIDL Migration Plugin (`pop3-uidl-migrate`) The pop3-uidl-migrate plugin is used to preserve POP3 UIDLs. It's a more efficient way than using [[plugin,pop3-migration]] because it doesn't require a separate POP3 connection to get the UIDLs. However, this plugin can be used only for a few POP3 servers. ::: warning Always do a test migration to verify that POP3 UIDLs are preserved correctly. If the UIDL format is wrong, all the mails have to be re-migrated. ::: ## Settings ## Example Configuration ```doveconf[dovecot.conf] # Critical Path: IMAP UIDVALIDITY-IMAP UID pop3_uidl_migrate_format = %{uidvalidity}-%{uid} # OpenWave: pop3_uidl_migrate_format = %{owm} ``` # IMAP proxyauth Plugin (`proxyauth`) ::: warning The imap-proxyauth plugin is not distributed as part of the base Dovecot Pro package. This plugin requires separate licensing to use. Contact [[link,sla,Open-Xchange Support]] for further information. ::: Implements Sun iPlanet/Oracle CMS like PROXYAUTH on the IMAP server-side. Dovecot internally just converts the LOGIN + PROXYAUTH command pair to a standard SASL PLAIN authentication before it does anything. This means that if the proxyauth plugin is loaded, Dovecot assumes that IMAP clients always do a LOGIN + PROXYAUTH pair. If no PROXYAUTH command is given, the IMAP connection will start giving errors when a client attempts to use commands such as LIST or SELECT. ## Example Configuration ```doveconf[dovecot.conf] protocol imap { login_plugins = proxyauth } ``` ## Example IMAP Session ``` C: a LOGIN master-user master-pass S: a OK Login processed, waiting for proxyauth. C: b PROXYAUTH real-user S: b OK Logged in as real-user ``` # Push Notification Plugin: Chronos (`push-notification-chronos`) [[added,push_notification_chronos_added]] The Chronos push-notification driver supports sending notifications on `MessageNew` events if the message contains a calendar invite. This driver was designed for use with the [OX App Suite iCalendar Transport-Independent Interoperability Protocol (iTIP)][ox-appsuite-itip-api] but can be used by any endpoint that implements the same API. ## Configuration ::: info The chronos push notification driver requires the [[plugin,push-notification]] to be loaded. ::: ### Options Key/Value options used with [[setting,push_notification_driver]]: | Name | Required | Type | Description | | ---- | -------- | ---- | ----------- | | `push_notification_driver` | **YES** | [[link,settings_types_string]] | To identify this settings block the driver should get the value `chronos`. | | `push_notification_chronos_url` | **YES** | [[link,settings_types_string]] | The HTTP end-point (URL + authentication information) to use for sending the push notification. Contains authentication information needed for Basic Authentication (if any). Example: `http + "://" + + ":" + + "@" + + ":" + + "/chronos/v1/itip/pushmail"`
For HTTPS endpoints, system CAs are trusted by default, but internal CAs might need further configuration.
See [Configuring OX App Suite endpoint][ox-appsuite-itip-api]. | | `push_notification_chronos_msg_max_size` | NO | [[link,settings_types_size]] | Maximum size a message may have to be considered for push notification sending. (DEFAULT: `1mb`) | ## Example Configuration ```doveconf[dovecot.conf] mail_plugins { notify = yes push_notification = yes push_notification_chronos = yes } push_notification chronos { driver = chronos url = http://login:pass@node1.domain.tld:8009/chronos/v1/itip/pushmail msg_max_size = 500kb } ``` ## Payload Push notification is sent in JSON format with the following fields: | Name | Type | Description | | ---- | ---- | ----------- | | `user` | [[link,settings_types_string]] | The username of the account receiving the message on the Dovecot backend. | | `event` | [[link,settings_types_string]] | [[rfc,5423]] event type. Currently, only `MessageNew`. | | `folder` | [[link,settings_types_string]] | Mailbox name in which the message was saved. Can be other than INBOX, in case sieve filters are active. A trivial deduplication is enabled if the sieve script copies the files into different folders, then only for one of the messages a push notification will be sent. | | `body` | [[link,settings_types_string]] | Full message content of the mail, including headers and text. The field content is escaped to comply to the JSON format. | ### Example Payload `Content-Type: application/json; charset=utf-8` ```json { "user": "4@464646669", "event": "MessageNew", "folder": "INBOX", "body": "From: user@example.com\nTo: user2@example.com\nSubject: calendar\nContent-Type: text/calendar\n\nICAL CONTENT\n" } ``` [ox-appsuite-itip-api]: https://documentation.open-xchange.com/8/middleware/calendar/iTip.html # Zimbra Sieve Compatibility Plugin (`sieve-zimbra-compat`) ::: warning The sieve-zimbra-compat plugin is not distributed as part of the base Dovecot Pro package. This plugin requires separate licensing to use. Contact [[link,sla,Open-Xchange Support]] for further information. ::: Sieve (RFC 5228) is a highly extensible machine language specifically tailored for internet message filtering. This package extends Dovecot's Sieve support for the vendor-specific Sieve language extensions as used by the Zimbra implementation of Sieve. The goal of this plugin is to provide sufficient compatibility to be able to run typical Sieve scripts originally written for Zimbra deployments. Support for the following extensions is added by this plugin: * vnd.zimbra.addressbook * vnd.zimbra.attachment * vnd.zimbra.body * vnd.zimbra.bulk * vnd.zimbra.contact_ranking * vnd.zimbra.conversation * vnd.zimbra.current_day_of_week * vnd.zimbra.current_time * vnd.zimbra.date * vnd.zimbra.disabled_if * vnd.zimbra.facebook * vnd.zimbra.flag * vnd.zimbra.flagged * vnd.zimbra.importance * vnd.zimbra.invite * vnd.zimbra.linkedin * vnd.zimbra.list * vnd.zimbra.me * vnd.zimbra.mime_header * vnd.zimbra.notify * vnd.zimbra.reply * vnd.zimbra.socialcast * vnd.zimbra.tag * vnd.zimbra.twitter The following extensions are not fully implemented and will cause runtime errors when the associated tests are evaluated while executing the Sieve script: * vnd.zimbra.contact_ranking * vnd.zimbra.conversation A warning is produced at compile time to indicate that this may happen. ## Settings ## Configuration The Zimbra extensions are not enabled by default and thus need to be enabled explicitly, which means that these extensions need to be added to [[setting,sieve_extensions]]. The Zimbra Sieve implementation is based on jSieve. For jSieve, the use of the "require" command is entirely optional. You will likely encounter scripts created by Zimbra that omit some of the extensions in the require line. Therefore, it is recommended to put all used Zimbra extensions in [[setting,sieve_implicit_extensions]], rather than [[setting,sieve_extensions]], so that the "require" command does not need to be used for those extensions. The "vnd.zimbra." prefix of these extension names is a Dovecot addition. This prevents these extensions from interfering with some of the standard extensions that have the same name. Unfortunately, Sieve scripts that were written for/by Zimbra use these extensions without the "vnd.zimbra." prefix. To be able to use such scripts, you need to use the [[setting,sieve_zimbra_bare_extensions]] setting. ### Addressbook The "vnd.zimbra.addressbook" extension needs additional configuration. This test yields "true" when any of the addresses contained in the indicated headers is in the user's addressbook. This means that this test needs access to that addressbook. This access is provided by means of a Dovecot dict lookup. See [[setting,sieve_zimbra_addressbook_dict]]. Example Configuration: ::: code-group ```doveconf[dovecot.conf] sieve_zimbra_addressbook_dict = proxy::addressbook # Sieve Zimbra addressbook in mysql dict_server { dict addressbook { driver = sql sql_driver = mysql #mysql_host = ... # The name mapping that yields the ID of the Sieve script dict_map priv/sieve/zimbra/addressbook/$sender { sql_table = user_contacts username_field = username value_field id { } key_field sender { value = $sender } } } } ``` ```sql[MySQL Database Schema] CREATE DATABASE contacts; USE contacts; CREATE TABLE user_contacts ( username VARCHAR(1024), sender VARCHAR(1024), id INTEGER PRIMARY KEY AUTO_INCREMENT, contactid INTEGER, UNIQUE KEY (username(767), sender(767)) ); ``` ::: ### Notify The "vnd.zimbra.notify" extension has additional configuration. This action sends a notification email to the indicated recipient. See [[setting,sieve_zimbra_notify_envelope_from]] for configuration details. Example: ```doveconf[dovecot.conf] sieve_zimbra_notify_envelope_from = recipient ``` #### Notify as Redirect The "vnd.zimbra.notify" extension can be configured such that the "notify" action is executed as a "redirect" when the full message is used as the notification. The purpose of this is having the ability to forward a complex multipart message as a means of notification. This is not a standard Zimbra feature. This feature is only enabled when [[setting,sieve_zimbra_notify_as_redirect,yes]]. Furthermore, the following conditions need to be met for a "notify" action to be executed as a "redirect": - The body template of the notify action is equal to "${BODY}" (leading and trailing whitespace is allowed). - The optional orig-headers argument is set explicitly to include all headers (set to "*" or ["*"]). - The optional maxbodybytes argument is not set. Example: ::: code-group ```doveconf[dovecot.conf] sieve_zimbra_notify_as_redirect = yes ``` ```[Sieve script] require "vnd.zimbra.notify"; # If the message has an "X-Redirect" or and "X-Notify-Forward" header and # no "X-Notify-No-Forward", the message is redirected to frop@example.com. # Otherwise, a normal notification message is sent. notify "frop@example.com" "Frop!" "BODY: ${BODY}"; ``` ::: ## Example Configuration ::: warning This plugin requires the [[plugin,sieve]] to be active. ::: ```doveconf[dovecot.conf] sieve_plugins { sieve_zimbra_compat = yes } sieve_implicit_extensions { vnd.zimbra.body = yes vnd.zimbra.bulk = yes vnd.zimbra.date = yes vnd.zimbra.flag = yes vnd.zimbra.invite = yes vnd.zimbra.me = yes vnd.zimbra.tag = yes } sieve_zimbra_bare_extensions { body = yes bulk = yes date = yes flag = yes invite = yes me = yes tag = yes } ``` # Throttle (`throttle`) Plugin The throttle plugin rate-limits Dovecot operations using token-bucket-style counters. Operations that match a configured event filter are counted in short and long buckets; once a bucket is full, further matching operations inside the same worker process are delayed by sleeping the worker for an amount of time proportional to how far over the bucket limit the user (or the global counter) currently is. Counters are kept in a dedicated `throttle` server process, so the limits apply across all worker processes on the same host. The short buckets are intended to be configured to throttle early and with low event counts (e.g. 30 second limit). This takes care of short bursts of activity. The long buckets are intended to prevent excessive abuse from a user over a longer time period (e.g. 1 day). They should be configured so that long bucket limits are not exceeded by regular clients. ::: warning Throttling delays the entire worker via a synchronous sleep. The plugin requires `client_limit=1` for any service into which it is loaded. If multiple clients share a worker, a sleep triggered by one user blocks every other client on that worker. ::: A single worker sleep is capped at 60 seconds regardless of how far over the bucket limit the counter has gone. ## Throttle Types Each throttle entry has a `throttle_type`: | Type | Description | | ---- | ----------- | | `global` | One bucket shared by all users. Useful for protecting shared resources (e.g. limiting total deliveries per minute on a backend). | | `user` | One bucket per username. Used to rate-limit per-user activity. The username is included in the bucket's global ID, so user buckets are isolated from each other. | ## Settings ## Example Configuration Limit each user to 60 IMAP `APPEND` commands per minute and 10 000 per day, and globally limit LMTP deliveries to 1 000 per minute on the backend: ```[dovecot.conf] mail_plugins { throttle = yes } throttle imap_append_user { type = user filter = event=imap_command_finished AND cmd_name=APPEND short_bucket_expire = 1min short_bucket_max_count = 60 long_bucket_expire = 1d long_bucket_max_count = 10000 } throttle lmtp_global { type = global filter = event=lmtp_command_finished AND cmd_name=DATA short_bucket_expire = 1min short_bucket_max_count = 1000 long_bucket_expire = 1h long_bucket_max_count = 50000 } ``` To load the plugin only into specific protocols, use a `protocol` filter around [[setting,mail_plugins]]. ## doveadm Commands [[doveadm,throttle list]] queries the running throttle server for current counter values. ## Events When throttling delays an event, the plugin annotates the event with a `throttled` field containing the sleep duration in milliseconds. This can be used in [[link,stats]]. For IMAP commands, the cumulative sleep across all throttles that matched during the command is also recorded in the `throttled_any` field on the command's global event; this causes the tagged response to be prefixed with `[THROTTLED]`. # Unified Quota Plugin (`unified-quota`) Unified quota plugin is a combined count and dict plugin, which uses `quota:count` to keep tabs of local quota and dict lookups to maintain external usage. When quota usage is looked up, it will count local quota usage and increment that with the other product(s) in dict. ::: info Unified Quota requires [[link,dovecot_pro_cassandra]]. ::: ## Settings ## Cassandra Schema The unified quota schema: ```cql[unified_quota_scheme.cql] CREATE KEYSPACE IF NOT EXISTS quota WITH REPLICATION = { 'class': 'SimpleStrategy', 'replication_factor': '1' } AND durable_writes = true; USE quota; CREATE TABLE quota.quota_usage ( ox_id text, type text, count bigint, usage bigint, PRIMARY KEY (ox_id, type) ) WITH CLUSTERING ORDER BY (type ASC) AND bloom_filter_fp_chance = 0.01 AND caching = { 'keys':'ALL', 'rows_per_partition':'NONE' } AND comment = '' AND compaction = { 'class': 'org.apache.cassandra.db.compaction.SizeTieredCompactionStrategy' } AND compression = { 'sstable_compression': 'org.apache.cassandra.io.compress.LZ4Compressor' } AND dclocal_read_repair_chance = 0.1 AND default_time_to_live = 0 AND gc_grace_seconds = 864000 AND max_index_interval = 2048 AND memtable_flush_period_in_ms = 0 AND min_index_interval = 128 AND read_repair_chance = 0.0 AND speculative_retry = '99.0PERCENTILE'; ``` Create the unified quota schema in Cassandra: ```bash cqlsh < unified_quota_scheme.cql ``` In your `dovecot.conf` you must enable the `quota_unified` plugin and configure the `dict` service: ```doveconf[dovecot.conf] # Add dict-async socket which provides access to cassandra service dict-async { unix_listener dict-async { user = vmail } } # Add "service dict" service dict { unix_listener dict { mode = 0600 user = vmail } } # Add the Cassandra mappings cassandra_hosts = cassandra-host-3 cassandra-host-2 cassandra-host-1 dict_server { dict cassandra { driver = sql sql_driver = cassandra cassandra_keyspace = quota dict_map priv/quota/messages/$product { sql_table = quota_usage username_field = ox_id value_field count { type = uint } key_field type { value = $product } } dict_map priv/quota/storage/$product { sql_table = quota_usage username_field = ox_id value_field usage { type = uint } key_field type { value = $product } } } } # Add "quota_unified" to your mail_plugins mail_plugins { quota_unified = yes } # Add the unified quota plugin (configured to use Cassandra "dict" driver) quota "User quota" { driver = unified quota_unified_dict_unset = no dict proxy { name = cassandra socket_path = dict-async } quota_unified_product_name = dovecot_mail } ``` # Vault Plugin (`vault`) ::: warning The vault plugin is not distributed as part of the base Dovecot Pro package. This plugin requires separate licensing to use. Contact [[link,sla,Open-Xchange Support]] for further information. ::: The vault plugin performs the job of storing the incoming mail first to a configurable, read-only mailbox location (e.g., `ARCHIVE`) and, if that succeeds, then to user’s INBOX. It also adds the `\Seen` flag to the message. ## Settings ## Configuration The vault plugin should be configured to store messages in a read-only namespace. This section describes how this can be done via Dovecot configuration. ### ARCHIVE Namespace Store the archived emails in the ARCHIVE namespace to a slightly different location: ```doveconf[dovecot.conf] namespace archive { prefix = ARCHIVE/ separator = / hidden = yes mail_driver = obox mail_path = %{user | sha1 % 256 | hex(2)}/ARCHIVE/%{user} mail_index_path = ~/archive mail_control_path = ~/archive mailbox "" { auto = create } } ``` ### Read-only Archive Enable the ACL plugin to set mailbox read-only when accessed with IMAP protocol: ::: code-group ```doveconf[dovecot.conf] protocol imap { mail_plugins { acl = yes } } acl_driver = vfile namespace archive { acl owner { rights = lr } } ``` ::: ### Incoming Emails The incoming mails are sent to Dovecot using LMTP protocol. The vault plugin performs the job of storing the incoming mail first to ARCHIVE and, if that succeeded, then to user’s INBOX. It also adds the \Seen flag to the message. ```doveconf[dovecot.conf] protocol lmtp { mail_plugins { vault = yes } vault_mailbox = ARCHIVE } ``` ### Outgoing Emails #### Dovecot Submission Server ::: todo Provide example configuration ::: #### External SMTP Server Configure that outgoing mails first go to an external SMTP server. This server (e.g., Postfix) is configured to BCC the messages to Dovecot LMTP via another port, which stores the mails to ARCHIVE. ::: code-group ```doveconf[Dovecot Proxy] service lmtp { inet_listener { port = 2400 } } ``` ```doveconf[Dovecot Backend] service lmtp-out { client_limit = 1 # run only the global sieve, no user sieve executable = lmtp -o vault_mailbox= \ -o plugin/sieve=/etc/dovecot/global-outgoing.sieve inet_listener { port = 2400 } } protocol lmtp { mail_plugins { sieve = yes } } ``` ```[/etc/dovecot/global-outgoing.sieve] require ["imap4flags", "fileinto"]; addflag "\\Seen"; fileinto "ARCHIVE"; ``` ::: The Sieve script needs to be manually compiled: ```sh sievec /etc/dovecot/global-outgoing.sieve ``` ### Encryption Enable [[plugin,mail-crypt]]: ```doveconf[dovecot.conf] mail_plugins { mail_crypt = yes } crypt_user_key_curve = secp521r1 crypt_global_public_key_file = /etc/dovecot/mail-crypt-pub.pem crypt_global_private_key main { crypt_private_key_file = /etc/dovecot/mail-crypt-priv.pem } ``` ### Quotas Make sure quotas aren’t enabled for the ARCHIVE namespace. ### Deleting Old Mails Run a nightly cronjob that deletes all old emails: ```sh doveadm expunge -A mailbox ARCHIVE savedbefore 90d ``` # Virtual Attachments Plugin (`virtual-attachments`) The virtual attachments plugin automatically creates an email message in a virtual folder for every attachment that exists in a mailbox. It is used by [OX App Suite](https://www.open-xchange.com/products/ox-app-suite) if the virtual attachment view has been activated in the software. ## Configuration ### `dovecot.conf` First, you'll have to load the plugin which also requires the `virtual` plugin to be loaded: ```doveconf[dovecot.conf] mail_plugins { virtual = yes virtual_attachments = yes } ``` ### IMAP Capabilities For OX App Suite to use the virtual folders fully, you need to enable two IMAP capabilities: * XDOVECOT: Enable FETCHing X-MAILBOX and X-REAL-UID. * SEARCH=X-MIMEPART: Enable SEARCHing attachments by filename. ```doveconf[dovecot.conf] imap_capability { "SEARCH=X-MIMEPART" = yes XDOVECOT = yes } ``` ### Namespace Then, you'll have to create a [[link,namespaces]] for the virtual-attachments. ```doveconf[dovecot.conf] namespace virtual { prefix = virtual/ separator = / mail_driver = virtual mail_path = /etc/dovecot/virtual mail_index_path = ~/virtual } namespace virtual-attachments { prefix = virtual-attachments/ separator = / mail_driver = attachments mail_path = ~/virtual-attachments mailbox virtual/All { auto = create } } ``` For each folder that you want an attachments folder for, you need to create a corresponding folder in the Virtual Attachments namespace. The mailbox names need to match existing real or virtual mailboxes. Those mailboxes will be mirrored below the virtual-attachments namespace. Each of the mirrored mailboxes will contain one mail per attachment found in the referenced mailbox. The virtual-attachments mailboxes can be [[setting,mailbox_auto,auto-created]]. For example: * Attachments in `INBOX` are in `virtual-attachments/INBOX` * Attachments in `virtual/All` are in `virtual-attachments/virtual/All` ### Storage Location With Obox When using the virtual-attachments plugin with obox, the virtual index files must be in a directory named `virtual-attachments` in the user home directory. This way the virtual-attachments indexes are added to the obox root index bundles and will be preserved when user moves between backends or when metacache is cleaned. ```doveconf[dovecot.conf] mail_driver = attachments mail_path = ~/virtual-attachments ``` The virtual-attachments indexes & cache will be stored in the user root bundle. It is possible to disable storing virtual indexes in the user root bundle using `metacache_disable_secondary_indexes`. # Dovecot Pro 3.0.0 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2024-09-04
Support End 2025-03-31
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[OX Dovecot Pro v2.3.21.1](https://software.open-xchange.com/products/dovecot/doc/Release_Notes_for_OX_Dovecot_Pro_2.3.21.1_2024-08-14.pdf)** ::: This is the first release of Dovecot Pro 3.x. This release introduces the Dovecot Pro Palomar Architecture as the replacement to the OX Dovecot Pro 2.x Director-based architecture. Additionally, this release introduces the new Storage Support strategy for Dovecot Pro. * Support for Azure Blob and "S3 Compatible" storages have been added. * All storages must use the obox mailbox format. * All object storage must use fs-dictmap for mailbox metadata storage. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. ::: ### Dovecot #### New Features - **DOV-5192**: obox: Added "doveadm metacache pull" command. This new command allows to copy metacache from remote backend to local backend. - **DOV-5348**: Added dict-expire service, which can be used to periodically delete expired dict-sql rows. See . - **DOV-5503**: obox: If `metacache_last_host_dict` is configured, obox can automatically attempt to pull metacache from another backend. See . - **DOV-5652**: Added JA3 client fingerprinting support to dovecot. See . - **DOV-5653**: Events can be exported to a local file or unix socket. See . - **DOV-5738**: Added `imap_id_received` event, which lists received IMAP ID parameters prefixed with `id_param_`. See . - **DOV-6202**: obox: Added azure fs driver. - **DOV-6578**: obox: fs-s3 and fs-aws-s3 can no longer be used without fs-dictmap. - **DOV-6784**: Added required `dovecot_config_version` setting, which specifies the configuration version. This will allow changing default settings for new installations without affecting existing installations, unless they also update the version number in this setting. Currently, the only supported version is `3.0.0`. - **DOV-6785**: Added required `dovecot_storage_version` setting, which specifies the oldest Dovecot version that must be able to read files written by this Dovecot instance. Currently, the oldest supported version is `2.3.0`. #### Changes - **DOV-4920**: Default for `fts_dovecot_mail_flush_interval` is now 10 (was: 0). - **DOV-4920**: Default for `fts_dovecot_max_triplets` is now 200 (was: 0). - **DOV-4943**: obox: Changed metacache UNIX socket listener defaults to "service metacache \{ unix_listener metacache \{ mode=0660, group=$default_internal_group \} \}". - **DOV-4960**: "doveadm who" output format changed: - It contains also proxied connections. - The protocol column was replaced by service column. - Alternative usernames (`user_*` passdb fields) are included. - **DOV-4960**: "doveadm proxy list/kick" are now aliases for "doveadm who/kick" - **DOV-5000**: Set default lmtp proxy destination port to 24. - **DOV-5039**: fs-crypt now requires encryption keys by default. Use "maybe" parameter to allow reading and writing unencrypted files. - **DOV-5042**: Weak password schemes are no longer accepted by default. See to enable weak schemes. - **DOV-5044**: Replace `auth_debug` setting with `log_debug = category=auth`. - **DOV-5045**: Replace `auth_worker_max_count` with "service auth-worker \{ process_limit \}". - **DOV-5222**: `ssl=required` now requires TLS for connections from `login_trusted_networks` as well. - **DOV-5222**: Auth events: `transport=trusted` was changed to `transport=secured`. - **DOV-5246**: The \NoSelect leaf folders are now automatically deleted by default (i.e. the obsolete `mail_location = ...:NO-NOSELECT` setting is now enabled by default). To revert to the former behaviour, use KEEP-NOSELECT (see ). - **DOV-5257**: Error wording has been changed from `plaintext` to `cleartext` in errors related to logging in without TLS/secure connection. - **DOV-5269**: The `auth_default_realm` setting has been renamed to `auth_default_domain`, which better reflects its function. - **DOV-5323**: `disable_plaintext_auth` setting has been renamed to `auth_allow_cleartext`, with the logic reversed between the settings. See . - **DOV-5366**: Attempting to use `push_notification_backend` now gives a warning about the setting being obsolete. Use `push_notification_driver` instead. - **DOV-5407**: When calling doveadm mail commands, one of "-u", "-A", or "-F" must be specified. Environment variable USER is no longer accepted as default. - **DOV-5408**: Enable support for the IMAP COMPRESS extension by default. Relevant plugin settings have been dropped and the imap-zlib plugin has been removed. - **DOV-5413**: The zlib-save plugin has been renamed to mail-compress. Likewise the relevant configuration items `zlib_save` and `zlib_save_level` have been renamed to `mail_compress_save` and `mail_compress_save_level` respectively. - **DOV-5415**: Unknown/invalid "%\{variables\}" were ignored in some situations, other than becoming expanded into "\{UNSUPPORTED_VARIABLE_name\}". Now they're causing proper errors instead, which may cause, e.g., authentication failures if the broken behavior was relied on. - **DOV-5514**: Enable imapc features "delay-login", "search", "fetch-headers", "fetch-bodystructure", "fetch-size" by default. Enable "acl" and "modseq" by default, if the remote server supports it. Replace the appropriate `imapc_features` with ones that disable features selectively. - **DOV-5539**: obox: Changed default for `max-parallel-iter` to 10. See . - **DOV-5562**: Event filters warn about type mismatches when filtering for numeric values. - **DOV-5591**: Prevent using fscache with ZFS, since it doesn't work correctly. - **DOV-5602**: Allow non-standard special-use-labels in "mailbox \{ special_use \}" setting, but log a warning about them at startup. - **DOV-5630**: Renamed `proxy_session_finished` event's "idle_secs" field to "idle_usecs" to make all event intervals microsecond-based and allow using interval units properly. - **DOV-5642**: The doveadm HTTP API now requires valid boolean values. Providing invalid boolean values will result in a 400 response. - **DOV-5747**: userdb fields can be set to empty value now. Previously they became changed to "yes" value. - **DOV-5785**: `bytes_in` and `bytes_out` fields in events have been renamed to `net_in_bytes` and `net_out_bytes` respectively. - **DOV-5972**: Lua passdb/userdb now passes all args key/values to an initialization function. See . - **DOV-6100**: Sub-metric labels are now limited to 256 bytes in total length. - **DOV-6128**: All sections must now have a (unique) name in the configuration file. This especially means namespace, passdb and userdb sections. For example "passdb \{ ... \}" must now be "passdb somename \{ ... \}". - **DOV-6284**: auth service's log line prefixes were changed. - **DOV-6369**: Dovecot's Lua HTTP client no longer sends "Except: 100-Continue" header unless asked to. - **DOV-6503**: "Maximum number of connections from user+IP exceeded" failure is now returned with "[LIMIT]" instead of "[UNAVAILABLE]" IMAP response code prefix. - **DOV-6520**: User kicking is now logged as "User kicked" instead of "Server shutting down". Also, there is no "Killed with signal 15" warning logged. - **DOV-6588**: IMAP hibernation is now enabled by default. - **DOV-6599**: "name" response field from IMAP ID command always returns "Dovecot Pro". - **DOV-6653**: Login log format now includes target host, ip, and port as prefix in login proxying. - **DOV-6893**: Changed some login/disconnection related log lines to make it easier to understand and search them. For example, "Login:" is now "Logging in:" and pre-login failures have now "Login aborted:" prefix instead of "Disconnect:". - **DOV-6902**: Dovecot Lua HTTP Client will error out if invalid setting name is used. - **DOV-6913**: "doveconf" without parameters now outputs the same as with "-n" parameter. Use "-a" to get the old behavior (all settings). #### Removed Items - **DOV-4678**: Memcached dict support was removed - **DOV-4960**: Removed ipc service. Its main functionality was moved to anvil service. - **DOV-4994**: Removed global ACL directory support. Use global ACL files instead. See . - **DOV-4998**: Legacy ssl-parameters.dat conversion support was removed. - **DOV-5007**: Dirsize quota driver was removed. - **DOV-5011**: "dsync" command symlink was removed. Use "doveadm sync" or "doveadm backup" directly instead. - **DOV-5013**: Option "SSLv3" in `ssl_min_protocol` was removed. - **DOV-5016**: `login_access_sockets` setting was removed, including tcpwrap support. - **DOV-5017**: old-stats plugin was removed. - **DOV-5017**: imap-old-stats plugin was removed. - **DOV-5023**: `metacache_disable_merging` setting was removed. Use `metacache_index_merging=none` instead. - **DOV-5024**: Nonstandard X-CANCEL and X-STATE IMAP commands were removed. - **DOV-5028**: "v1" option in `metacache_index_merging` has been removed. - **DOV-5030**: checkpassword passdb/userdb was removed. Use Lua passdb/userdb instead. - **DOV-5032**: Quota dict driver was removed. - **DOV-5036**: `obox_allow_inconsistency` setting was removed. - **DOV-5037**: "doveadm batch" command was removed. - **DOV-5038**: Shadow passdb driver was removed. - **DOV-5040**: sieve: Removed notify, imapflags, and vnd.dovecot.duplicate extensions. - **DOV-5043**: Remove deprecated wiki documentation included in distribution packages. Replace references to obsolete wiki with new docs. - **DOV-5101**: `license_checksum` setting was removed. A notice about the obsolete setting will be raised if it is found in configuration. - **DOV-5254**: sieve: Removed `sieve_vacation_max_subject_codepoints` setting. - **DOV-5358**: `auth_client_cache_flush_started` and `auth_client_cache_flush_finished` events were removed. - **DOV-5404**: The mailbox-alias plugin was removed. - **DOV-5535**: Director component has been removed. - **DOV-5585**: Deprecated `sieve_dir`, `sieve_global_path`, and `sieve_global_dir` settings were removed. - **DOV-5585**: Drop undocumented handling of draft 'import'/'export' of the sieve include extension, which have been replaced by the ':global' command when finalizing the appropriate RFC (RFC 6609). - **DOV-5612**: obox: HTTP Storage options that have been deprecated since 2.3 have been removed. - **DOV-5738**: Support for `imap_id_log` setting was removed. The IMAP ID parameters can now be exported via the `imap_id_received` event. - **DOV-6699**: Dict authentication support has been removed. Use Lua based authentication instead. - **DOV-6770**: Support for IMAP SETQUOTA command to change quota limits was removed. This removes the `quota_set` setting. - **DOV-6952**: cassandra: `ssl_verify=cert-dns` was removed. This behavior is vulnerable to MITM attacks, so it's not safe to use. #### Improvements - **DOV-3970**: If backend IMAP server returns "NO [REFERRAL imap://url/]", IMAP proxy will automatically reconnect to that server instead (unless it detects a loop). - **DOV-3981**: LMTP supports returning Dovecot-specific referrals now, which Dovecot LMTP proxy will follow. This happens when passdb returns "host" extra field without "proxy" field. - **DOV-4142**: obox: `fs_object_write_uncertain` event is sent when a write HTTP operation is timed out. - **DOV-4754**: Support Write-Ahead Log (WAL) and read-only databases with SQLite driver. - **DOV-4901**: Added base64url format to hash modifier in variable expansion. For example: "%\{sha1;format=base64url:username\}". - **DOV-4921**: Reduce the number of file accesses by FTS on first fts cache access. - **DOV-4964**: obox: If `obox_fetch_lost_mails_as_empty=yes` is used and a mail is failing with "object exists in dict, but not in storage" error, don't assume that cached records are corrupted because they don't match the empty mail content. This may be only a temporary situation. - **DOV-4997**: `fts_autoindex_exclude` now honors namespaces. See . - **DOV-5020**: `mail_crypt_require_encrypted_user_key` now accepts boolean values. - **DOV-5053**: "doveadm kick" stops any active indexer-workers for matching users (but doesn't remove them from indexer queue). - **DOV-5053**: Added "doveadm indexer add/remove/list" commands. The remove command especially is useful to remove the user's indexing requests from the queue. - **DOV-5054**: "doveadm kick" now supports kicking hibernated imap connections. - **DOV-5097**: Mail processes stop now more quickly when receiving SIGTERM, for example due to "doveadm kick". - **DOV-5098**: Folder deletion now expunges mails in batches of 1000 mails. This helps especially with lazy-expunge plugin when expunging a lot of mails (e.g. millions) to make sure that the progress always moves forward even if the process is killed. - **DOV-5099**: Added `submission_add_received_header` setting to protect sender identity by suppressing the Received: header. - **DOV-5191**: Added `login_socket_path` setting, which makes it easier to override the default "login" socket. The old method of providing this as a parameter to the login executable still works, and can be used to override this setting. - **DOV-5254**: sieve: The maximum length of the subject header for a notification message is now 256 Unicode code points rather than 256 octets, which allows languages using many multibyte characters (like Japanese) to have long subjects as well. - **DOV-5401**: "doveadm log errors" now shows microseconds in timestamps. - **DOV-5418**: The "address" Sieve test now allows evaluating the contents of the X-Original-From header. - **DOV-5496**: Auth policy reports can now include an attribute describing why authentication failed. This attribute is sent as `fail_type` in defaults. See . - **DOV-5562**: Allow size units when specifying event filter values, e.g., "100kb" instead of "102400". - **DOV-5630**: Allow interval units when specifying event filter values, e.g. "1min" instead of "60000000". - **DOV-5662**: Added support for ARGON2 password scheme. - **DOV-5667**: Configuration of service listener type can now be performed explicitly by setting the "type" field of the listener. Before, (a suffix of) the name or path of the listener was used to determine the listener type, which was error-prone and cumbersome. - **DOV-5693**: sieve: Added untagged IMAP response code `* OK [INPROGRESS...] ...` for client keepalive and update progresses in FILTER command, sent every 10 seconds. - **DOV-5719**: Added `login_aborted` event. See . - **DOV-5720**: Support SCRAM-SHA-1 and SCRAM-SHA-256 SASL mechanisms for outgoing connections, such as proxying, imapc, and pop3c. - **DOV-5744**: Added untagged IMAP response code `* OK [INPROGRESS...] ...` for client keepalive and update progresses in long operations. Where applicable, it replaces the previous `* OK Hang in there..` response and it is sent every 10 seconds. SORT and THREAD commands support this only for the searching part, not the sorting/threading. - **DOV-5761**: Improve error messages when sqlite fails due to permission issues. - **DOV-5772**: The doveadm command now processes a "--help" argument to print the relevant list of subcommands or the usage of a specific subcommand depending on placement. - **DOV-5785**: Added `net_in_bytes` and `net_out_bytes` fields to `mail_user_session_finished` event. - **DOV-5785**: Added `pop3_command_finished` event. - **DOV-5791**: Added optional dict proxy parameters `idle_timeout` and `slow_warn`. - **DOV-5936**: "doveadm save": Added -r received-date parameter. - **DOV-5973**: auth: Added "%\{ldap_multi\}" variable to handle multi-valued attributes. See . - **DOV-5990**: Now imapc supports remote GETMETADATA (except on private attributes for users different from the owner). - **DOV-5999**: Event filters now support escaping wildcard `'*'` and `'?'` characters by prefixing them with `'\'`. - **DOV-6022**: obox: If a write to Cassandra fails with uncertainty, Dovecot now attempts to clean up by default. First it tries to delete the uncertainly written dict key. If that succeeded the deletion of the corresponding storage object is also attempted. See . This behaviour can also be disabled by using "no-cleanup-uncertain" as a dictmap parameter. See . - **DOV-6063**: Added `mail_metadata_accessed` event. - **DOV-6210**: "doveadm fs put" can now put metadata. - **DOV-6266**: Improve Cassandra debug and error messages by adding used consistency. For errors add "N of minimum M responses received". - **DOV-6377**: mail-crypt and fs-crypt now support X25519 and X448 curves. - **DOV-6418**: Provide more granular error codes in `proxy_session_finished` event, allowing differentiating between temporary and permanent authentication failures (e.g. max connections vs. incorrect password). See . - **DOV-6442**: Added `metacache_forced_refresh_interval` setting (default 8h). If user indexes haven't been refreshed for that long, force the refresh even if `metacache_close_delay` setting otherwise would prevent the refresh. This makes sure that indexes for very active users are still refreshed once in a while. - **DOV-6486**: Added support for ChaCha20-Poly1305 encryption algorithm. - **DOV-6604**: `fts_message_max_size` setting can be used to set the maximum size of message body to be processed for FTS indexing. The rest of the message is ignored. - **DOV-6616**: Added `log_retries=yes` parameter to Cassandra connect string. This enables logging every time the Cassandra driver retries a failed request internally. - **DOV-6616**: Adds "consistency" and "error_consistency" fields to `sql_query_finished` event. - **DOV-6655**: intercept: Support UUID matching between X1 and X3. - **DOV-6698**: Added "--no-userdb-lookup" parameter to doveadm mail commands. - **DOV-6752**: Added `quota_mailbox_message_count` setting to limit maximum number of messages for a folder. The default is unlimited. - **DOV-6753**: Added `quota_mailbox_count` setting to limit the maximum number of mailboxes a user can create. - **DOV-6919**: Added `auth_internal_failure_delay` setting, defaulting to 2 seconds. If auth lookup fails with internal error, the reply to the client is delayed by this much + random 0..50% This is intended to prevent clients from hammering the server with immediate retries. #### Fixed Issues - **DOV-4819**: obox added 128bit GUIDs to dovecot.index.cache, which is unnecessary since they also exist in dovecot.index. - **DOV-4830**: Header name lengths or counts weren't limited in dovecot.index.cache, making it possible for users to cause Dovecot to behave inefficiently. Now the header name lengths are truncated to 100 characters and a maximum of 100 different headers can be cached at a time per folder. If header count limit is reached, `mail_cache_decision_rejected` event is sent. - **DOV-4849**: Using dsync with "tcp" target didn't locally show all log messages sent by remote. - **DOV-4986**: "doveadm fetch date.sent" reported a time which is incorrect for the represented timezone. - **DOV-4995**: Sieve: The "string" test from the "variables" extension uses the "i;octet" comparator by default, which is not standard. It must be "i;ascii-casemap" instead. - **DOV-4999**: Folder renaming was broken when using `mail_location's` FULLDIRNAME together with INDEX, INDEXPVT, INDEXCACHE or CONTROL. Renaming a parent folder lost the index/control files for all of its child folders, which with some mailbox formats lost the mails until "doveadm force-resync" was used. - **DOV-5118**: oauth2: JWT tokens containing decimal parts in NumericDate fields were rejected as invalid. - **DOV-5219**: Could not use IPv6 link-local addresses in listen setting. - **DOV-5222**: Submission service didn't write the SSL "S" flag correctly to Received: headers. In proxying setups it indicated only whether the last proxy-backend hop was SSL secured, rather than whether the client-proxy connection was SSL secured. - **DOV-5226**: submission proxy: IPv6 addresses were missing IPV6: prefix in proxy XCLIENT command, which was incompatible if submission proxy connected directly to Postfix (which isn't recommended). - **DOV-5242**: Setting `login_trusted_networks` to an invalid value would crash login processes on client connect. - **DOV-5247**: Log warning: "Server-side warning: USE <keyspace> with prepared statements ..." polluting the log files. The way cassandra tables are accessed has been modified in order to conform with official cassandra recommendations. - **DOV-5293**: "doveadm mailbox cache remove" crashes when trying to access nonexistent mailbox. - **DOV-5320**: auth: Fix handling passdbs with identical driver/args but different mechanisms/username_filter. The second passdb was handled identically to the first one, with the first one's mechanisms/username_filter. - **DOV-5332**: imap-acl: Using IMAP ACL commands (e.g. MYRIGHTS) for a shared mailbox of a nonexistent user would lead to a crash. - **DOV-5333**: It was not possible to use virtual mailboxes as imapsieve COPY/APPEND destination mailbox. It is still not possible to use the virtual mailbox names themselves (e.g. "Virtual/All"), but using the physical save destination mailbox name works now also via virtual mailboxes. - For example if "Virtual/All" is configured to save to INBOX, `imapsieve_mailbox_name = INBOX` will trigger both when saving to INBOX and when saving to "Virtual/All". - **DOV-5347**: fs-fts-cache: When expunging created a new FTS triplet with increased "generation number", but failed to delete the old FTS triplet, this lead to broken behavior. It may have also resulted in a crash. - _Fixes_: Panic: file fs-fts-cache-sync.c: line 426 (fs_fts_sync_find_last_cached_triplet): assertion failed: (i >= 3) - **DOV-5377**: `mail_cache_fields=body.snippet` prevented parallel obox writes (mainly in dsync) - **DOV-5401**: "doveadm log errors" command didn't show errors logged by the master process. - **DOV-5416**: Aborting some doveadm commands with Ctrl-C may have caused crashes or other bad behavior. - **DOV-5472**: Invalid parameters to IMAP APPEND command can crash the imap process. - **DOV-5480**: Using doveadm "-F" parameter to specify a list of usernames didn't work in a doveadm proxy. - **DOV-5481**: doveadm with the "-F" argument would always attempt to list all users. Now it only matches usernames exactly. - **DOV-5509**: obox: Message sizes were unnecessarily written to dovecot.index.cache, even though they were also written to dovecot.index. - **DOV-5551**: fts-dovecot: Corrupted fts.X and fts.Y files weren't always deleted, resulting in repeating errors logged about them. - **DOV-5643**: The HTTP server component does not correctly log whether HTTP requests arrived on a secure connection. - **DOV-5649**: Event filter with "duration" field never matched. - **DOV-5649**: Event filters could not use 0 with non-equal comparison (e.g. >= 0). - **DOV-5649**: Event filters comparing number type field to a string value (e.g. "bytes_in=foo") crashed with signal 11. - **DOV-5654**: IMAP URLAUTH extension's URLFETCH command behavior was not RFC compliant. - **DOV-5668**: "%\{userdb:field\}" expansion didn't work for certain settings: `sendmail_path`, `submission_host`, `rawlog_dir`, and `submission_relay_rawlog_dir`. - **DOV-5670**: fts indexing assert-crashes when snowball filter causes a word to be dropped, e.g. "H." in French. - _Fixes_: Panic: file fts-filter.c: line 137 (fts_filter_filter): assertion failed: ((\*token)[0] != '\0') - **DOV-5680**: Process would crash with DNS caching enabled if lookup failed during background refresh. - **DOV-5696**: SCRAM-SHA-1 and SCRAM-SHA-256 schemes ignored the -r rounds parameter with "doveadm pw". - **DOV-5698**: obox: Error message is written wrong when index diff bundle write succeeds, but the old diff bundle deletion fails. It likely logged "Asynchronous operation in progress" rather than the real error. - **DOV-5703**: Auth process crashes (or other communication errors with it) resulted in a regular "Authentication failed" error rather than "internal error". - **DOV-5743**: If index bundle list cache wasn't up-to-date, accessing the user/folder may have crashed. - _Fixes_: Panic: file metacache-get.c: line 542 (metacache_bundle_unpack_with_bundle): assertion failed: (file->base_file->exists_as_file) - **DOV-5751**: Using email-address fts tokenizer could result in excessive memory usage with garbage email input. This could cause the indexer-worker processes to fail due to reaching the VSZ memory size limit. This was only partially fixed by DOV-4745 / v2.3.18. - **DOV-5788**: In some rare cases an HTTP client request can hang indefinitely while sending the request payload. - **DOV-5793**: Object storage failures can cause FTS to crash during expunging. - _Fixes_: Panic: cache missing when deleting failed triplets - **DOV-5814**: The IMAP URLAUTH (and Submission BURL) capability is broken in several ways and causes panics and errors upon URL resolution. - **DOV-5822**: IMAP URLAUTH URL creation and retrieval fails when the user name is translated to, e.g., some internal GUID upon login. This translation is invisible to clients, which causes URLAUTH URLs produced by clients to be rejected by the server. - **DOV-5823**: submission: Signal 11 crash if connection is closed by MTA too early. - **DOV-5844**: Fix validation of characters in IMAP tags and atoms. The DEL character (0x7F) is now rejected in both tags and atoms, and the close square bracket "]" is now accepted in tags (but not in atoms) - **DOV-5848**: doveadm crashed when invoking "doveadm fts expand -A". - **DOV-5856**: IMAP NOTIFY events caused `imap_command_finished` events to be sent with NOTIFY-CALLBACK command name. These shouldn't have been sent. - **DOV-5877**: dict-fs could have been endlessly looping when iterating in some situations. - **DOV-5954**: ManageSieve did not emit `mail_user_session_finished` event. - **DOV-5971**: IMAP NOTIFY: If a change happened within 1 second after any IMAP command was finished, the notification wasn't sent until some other change/command occurred. - **DOV-6002**: auth failed to mark the anonymous user as such. - **DOV-6005**: submission service could have logged sensitive authentication data with debug logging enabled. - **DOV-6007**: Applying imapsieve scripts to read-only source mailboxes could crash IMAP session - **DOV-6061**: The "nodelay" passdb extra field has been broken since v2.2.0. - **DOV-6062**: sieve-filter: Event recursion could have caused the log message to repeat the log prefix and overwrite parts of the actual message. - **DOV-6100**: Missing field would stop sub-metric "group_by" from first unknown field. - **DOV-6125**: Doveadm would crash if ran from a process under master process. - **DOV-6170**: obox: If `obox_fetch_lost_mails_as_empty=yes` is used and a objects metadata read is failing with "object exists in dict, but not in storage", Dovecot could have crashed after trying fall back reading vsize from index files while vsize was not in the index. - Now the object is marked as broken which prevents the reading. - _Fixes_: `Panic: file obox-mail.c: line 486 (obox_mail_get_virtual_size): assertion failed: (data->virtual_size != (uoff_t)-1)` - **DOV-6179**: Auth service crash can cause login services to crash too on a busy system. This change will cause authentications to fail instead. - **DOV-6210**: metawrap with compress, crypt, and posix fs drivers would fail. - **DOV-6212**: MTA policy server would get badly treated with multiple recipients. - **DOV-6214**: If oauth2 response failed with 200 OK, but the response JSON had error field, dovecot would not process this as error. - **DOV-6236**: Fixed case where dovecot-sysreport stops silently if gdb is not installed and core flag is used. Now the error is reported properly. - **DOV-6239**: obox: [aws-]s3: If multiple S3 requests were failing concurrently, the process could have crashed. - _Fixes_: Panic: Buffer write out of range - **DOV-6242**: "Expunged GUID mismatch" error in indexes could not be easily repaired. Such expunge requests are now ignored. - **DOV-6254**: fs-fscache always attempted to rmdir() the fscache root directory. This may have resulted in "Permission denied" errors being logged. - **DOV-6260**: imap: GETMETADATA with mailbox containing wildcards would fail with "NO [PERM]" rather than just skip the folders that cannot be accessed. The updated behavior is that if any folder is not accessible is skipped from the wildcard expansion. - **DOV-6284**: auth service: Request log lines often have no request prefix, making it unclear to which request the log line applies and which sub-system is involved. - **DOV-6315**: Prepared statements may have leaked memory if connecting to Cassandra failed. - **DOV-6318**: obox keeps mail files open until the transaction is committed. This results in excessive memory usage with large transactions, such as used by dsync. Regression since v2023.1. - **DOV-6322**: dsync may have been committing each saved mail independently instead of using `dsync_commit_msgs_interval` setting, which caused it to work inefficiently. - **DOV-6394**: Submission and LMTP services accepted termination of DATA payloads with bare CR/LFs guards instead of strictly CRLF-"."-CRLF as specified by RFC 5321. - **DOV-6407**: "doveadm fts check fast" didn't handle correctly fts.S cache files where some triplets contained per-folder message counts and some didn't. If there were any missing ones, the output should have been "?", but instead a wrong number was output. - **DOV-6409**: The last userdb's "default_fields" and "override_fields" are used, even if the user isn't found from that userdb. - **DOV-6409**: If passdb uses "userdb_" prefixed field, the first userdb's "default_fields" are added to the request, even if the user isn't found from the first userdb. - **DOV-6410**: Only the last userdb lookup was cached in auth_cache. - **DOV-6451**: Cassandra batch queries were hanging if they were sent while Cassandra wasn't connected to. - **DOV-6480**: Dovecot would send booleans as strings for auth policy requests. - **DOV-6488**: fs-dictmap may have assert-crashed in some situations. - _Fixes_: Panic: file dict-client.c: line 826 (client_dict_wait): assertion failed: (io_loop_is_empty(dict->dict.ioloop)) - **DOV-6489**: Some mail access patterns inside virtual-attachments folders (e.g. searching headers) may result in a crash. - **DOV-6527**: login-intercept didn't handle STARTTLS correctly. It was writing the encrypted network traffic into the intercept files. - **DOV-6550**: metacache rescanning logged unnecessary stat() errors when there were symlinks pointing to nonexistent files. - **DOV-6577**: login-intercept plugin wasn't working correctly with IMAP COMPRESS. The compression is now handled by the imap-login process when Dovecot proxies are used with trusted backends. - **DOV-6592**: In some cases the doveadm-server failed to restore properly the privileges after dropping them to serve the requests. This caused failures during next authentication phases reusing the same process. - **DOV-6603**: Fixed a potential hang between doveadm-to-doveadm TCP connections. - **DOV-6610**: Using fs-dictmap with fs-compress or fs-crypt may have caused unnecessary Cassandra lookups (although these were mostly avoided by using fs-fscache). - **DOV-6611**: Using fs-compress or fs-crypt with fs-dictmap may have resulted in "Object not found from dict" errors that didn't fix itself. - **DOV-6622**: imapc failed with "Opening mailbox failed: EXISTS not received" if the IMAP server violated the QRESYNC standard by advertising it in CAPABILITY reply, but without sending untagged "OK [CLOSED]" after SELECTing a folder (at least Zimbra). This is now fixed automatically by reconnecting. To avoid the reconnection, use `imapc_features=no-qresync` setting. v2.3.21 regression. - **DOV-6623**: imapc with delayed logins didn't automatically reconnect to server if the disconnection happened before opening a folder. - **DOV-6660**: "doveadm who" output didn't contain alternative usernames for hibernated IMAP sessions. - **DOV-6687**: If both "host" and "hostip" fields are set to IP and they differ, and end up in source proxy, infinite proxying loop can happen. - **DOV-6687**: If proxy field parsing fails, connection might have gotten stuck. - **DOV-6702**: When multiple DNS lookups were done in parallel, wrong IP address could have been returned in some cases, especially after DNS lookup errors. This mainly affected proxying if DNS lookups were being used. - **DOV-6715**: Fixed assert-crash if compressed/encrypted mail couldn't be written to `mail_temp_dir` (due to out of disk space). - _Fixes_: Panic: file istream-seekable.c: line 238 (read_from_buffer): assertion failed: (\*ret_r > 0) - **DOV-6716**: Fix assert-crash in master process after "Process .. is ignoring idle SIGINT" error. - _Fixes_: Panic: file service-monitor.c: line 60 (service_kill_idle): assertion failed: (processes_to_kill <= service->process_avail) - **DOV-6718**: Metacache flushing (via "doveadm flush" or metacache-worker) crashed if fs-fts-cache was enabled and the flush operation started by doing dsync-based index merging. - **DOV-6775**: mail-intercept crashes with obox and `mail_attachment_detection_options=add_flags`. - _Fixes_: Panic: file obox-save.c: line 215 (obox_save_update_keywords): assertion failed: (!save_mail->finished) - **DOV-6776**: mail-intercept plugin always opened mail bodies when copying mails. - **DOV-6828**: When reading encrypted files, a signal 11 crash can occur. - **DOV-6919**: doveadm auth test/login: Internal failures were returned with EX_NOPERM (77) instead of EX_TEMPFAIL (75) exit code. This made it difficult to distinguish between wrong password and internal failure. - **DOV-6930**: imapc may have caused a timeout leak in IDLE processing, resulting in a crash later. This was mainly visible sometimes when using shared folders via imapc. - **DOV-6931**: "doveadm save" and lib-smtp mail sending could have caused lseek() errors with certain kind of email input. This resulted in failing to save/send the mail. - **DOV-7005**: fixed controller API where response to Prometheus polls were stuck if "Metrics Export" feature is not enabled. Returns an empty response instead. - **DOV-7006**: Fixed controller's wrong parsing of Cassandra servers list if it contains spaces after the comma. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) * [Lua 5.4](https://www.lua.org/manual/5.4/) ## Obox Testing ### AWS S3
Testing Date 2024-08
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2024-08
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2024-08
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.30, 1.29 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.0 ``` ### Dovecot Pro Base [dovecot-pro-3.0.0-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.0-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.0-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.0-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.0-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.0-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.0-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.0-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.0 ``` ### Dovecot Pro Base # dovecot-pro-3.0.0 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.0 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.0 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.0 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.0 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.0 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.0 ``` ### Dovecot Pro Base # dovecot-pro-3.0.0 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.0 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.0 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.0 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.0 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.0 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.0 ``` ### Dovecot Pro Base [dovecot-pro-3.0.0-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.0-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.0-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.0-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.0-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.0-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.0 ``` ### Dovecot Pro Base [dovecot-pro-3.0.0-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.0-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.0-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.0-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.0-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.0-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.0-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.0-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.0 ``` ### Dovecot Pro Base # dovecot-pro-3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.0 ``` ### Dovecot Pro Base # dovecot-pro-3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.0/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.0.1 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2024-12-20
Support End 2025-07-31
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.0](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.0.html)** ::: This is a minor release of the Dovecot Pro v3.0.x branch, which contains bug fixes and optimizations. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. ::: ### Kubernetes Deployments #### New Features - **DOV-6950**: controller: It's possible to configure the Service type of Controller API via `controller.api.service.type` parameter (default to the current/former value: `ClusterIP`). #### Changes - **DOV-7027**: controller: It's no longer needed to mention the "maxmemory-policy" setting in the `redis.commonConfiguration` (since it's configured under the hood elsewhere). - **DOV-7028**: controller: It's now possible to configure any registry in both `global.image.registry` and `image.registry` parameters. ### Dovecot Cluster Controller #### New Features - **DOV-6744**: Cluster controller now has the possibility to run in dry-run mode by setting the key `controller.worker.dryrun` to `true`. This mode will log actions like changing backend status online or offline, or when group would move. - **DOV-6747**: Cluster controller tracks group moves for their progress. If it seems like the move is very slow or stuck it will force the move directly by updating GeoDB. Two new settings are introduced: `GROUP_MOVE_START_TIMEOUT_SECS` defines how long a group can be in the "move started" stage before it's forced and `GROUP_MOVE_FINISH_TIMEOUT_SECS` defines how long a move can take before it's forced. The following conditions trigger the force move: - If controller marked a group to be moved to another backend but dovecot backends didn't pick up the move or update GeoDB within the threshold period. - If move is in progress but it will take more than `GROUP_MOVE_FINISH_TIMEOUT_SECS` seconds for it to finish. - If there has been a long pause in group move status update by the backend. - **DOV-7078**: Controller adds support for configuring Cassandra load balancing Policy. The two options are "RoundRobin" and "DCAwareRoundRobin". The latter prefers local cluster nodes and uses remote nodes as last resort. #### Changes - **DOV-6709**: Cluster controller is now configured to have unlimited connection retries (with exponential back-off) in case of Redis connection errors or if Redis reports out of memory. - **DOV-6743**: Cluster controller now checks before evacuating backends that have high failure rate in health monitoring and if more than 75% of all backends need to be evacuated. In this situation, no group move is done. Instead a critical error is logged and the administrator is expected to manually check the root cause for the severe issue. - **DOV-7057**: Refactored Cassandra client library. This change makes cluster controller compatible with ScyllaDB. - **DOV-7064**: Controller configuration option `CASSANDRA_KEYSPACE` is renamed to `CASSANDRA_GEODB_KEYSPACE`. - **DOV-7099**: Controller configuration option `CASSANDRA_SITE` is renamed to `CASSANDRA_LOCAL_DC`. - **DOV-7198**: Non-essential packages were removed from the image - **DOV-7198**: Non-essential utilities were removed from the image #### Improvements - **DOV-7155**: Controller now warns if Cassandra queries take more than 1 second. The warnings are gated so that no same warning will be logged within 5 seconds. - **DOV-7168**: Speed optimizations for Cassandra queries by doing data filtering on the client side instead of repeatedly using ALLOW FILTERING. - **DOV-7210**: Optimised backend and group statistics gathering and processing. This fixes an issue where Prometheus metrics scraping failed due to cached metrics being too old. #### Fixed Issues - **DOV-6870**: Add workaround for memory leak in controller worker process due to a bug in underlying celery library. - **DOV-6967**: fixed controller API where response to Prometheus polls were stuck if "Metrics Export" feature is not enabled. Returns an empty response instead. - **DOV-6986**: Fixed cluster controller API to not accept IP addresses or valid UUID strings as host name when creating a backend. - **DOV-7001**: Fixed controller's wrong parsing of Cassandra servers list if it contains spaces after the comma. - **DOV-7119**: Fix wrong configuration read for minimum samples needed in load balancing. ### Dovecot #### New Features - **DOV-6805**: Support for Azure blob batch deletion #### Changes - **DOV-6910**: Docker compose now runs all components except redis as non-root user without extra privileges. Containers are marked read-only with tmpfs for state data. - **DOV-7068**: dovecot.service: Added dependency for time-sync.target. This way Dovecot won't be started before time has been synchronized. systemd-time-wait-sync.service also needs to be enabled. - **DOV-7153**: fts-kuromoji: Add U+30FB as tokenizer delimiter. - **DOV-7225**: Dovecot now requires at least OpenSSL v1.1.1 to work. #### Removed Items - **DOV-6945**: cassandra: Removed `ssl_verify=cert-dns`. This behavior is vulnerable to MITM attacks, so it's not safe to use. #### Improvements - **DOV-6792**: intercept: Added login and logout events for Utimaco X3. - **DOV-7007**: Discrete `group_by` in stats now allows modifiers via %variables. - **DOV-7015**: Add `proxy_no_multiplex` passdb extra field to disable multiplex iostreams in proxies towards the next hop. This is required when doing IMAP proxying with Dovecot v3.0 proxy - v2.3 proxy - v3.0 backend. - **DOV-7026**: Added `--oldest-safe-timestamp` option to `doveadm metacache status`. #### Fixed Issues - **DOV-6406**: imapc: When a shared mailbox's INBOX is implicitly shared due to a submailbox being shared, the \Noselect flag of INBOX was not respected. - **DOV-6922**: `doveadm who` crashed when using the json formatter. - **DOV-6997**: The `%u` format specifier in `pop3_logout_format` was always empty. - **DOV-7031**: Failing to do FTS indexing for a virtual folder may have crashed instead of simply failing with an error. - _Fixes_: Panic: file fts-backend-dovecot.c: line 354 (fts_backend_dovecot_flush_expunged): assertion failed: (last_indexed_uid <= next_indexed_uid) - **DOV-7050**: Dovecot may have wrongly logged "Time moved forwards" warnings. This mainly happened on idling servers. - **DOV-7082**: `ssl_ja3_hash` did not work in a blocking passdb. - **DOV-7111**: Sieve script would crash if more than one :optional script was missing. - **DOV-7117**: If IMAP client disconnected during IDLE unhibernation, the session may have become stuck for 30 minutes or crashed immediately. - **DOV-7120**: When dsync merges folder trees, it may crash. - _Fixes_: Panic: file dsync-mailbox-tree-sync.c: line 575 (node_mailbox_trees_cmp): assertion failed: (ret != 0) - **DOV-7121**: fs-dictmap: If delete-dangling-links option auto-deleted a lost self/diff index bundle for a folder that wasn't in folder list index (due to corruption or lost user index bundle), the folder could have been lost entirely. - **DOV-7154**: Fixed various hangs and a crash if IMAP client sent command lines longer than imap_max_line_length (default: 64 kB). - _Fixes_: Panic: file imap-client.c: line 1098 (client_check_command_hangs): assertion failed: (!have_wait_unfinished || unfinished_count > 0) - **DOV-7206**: If mdbox resyncing failed early, it crashed. This mainly happened due to a locking timeout caused by another process that was doing a long-running resync. - **DOV-7209**: If auth caching is enabled, and both passdb and userdb return changed username, then an initial login (e.g. imap) followed by a userdb lookup (e.g. lmtp) returned the unchanged username. - **DOV-7276**: doveadm auth command may crash if aborted with a signal at the same time as when the auth finishes. - **DOV-7278**: fs-s3: Bulk deletes didn't contain the maximum number of bulk delete requests when used with fs-dictmap. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) * [Lua 5.4](https://www.lua.org/manual/5.4/) ## Obox Testing ### AWS S3
Testing Date 2024-12
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2024-12
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2024-12
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.31, 1.30 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.1 ``` ### Dovecot Pro Base [dovecot-pro-3.0.1-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.1-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.1-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.1-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.1-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.1-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.1-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.1-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.1 ``` ### Dovecot Pro Base # dovecot-pro-3.0.1 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.1 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.1 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.1 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.1 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.1 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.1 ``` ### Dovecot Pro Base # dovecot-pro-3.0.1 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.1 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.1 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.1 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.1 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.1 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.1 ``` ### Dovecot Pro Base [dovecot-pro-3.0.1-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.1-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.1-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.1-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.1-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.1-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.1 ``` ### Dovecot Pro Base [dovecot-pro-3.0.1-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.1-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.1-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.1-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.1-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.1-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.1-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.1-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.1 ``` ### Dovecot Pro Base # dovecot-pro-3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.1 ``` ### Dovecot Pro Base # dovecot-pro-3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.1/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.0.2 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2025-04-09
Support End 2026-03-31
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.1](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.1.html)** ::: ### Dovecot Cluster Controller #### Changes - **DOV-7273**: `HOST_LOAD_BALANCE_MIN_COOL_TIME_SECS` has been renamed to `HOST_LOAD_BALANCE_GROUP_MIN_COOL_TIME_SECS`. - **DOV-7274**: `GROUP_BALANCE_GROUP_SIZE_SLACK_PERCENT` has been renamed to `GROUP_BALANCE_GROUP_SIZE_RATIO_SLACK`. - **DOV-7382**: Limit cluster controller container privileges even further and make root filesystem read-only. #### Improvements - **DOV-7150**: DryRun mode is changing from a global flag to per-feature configuration, allowing granular control over which specific features operate. This enhancement enables more precise testing and debugging by isolating feature behavior without impacting other functionalities. - **DOV-7352**: Cluster controller now support custom CA, authentication and client certificates for cassandra connections. ### Dovecot #### Removed Items - **DOV-7331**: Azure storage shared key authentication has been removed. #### Improvements - **DOV-7291**: Added new `%\{local_port\`} and `%\{remote_port\`} variables to mail logging. #### Fixed Issues - **DOV-7257**: fs-s3: Bulk deletes didn't contain the maximum number of bulk delete requests when used with fs-dictmap. - **DOV-7272**: doveadm auth command may crash if aborted with a signal at the same time as when the auth finishes. - **DOV-7287**: obox: Fix storage-objectid-migrate-index.sh fts object migration. - **DOV-7297**: IMAP NOTIFY may have crashed if dovecot.list.index.log was rotated rapidly enough. - **DOV-7301**: Mailbox list index rebuild didn't always detect duplicate folder names, causing the mailboxes to be lost. - **DOV-7309**: ManageSieve SSL connections may have started hanging in some situations before login. - **DOV-7334**: FETCHing a partial message following a lone CR (without a following LF character) causes corruption error. - _Fixes_: Deleting corrupted cache record: Broken virtual size in mailbox .. FETCH BODY... got too little data - **DOV-7347**: Failing to connect to userdb/master auth socket can cause a crash in some places. - _Fixes_: "doveadm user": Panic: file auth-master.c: line 440 (auth_master_unset_io): assertion failed: (conn->to == NULL) - **DOV-7455**: If backend was removed, users could no longer login. Instead, Lua exception would be raised. - **DOV-7456**: Azure FS driver was leaking memory. v3.0.1 regression. - **DOV-7502**: OpenSSL 3 lib-dcrypt can cause SSL connection failure - **DOV-7508**: Wildcards didn't work in local_name \*.example.com \{ .. }. v3.0 regression. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2025-03
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2025-05
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2025-04
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.31, 1.30 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.2 ``` ### Dovecot Pro Base [dovecot-pro-3.0.2-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.2-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.2-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.2-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.2-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.2-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.2-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.2-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.2 ``` ### Dovecot Pro Base # dovecot-pro-3.0.2 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.2 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.2 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.2 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.2 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.2 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.2 ``` ### Dovecot Pro Base # dovecot-pro-3.0.2 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.2 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.2 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.2 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.2 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.2 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.2 ``` ### Dovecot Pro Base [dovecot-pro-3.0.2-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.2-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.2-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.2-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.2-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.2-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.2 ``` ### Dovecot Pro Base [dovecot-pro-3.0.2-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.2-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.2-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.2-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.2-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.2-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.2-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.2-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.2 ``` ### Dovecot Pro Base # dovecot-pro-3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.2 ``` ### Dovecot Pro Base # dovecot-pro-3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.2/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.0.3 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2025-12-12
Support End 2026-05-31
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.2](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.2.html)** ::: This is a minor release of the Dovecot Pro v3.0.x branch, which contains bug fixes and optimizations. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. ::: ::: danger Support End for 3.0.x Major Release Branch A new Major Release version of Dovecot Pro was released (FCS) on 2025-09-29. The [[link,pro_support_commitment]] provides 12 months of additional support for the 3.0.x branch after FCS of the next Major Release. **Support for the 3.0.x branch will end on 2026-09-30**. Note: The 3.0.2 Release Notes gave an incorrect date for the end of support for the 3.0.x branch. The correct date is 2026-09-30. ::: ### Dovecot #### New Features - **DOV-7158**: obox: The aws-s3 driver now also supports IAM on EKS. See [[link,aws_s3_iam_authentication]]. #### Changes - **DOV-8385**: Allow OAUTH2 tokens to be used slightly after their expiration. Added `token_expire_grace setting` for this (default 1 minute). #### Improvements - **DOV-8494**: imapc can now use SORT IMAP extension to optimize sorting emails. #### Fixed Issues - **DOV-7501**: OpenSSL 3 lib-dcrypt can cause SSL connection failure. - **DOV-7594**: Certain relational tests of :match type would cause Sieve to crash with Panic. - _Fixes_: Panic: file bits.c: line 17 (nearest_power): assertion failed: (num <= ((size_t)1 << (CHAR_BIT\*sizeof(size_t) - 1))) - _Fixes_: Panic: file mempool.c: line 16 (pool_get_exp_grown_size): assertion failed: (old_size < min_size) - **DOV-8241**: Shared folder subscriptions to a user which does not exist would cause a panic crash. - **DOV-8284**: imapc could have wrongly written empty header values into dovecot.index.cache, unless `imapc_features=no-fetch-header` was used. - **DOV-8384**: Corrupted virtual dovecot.index file may have caused a crash - _Fixes_: Panic: file virtual-sync.c: line 673 (virtual_sync_mailbox_box_remove): assertion failed: (uidmap[src].real_uid == uid) - **DOV-8385**: Just-generated OAUTH2 tokens sometimes fail with "Token is issued in future", because time can't be 100% synced. Allow timestamps 1 second into the future. - **DOV-8386**: Utimaco - Interception with large mail deliveries crashes. - _Fixes_: Panic: file ostream.c: line 59 (o_stream_close_full): assertion failed: (stream->real_stream->error_handling_disabled) - **DOV-8390**: Utimaco - Interception was skipped for IMAP responses where server sent a line longer than 64 kB. - **DOV-8397**: obox: Existing IMAP UIDs may become reused if mails are in the middle of being expunged when the backend crashes. This can also result in UIDNEXT value shrinking. - **DOV-8399**: obox: Virtual folders may have lost dovecot.index.log from index bundles, which mainly meant opening them again was unnecessarily inefficient due to rebuilds. - **DOV-8409**: obox: azure: SAS based authentication has been appending an extra '/' to all object names in storage. This behavior can be enabled by adding `trailing_slash_workaround=yes` to the azure URL parameters. By default it is no longer appending '/'. - **DOV-8448**: obox: If fs-auth failed to acquire a valid token, fs-s3 and fs-azure still sent requests which fail with an authentication error. These requests now fail earlier and use the fs-auth provided error. This affects azure SAS based authentication and S3 IAM. - **DOV-8494**: imapc ignored remote SEARCH command failures. It returned empty results instead. - **DOV-8494**: imapc sent UID STORE commands with uidsets ending with a comma. This wasn't valid IMAP protocol, although it seems many IMAP servers allow it. ### Dovecot Cluster Controller #### Fixed Issues - **DOV-8229**: Backends are not evacuated and set offline if Dovecot is stopped due to a crash or was killed. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2025-12
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2025-12
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2025-12
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.33, 1.32 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.3 ``` ### Dovecot Pro Base [dovecot-pro-3.0.3-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.3-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.3-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.3-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.3-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.3-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.3-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.3-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.3 ``` ### Dovecot Pro Base # dovecot-pro-3.0.3 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.3 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.3 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.3 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.3 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.3 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.3 ``` ### Dovecot Pro Base # dovecot-pro-3.0.3 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.3 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.3 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.3 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.3 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.3 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.3 ``` ### Dovecot Pro Base [dovecot-pro-3.0.3-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.3-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.3-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.3-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.3-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.3-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.3 ``` ### Dovecot Pro Base [dovecot-pro-3.0.3-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.3-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.3-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.3-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.3-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.3-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.3-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.3-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.3 ``` ### Dovecot Pro Base # dovecot-pro-3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.3 ``` ### Dovecot Pro Base # dovecot-pro-3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.3/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.0.4 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-02-10
Support End 2026-06-30
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.3](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.3.html)** ::: This is a minor release of the Dovecot Pro v3.0.x branch, which contains security fixes. ::: danger Security Information See https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html for full details on the security incident. ::: ### Dovecot #### Changes - **DOV-8614**: SECURITY: Removed (insecure) decode2text.sh FTS attachment parser script. #### Fixed Issues - **DOV-8610**: SECURITY: Using %d in passwd-file path can lead to reading /etc/passwd. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-01
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-01
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-01
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.34, 1.33 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.4 ``` ### Dovecot Pro Base [dovecot-pro-3.0.4-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.4-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.4-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.4-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.4-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.4-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.4-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.4-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.4 ``` ### Dovecot Pro Base # dovecot-pro-3.0.4 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.4 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.4 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.4 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.4 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.4 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.4 ``` ### Dovecot Pro Base # dovecot-pro-3.0.4 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.4 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.4 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.4 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.4 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.4 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.4 ``` ### Dovecot Pro Base [dovecot-pro-3.0.4-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.4-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.4-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.4-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.4-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.4-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.4 ``` ### Dovecot Pro Base [dovecot-pro-3.0.4-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.4-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.4-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.4-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.4-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.4-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.4-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.4-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.4 ``` ### Dovecot Pro Base # dovecot-pro-3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.4 ``` ### Dovecot Pro Base # dovecot-pro-3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.4/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.0.5 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-03-13
Support End 2026-09-30
Current Support Status Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.4](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.4.html)** ::: ::: danger Security Information See https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html for full details on the security incident. ::: ### Dovecot #### Fixed Issues - **DOV-8802**: A large number of MIME header parameters caused excessive CPU usage. - **DOV-8823**: imap-login process can be made to use excessive amount of memory by sending many '(' (open list) characters in the IMAP commands. Prevent this by limiting to just one '(' character per IMAP command in the imap-login process. For post-login imap process there is no explicit limit for this, since there are many other ways to grow memory usage. - **DOV-8828**: managesieve-login process could be easily crashed by sending an AUTHENTICATE command with an excessively large initial response parameter size. This would end up trying to allocate all the memory, leading to reaching process's `vsz_limit`. - **DOV-8836**: Doveadm HTTP and TCP client did not use timing safe credentials comparison, enabling attacker to do timing based attack to determine credentials. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-01
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-01
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-01
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.34, 1.33 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.5 ``` ### Dovecot Pro Base [dovecot-pro-3.0.5-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.5-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.5-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.5-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.5-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.5-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.5-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.5-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.5 ``` ### Dovecot Pro Base # dovecot-pro-3.0.5 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.5 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.5 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.5 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.5 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.5 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.5 ``` ### Dovecot Pro Base # dovecot-pro-3.0.5 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.5 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.5 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.5 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.5 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.5 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.5 ``` ### Dovecot Pro Base [dovecot-pro-3.0.5-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.5-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.5-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.5-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.5-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.5-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.5 ``` ### Dovecot Pro Base [dovecot-pro-3.0.5-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.5-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.5-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.5-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.5-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.5-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.5-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.5-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.5 ``` ### Dovecot Pro Base # dovecot-pro-3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.5 ``` ### Dovecot Pro Base # dovecot-pro-3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.5/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.0.6 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-06-25
Support End 2026-09-30
Current Support Status Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.5](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.5.html)** ::: This is a minor release of the Dovecot Pro v3.0.x branch, which contains bug fixes and optimizations. ### Dovecot #### Fixed Issues - **DOV-8569**: When virtual mailbox was configured to use metadata filters, the mailbox opening failed if there were any \Nonexistent mailboxes matching the mailbox name filter. For example with obox when creating "parent/child" mailbox, the parent mailbox is \Nonexistent. - **DOV-9101**: Using [[doveadm,acl remove]] didn't fully remove the user identifier from ACLs. It just left it as having no rights. - **DOV-9102**: Partial (multi-byte) character at the end of a MIME part was leaked into beginning of the next MIME part. This could have resulted in broken decoding, or possibly a crash. - _Fixes_: Panic: file message-decoder.c: line 232 (translation_buf_decode): assertion failed: (orig_size < CHARSET_MAX_PENDING_BUF_SIZE) - **DOV-9121**: Login processes may have crashed in some situations. - _Fixes_: Panic: epoll_ctl(del, ...) failed: Bad file descriptor - **DOV-9122**: Login processes sometimes crashed when handling SSL connections. - _Fixes_: Panic: file iostream.c: line 28 (iostream_fd_unref): assertion failed: (ref->refcount > 0) - **DOV-9144**: Fix imap process panic. - _Fixes_: Panic: file imap-client.c: line 1123 (client_check_command_hangs): assertion failed: ((io_loop_find_fd_conditions(current_ioloop, client->fd_out) & IO_WRITE) != 0) ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-01
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-01
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-06
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.35, 1.34 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.6 ``` ### Dovecot Pro Base [dovecot-pro-3.0.6-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.6-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.6-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.6-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.6-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.6-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.6-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.6-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.6 ``` ### Dovecot Pro Base # dovecot-pro-3.0.6 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.6 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.6 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.6 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.6 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.6 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.6 ``` ### Dovecot Pro Base # dovecot-pro-3.0.6 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.6 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.6 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.6 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.6 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.6 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.6 ``` ### Dovecot Pro Base [dovecot-pro-3.0.6-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.6-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.6-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.6-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.6-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.6-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.6 ``` ### Dovecot Pro Base [dovecot-pro-3.0.6-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.6-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.6-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.6-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.6-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.6-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.6-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.6-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.6 ``` ### Dovecot Pro Base # dovecot-pro-3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.6 ``` ### Dovecot Pro Base # dovecot-pro-3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.6/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.0.7 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-07-30
Support End 2026-09-30
Current Support Status Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.6](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.6.html)** ::: This is a minor release of the Dovecot Pro v3.0.x branch, which contains security fixes and bug fixes. ::: danger Security Embargo The changelog and details of the security fix will be disclosed following the public announcement. ::: ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-01
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-01
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-06
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.35, 1.34 ### Cluster Controller [[link,cluster_controller_installation]] ## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.0.7 ``` ### Dovecot Pro Base [dovecot-pro-3.0.7-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.7-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.7-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0.7-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0.7-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0.7-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.7-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.7-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.0-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.0-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.0.7 ``` ### Dovecot Pro Base # dovecot-pro-3.0.7 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.7 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.7 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.7 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.7 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.7 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.0.7 ``` ### Dovecot Pro Base # dovecot-pro-3.0.7 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.7 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.7 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.7 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.7 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.7 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.7 ``` ### Dovecot Pro Base [dovecot-pro-3.0.7-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.7-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.7-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.7-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.7-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.7-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.0.7 ``` ### Dovecot Pro Base [dovecot-pro-3.0.7-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0.7-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0.7-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0.7-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0.7-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.7-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0.7-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0.7-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base [dovecot-pro-3.0-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.0-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.0-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.0-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.0-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.0-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.0-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.0.7 ``` ### Dovecot Pro Base # dovecot-pro-3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.7 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.0.7 ``` ### Dovecot Pro Base # dovecot-pro-3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0.7 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0.7/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.0-stable ``` ### Dovecot Pro Base # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.0-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.0-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.1.0 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2025-09-29
Support End 2026-02-28
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.0.2](https://doc.dovecotpro.com/latest/release_notes/3.x/3.0.2.html)** ::: This is the first major release of Dovecot Pro v3.1. This release introduces the new Dovecot configuration syntax. See the Upgrade page (link above) for details on the necessary conversion needed from pre-3.1 configurations. As a major release, in addition to bug fixes and optimizations, this release contains new features as well as removals of existing features. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. ::: ### Dovecot #### New Features - **DOV-6263**: Support inline ACLs in config file, see [[link,acl]] for more information. - **DOV-6325**: Added `%{system:cpu_count}` variable. - **DOV-6383**: Support TLS Application-Layer Protocol Negotiation (ALPN). - **DOV-7275**: Add support for indexing attachments in FTS with Apache Tika. See [[link,tika_support]]. - **DOV-7330**: Support PLUS variants of SCRAM-SHA-1 and SCRAM-SHA-256 mechanisms. - **DOV-7336**: sieve: Add simple "i;unicode-casemap" comparator. It cannot do character decomposition. - **DOV-7350**: Added support for IMAP REPLACE extension ([[rfc,8508]]). - **DOV-7351**: Added support for IMAP LIST-MYRIGHTS extension ([[rfc,8440]]). - **DOV-7407**: obox: The aws-s3 driver now also supports IAM on EKS. See [[link,aws_s3_iam_authentication]]. #### Changes - **DOV-6004**: All settings now support `%{variables}`, except for `log_timestamp`, `listen`, and `inet_listener { address }`. - **DOV-6004**: Unset `service { ... }` settings now default to the global `service_*` settings. The "0" values no longer mean "default" values - instead they're treated as invalid values. The `default_process_limit`, `default_client_limit`, `default_idle_kill`, and `default_vsz_limit` settings were removed. Use the global `service_process_limit`, `service_client_limit`, `service_idle_kill`, and `service_vsz_limit` settings instead. - **DOV-6004**: `postmaster_address` setting that is explicitly set to empty no longer generates an address. Keep the setting as default (unset) instead to preserve the old behavior. - **DOV-6019**: `namespace { alias_for }` now points to the namespace name, not the prefix. - **DOV-6019**: Empty `submission_backend_capabilities` value now means to propagate backend's capabilities. To disable all capabilities, use "-". - **DOV-6027**: Added "list of booleans" setting type. Settings that use it are: `protocols`, `mail_plugins`, `auth_mechanisms`, and `passdb_mechanisms`. - **DOV-6040**: Renamed `ssl_verify_client_cert` setting to `ssl_request_client_cert`. - **DOV-6040**: Split `ssl_client_ca` out of `ssl_ca`. `ssl_ca` is now used only for verifying client certificates, while `ssl_client_ca` is used in addition to `ssl_client_ca_file`/`ssl_client_ca_dir`. - **DOV-6040**: passdb imap no longer has "ssl_ca_dir", "ssl_ca_file", or "allow_invalid_cert" args. Instead, the global `ssl_client_ca_file`/`ssl_client_ca_dir` and `ssl_client_require_valid_cert` settings can be used. - **DOV-6040**: passdb and userdb event fields changed: "passdb" and "userdb" fields were renamed to "passdb_driver" and "userdb_driver". "passdb_name" and "userdb_name" were renamed to replace the original "passdb" and "userdb". - **DOV-6073**: auth client, auth server, login: Renamed "service" event field to "protocol", which more correctly describes the value. Note that storage events still have a "service". - **DOV-6073**: auth, login: Renamed `%s` and `%{service}` variables to `%{protocol}`, which more correctly describes the value. Note that storage variables still have `%{service}`. - **DOV-6073**: oauth2: Rename "X-Dovecot-Auth-Service" HTTP header to "X-Dovecot-Auth-Protocol". - **DOV-6095**: Enable SNI for SMTP and LMTP. Reload `local_name` config sections for the specified server name. - **DOV-6110**: `auth_policy_server_timeout_msecs` setting replaced by `auth_policy { http_client_request_absolute_timeout }`. - **DOV-6110**: fs-auth "-R" parameter replaced by `fs_auth { http_client_rawlog_dir }`. - **DOV-6110**: `fs_auth_request_timeout` setting replaced by `fs_auth { http_client_request_timeout }`. - **DOV-6110**: `fs_auth_request_max_retries` setting replaced by `fs_auth { http_client_max_attempts }`. - **DOV-6110**: oauth2 uses now the global `http_client_*` and `ssl_*` settings. The old settings were removed from the .conf.ext file. - **DOV-6112**: notify status: Change `notify_status_dict` into a filter-name. `notify_mailbox_status` is now called `mailbox_notify_status` and is disabled by default, it can be enabled per mailbox or using a mailbox filter name wildcard. - **DOV-6114**: Replace `mail_attachment_fs` with `mail_attachment { ... }` named filter. - **DOV-6114**: doveadm fs: Change "fs-driver" & "fs-args" parameters to filter-name. - **DOV-6114**: doveadm dict: Change "dict-uri" parameter to filter-name. - **DOV-6114**: Replace `obox_fs` with `obox { ... }` named filter. Replace `obox_index_fs` with `metacache { ... }` named filter. - **DOV-6114**: Replace `fs_server_backend` with `fs_server { ... }` named filter. - **DOV-6114**: obox fs-drivers' settings are now individual normal `fs_*` settings, not encoded in the URLs or elsewhere. Some of the fs-drivers' default settings have also been changed. - **DOV-6114**: obox fs-drivers' HTTP User-Agent header no longer contains obox/version. - **DOV-6114**: Replace `fts_dovecot_fs` with `fts_dovecot { ... }` named filter. - **DOV-6114**: Replace `intercept_fs` with `intercept { ... }` named filter. - **DOV-6118**: push-notification: Change `push_notification` into a filter-name. Push notification settings now require a `push_notification_driver` key that identifies the appropriate driver, as well as specifically named options per driver. - **DOV-6119**: lazy_expunge plugin settings converted to normal `lazy_expunge_*` settings. - **DOV-6120**: `mail_compress_save` plugin setting is replaced by `mail_compress_write_method`. `mail_compress_save_level` plugin setting is replaced by compression method specific settings: `compress_gz_level`, `compress_deflate_level`, `compress_bz2_block_size_100k`, and `compress_zstd_level`. - **DOV-6120**: fs-compress: The compression method parameter is replaced by `fs_compress_write_method setting`. An empty setting means writing with plaintext. The old "maybe-" prefix is replaced by `fs_compress_read_plain_fallback` setting. - **DOV-6169**: `mail_crypt_*` plugin settings converted to normal `crypt_*` settings. - **DOV-6263**: ACL settings have changed. See [[link,acl]] for more information. - **DOV-6278**: Split `mail_location` setting into separate settings: - "format:path" prefix split to `mail_driver` and `mail_path` settings - INBOX: `mail_inbox_path` - INDEX: `mail_index_path` - INDEXPVT: `mail_index_private_path` - INDEXCACHE: `mail_cache_path` - CONTROL: `mail_control_path` - ALT: `mail_alt_path` - ALTNOCHECK: `mail_alt_check` - LAYOUT: `mailbox_list_layout` - SUBSCRIPTIONS: `mailbox_subscriptions_filename` - DIRNAME & FULLDIRNAME: `mailbox_directory_name` & `mailbox_directory_name_legacy` - MAILBOXDIR: `mailbox_root_directory_name` - VOLATILEDIR: `mail_volatile_path` - LISTINDEX: `mailbox_list_index_prefix` - BROKENCHAR: `mailbox_list_visible_escape_char` - KEEP-NOSELECT: `mailbox_list_drop_noselect` - NO-FS-VALIDATION: `mailbox_list_validate_fs_names` - ITERINDEX: `mailbox_list_iter_from_index_dir` - UTF-8: `mailbox_list_utf8` - **DOV-6278**: `mailbox { driver }` setting replaced by `mailbox { mail_driver }`. - **DOV-6278**: listescape plugin was removed, and its functionality was replaced by the `mailbox_list_storage_escape_char` setting. - **DOV-6278**: doveadm sync/backup: The destination parameter is now in a simple "mail_driver:mail_path" format. For additional options use "-p" parameter to specify any destination-specific storage options (similarly to how "-o" parameter would be used for source-specific storage options). - **DOV-6278**: doveadm import: The source location parameter is now in a simple "mail_driver:mail_path" format. For additional options use "-p" parameter to specify any source-specific storage options (similarly to how "-o" parameter would be used for destination-specific storage options). - **DOV-6278**: Rename `mail_attachment*` settings related to external attachment files to `mail_ext_attachment*`. Also rename `mail_attachment_dir` to `mail_ext_attachment_path`. - **DOV-6291**: Removed `namespace { location }` setting. Use `namespace { mail_location }` instead. - **DOV-6295**: Removed the example configuration and replaced it with an automatically installed minimum configuration. - **DOV-6304**: fts settings have changed. See [[plugin,fts]]. - **DOV-6304**: fts-solr settings have changed. See [[plugin,fts-solr]]. - **DOV-6304**: fts-dovecot settings have changed. See [[plugin,fts-dovecot]]. - **DOV-6305**: `import_environment` setting is now a string list. The values are expanded from the calling environment on Dovecot startup. - **DOV-6305**: `imap_id_send` setting is now a string list. New distribution attributes are available in the configuration via the `%{dovecot:}` syntax. - **DOV-6306**: `passdb { default_fields }` and `passdb { override_fields }` are now string lists. - **DOV-6306**: Added `passdb_default_password_scheme`, `passdb_use_worker`, and `userdb_use_worker` settings. These are the new standard ways of changing these settings rather than having passdb/userdb-specific settings. - **DOV-6307**: quota_clone plugin settings converted to normal `quota_clone*` settings - **DOV-6313**: `stats_http_rawlog_dir` replaced by `stats_server { http_server_rawlog_dir }`. - **DOV-6313**: `doveadm_http_rawlog_dir` replaced by `doveadm_server { http_server_rawlog_dir }`. - **DOV-6325**: `%{pid}`, `%{uid}` and `%{gid}` variables are now prefixed with process:, e.g. `%{process:pid}`. `%{hostname}` is now prefixed with system:, i.e. `%{system:hostname}`. - **DOV-6325**: Renamed `%{pid}` to `%{client_pid}` in auth variables. - **DOV-6326**: Replace `inet_listener { address }` with `inet_listener { listen }`. - **DOV-6365**: Moved Sieve plugin settings to global settings. Invalid Sieve plugin and extension configuration now causes errors and Sieve interpreter failures, instead of just warnings and disabling of the involved plugin or extension. - **DOV-6379**: `service { service_count }` renamed to `service_restart_request_count`. - **DOV-6383**: Pre-login settings are applied based on SNI. - **DOV-6391**: `fts_languages` setting has been converted into `language xx { ... }`. blocks. See [[setting,language]]. - **DOV-6391**: `fts_filters` setting has been changed and split into converted into `language_filters`, `language_filter_normalizer_icu_id`, and `language_filter_stopwords_dir`. See [[link,fts_filter_configuration]]. - **DOV-6391**: `fts_tokenizers` setting has been changed and split into `language_tokenizers`, `language_tokenizer_address_token_maxlen`, `language_tokenizer_generic_algorithm`, `language_tokenizer_generic_token_maxlen`, `language_tokenizer_generic_wb5a`, `language_tokenizer_kuromoji_icu_id`, `language_tokenizer_kuromoji_split_compounds`, and `language_tokenizer_kuromoji_token_maxlen`. See [[link,fts_tokenizer_configuration]]. - **DOV-6421**: `dict { .. }` string list was converted to `dict_server { dict { .. } ... }` filter settings. See [[link,dict]]. - **DOV-6424**: passdb/userdb passwd-file args parameter converted to separate settings: - "scheme": `passdb_default_password_scheme` - "username_format": `auth_username_format` - "path": `passwd_file_path` - **DOV-6446**: oauth2 settings are now inlined. See [[link,auth_oauth2]]. - **DOV-6447**: OAuth2 mechanism no longer use passdb to validate tokens, instead a new setting `auth_oauth2_config_file` is used. - **DOV-6453**: passdb/userdb static args parameter converted to separate settings: - "password": `passdb_static_password` - "allow_all_users": `userdb_static_allow_all_users` - **DOV-6454**: passdb/userdb passwd args parameter converted to separate settings: - "blocking": `passdb_use_worker` and `userdb_use_worker` - **DOV-6455**: lib-lua: Add `lua_file` and `lua_settings` global settings. These settings are now used by passdb-lua, userdb-lua, push-notification-lua, and mail-lua. - **DOV-6455**: Introduce `mail_lua` setting filter. - **DOV-6455**: Remove `push_notification_lua_path`, it can now be configured using the `lua_file` setting. - **DOV-6455**: passdb/userdb lua args parameter converted to separate settings: - "scheme": `passdb_default_password_scheme` - "file": `lua_file` - generic args: `lua_settings` - "blocking": `userdb_use_worker` and `passdb_use_worker` - "cache_key": The setting is removed, it can now be set from the auth lua script itself implementing auth_userdb_get_cache_key() and auth_passdb_get_cache_key(). - **DOV-6456**: passdb imap: Replace args-based settings with generic `imapc_*` settings. - **DOV-6456**: Change default value of `imapc_max_line_length` to unlimited. Make "0" an explicit configuration error. - **DOV-6457**: LDAP external config file has been converted into `ldap_*`, `passdb_ldap_*`, and `userdb_ldap_*` settings. - **DOV-6458**: passdb/userdb pam args parameter converted to separate settings: - "blocking": `passdb_use_worker` and `userdb_use_worker` - "session": `passdb_pam_session` - "setcred": `passdb_pam_setcred` - "failure_show_msg": `passdb_pam_failure_show_msg` - "max_requests": `passdb_pam_max_requests` - service name parameter: `passdb_pam_service_name`; "cache_key" parameter was removed. - **DOV-6459**: passdb bsdauth: replace "blocking" argument with global `use_worker` setting. - **DOV-6459**: passdb bsdauth lookups are cached by default now, previously this needed a specific passdb argument. - **DOV-6471**: Converted ssl settings to file type: - `ssl_cert`: `ssl_cert_file` - `ssl_alt_cert`: `ssl_alt_cert_file` - `ssl_key`: `ssl_key_file` - `ssl_alt_key`: `ssl_alt_key_file` - `ssl_client_cert`: `ssl_client_cert_file` - `ssl_client_key`: `ssl_client_key_file` - `ssl_dh`: `ssl_dh_file` - `ssl_ca`: `ssl_ca_file` - `ssl_client_ca` and `ssl_client_ca_file`: merged into `ssl_client_ca_file` - **DOV-6471**: Converted mail-crypt settings to file type: - `crypt_private_key`: `crypt_private_key_file` - `crypt_global_public_key`: `crypt_global_public_key_file` - **DOV-6483**: sql connect string was split into individual `mysql_*`, `pgsql_*`, `sqlite_*`, and `cassandra_*` settings. - **DOV-6542**: passdb/userdb sql: external config file was moved to regular settings: - "connect": individual sql-driver specific settings - "password_query": `passdb_sql_query` - "user_query": `userdb_sql_query` - "update_query": `passdb_sql_update_query` - "iterate_query": `userdb_sql_iterate_query` - "default_pass_scheme": `passdb_default_password_scheme` - **DOV-6551**: Referring to a `$setting` in config file must now be prefixed with "\$SET:", i.e. `$SET:setting`. - **DOV-6552**: External dict-sql configuration file was converted to regular settings. - **DOV-6556**: `dict { .. }` is renamed to `dict_legacy { ... }` for now; this will be removed entirely later. - **DOV-6556**: `dict_driver=` setting is replaced by `dict { }`. - **DOV-6559**: Split `fts_enforced` setting: - `fts_enforced=no` (default): `fts_search_add_missing=body-search-only`, `fts_search_read_fallback=yes` - `fts_enforced=yes`: `fts_search_add_missing=yes`, `fts_search_read_fallback=no` - `fts_enforced=body`: `fts_search_add_missing=body-search-only`, `fts_search_read_fallback=no` - **DOV-6693**: The "driver" field in dict events was renamed to "dict_driver". - **DOV-6901**: Renamed ":protected" passdb/userdb field suffix to ":default". - **DOV-6909**: welcome plugin now uses global settings and `execute { .. }` settings. - **DOV-6912**: Setting names for Dovecot's Lua HTTP client have changed. - **DOV-6917**: Default quota grace changed from "10%" to "10 MB". - **DOV-6924**: Variable syntax has been changed. See [[link,settings_variables]]. - **DOV-6984**: Converted last_login, mail_log, virtual, apparmor, charset_alias, pop3_migration, and trash plugin settings to global settings. - **DOV-6999**: Various changes to metric and event exporter settings. - **DOV-7069**: Renamed `service_idle_kill` setting to `service_idle_kill_interval`. - **DOV-7070**: Shared namespace prefix "%%variables" were changed to "$variables". - **DOV-7071**: Renamed `passdb_mechanisms` to `passdb_mechanisms_filter`. Rename "none" value to "lookup". - **DOV-7187**: Converted metacache and obox plugin settings to global settings. Added `metacache_pull` setting. Renamed settings: - `metacache_disable_bundle_list_cache`: `metacache_bundle_list_cache` - `metacache_disable_secondary_indexes`: `metacache_secondary_indexes` - `obox_refresh_index_once_after`: `metacache_refresh_index_once_after` - `obox_rescan_mails_once_after`: `metacache_rescan_mails_once_after` - `obox_no_pop3_backend_uidls`: `obox_pop3_backend_uidls` - `obox_dont_use_object_ids`: `obox_use_object_ids` - **DOV-7187**: `mail_prefetch_count` defaults to "10" now for obox format. - **DOV-7187**: Moved `obox_lost_mailbox_prefix` setting to `mailbox_list_lost_mailbox_prefix` core setting. - **DOV-7197**: Intercept plugin settings and environment variables are now global settings. - **DOV-7199**: encrypt and decrypt filters are now always available for %variables. - **DOV-7203**: Convert pop3-uidl-migrate, vault, and nfs-hostchange plugin settings to globals. - **DOV-7240**: doveadm and dovecot-lda no longer log an error if they can't connect to stats-writer socket due to permission errors. - **DOV-7242**: Renamed `fts_index_timeout` to `fts_search_timeout`. - **DOV-7251**: Dovecot no longer enables any protocols (imap, pop3 or lmtp) by default. You need to enable the ones you want explicitly with the `protocols` setting. - **DOV-7255**: Replace in-URL authentication configuration for azure storage. - Adds `fs_azure_account_name`, `fs_azure_container_name`, `fs_azure_legacy_auth_secret`, and `fs_azure_service_sas_secret`. - Remove the `no_sas_auth` URL Parameter. It is replaced by `fs_azure_auth_type` which defaults to "user-sas". - **DOV-7255**: To configure User SAS, the URL Parameter based configuration is replaced by the following settings: - "auth_tenant_id": `fs_azure_auth_user_sas_tenant_id` - "auth_client_id": `fs_azure_auth_user_sas_client_id` - "client_secret": `fs_azure_user_sas_client_secret` - **DOV-7255**: Replace in-URL authentication configuration for S3 storage. - Adds `fs_s3_access_key` and `fs_s3_secret`. - **DOV-7302**: `ssl_cipher_list` for outgoing SSL client connections is now empty (OpenSSL default). - **DOV-7305**: Added "ssl_server_" prefix to SSL server settings: `ssl_server_ca_file`, `ssl_server_cert_file`, `ssl_server_alt_cert_file`, `ssl_server_key_file`, `ssl_server_alt_key_file`, `ssl_server_key_password`, `ssl_server_dh_file`, `ssl_server_cert_username_field`, `ssl_server_require_crl`, `ssl_server_request_client_cert`, `ssl_server_prefer_ciphers`. - **DOV-7431**: auth-lua: Passdb and userdb lookups can no longer return a space-separated string of "key=values". They must return a table of "key=values" now instead. - **DOV-7436**: `auth_failure_delay=0` removes auth failure delay now entirely, effectively behaving the same as using "nodelay=yes" passdb extra field. - **DOV-7526**: imap-master socket is now owned by dovecot internal user by default. - **DOV-7527**: Change the default `lmtp_user_concurrency_limit` from "0" (unlimited) to "10". Also "0" is now an invalid value, use "unlimited" instead. - **DOV-7671**: DNS lookup timeouts are now configured via `dns_client_timeout` setting. - **DOV-7714**: The anvil UNIX socket listener's default group changed to `default_internal_group` and mode to 0660. This allows all processes launched via the Dovecot master process to access the anvil socket. - **DOV-7769**: obox: Introduce `fs_http_url_suffix` setting. This can be used to configure a suffix to the fs-http based storage used in obox, metacache, or fts_dovecot filters. https://doc.dovecotpro.com/3.1.0/storage/configuration.html#fs_http_url_suffix - **DOV-7788**: Removed the concept of user groups from Palomar. - **DOV-7819**: dovecot-pro-cluster package now installs dovecot-pro-obox package as package dependency - **DOV-7873**: Giving unknown settings as -o command line parameters fails now. - **DOV-7873**: Added "set/" prefix for userdb extra fields to explicitly specify that the field is intended to be a setting. Unknown settings with the "set/" prefix will cause a failure. - **DOV-7887**: $SET is now expanded to the value at the end of configuration parsing instead of what it was at the $SET parsing time. This fixes using $SET inside settings groups. - **DOV-8001**: doveadm's "table" formatter prints empty fields now as "-". - **DOV-8081**: Changed `metacache_pull_finished` event: Removed `exit_code`; added `files_count` and `import_count`. - **DOV-8116**: Add `cluster_director_transition_config` setting. It can be used to configure user logins to do a additional lookup for the backend that they lived on in the director based setup they are targeted to be migrated from. See [[setting,cluster_director_transition_config]]. #### Removed Items - **DOV-5767**: `config_cache_size` setting, which is now unnecessary. - **DOV-6040**: `verbose_ssl` setting. Replaced by `log_debug = category=ssl`. - **DOV-6114**: obox-fs.sh script. "doveadm mail fs" commands replace this. - **DOV-6119**: lazy_expunge no longer supports namespaces as destination. - **DOV-6169**: fs-mail-crypt plugin. The fs-crypt plugin works for the same purposes now. - **DOV-6169**: mail_crypt plugin no longer supports writing version 1 files. - **DOV-6263**: Global ACL directory support has been fully removed. - **DOV-6278**: passwd-file: Remove support for "old" format which used `mail_location` setting in the "shell" field. - **DOV-6278**: doveadm sync/backup: Removed "-d" (default-destination) and "-E" (legacy-dsync) parameters. - **DOV-6306**: `passdb { pass }` setting. Use "result_success=continue" instead. - **DOV-6456**: Remove `imapc_ssl_verify` setting. Use `ssl_client_require_valid_cert` instead. - **DOV-6542**: `userdb_warning_disable` setting was removed. - **DOV-6901**: passdb/userdb `default_fields { ... }` and `override_fields { ... }`. These are replaced by the more generic `fields { ... }`. Default fields can be set by adding ":default" to the field name. - **DOV-6917**: Maildir++ quota: Remove support for reading quota limits from an existing maildirsize file. Quota limits must be explicitly configured in Dovecot. - **DOV-6924**: Old variable aliases have been removed. - **DOV-6924**: Old one letter variables are no longer supported. - **DOV-7173**: doveconf "-m", "-p", and "-S" parameters. - **DOV-7187**: Removed unnecessary settings: `metacache_socket_path`, `obox_username`. - **DOV-7431**: auth-lua: Removed auth_request#response_from_template(). Return the table instead with the necessary auth_request#var_expand() calls. #### Improvements - **DOV-5767**: Added "local_name" field to pre-login client event. - **DOV-6004**: Added "unlimited" value for number, size, and time interval setting types. Some of the `service { idle_kill }` defaults now shows up as "unlimited". - **DOV-6110**: Added global `http_client_*` settings. - **DOV-6114**: Add "doveadm mail fs" commands. These are similar to "doveadm fs" commands, but they're run in the mail user context. This way all user-specific settings are applied and process uid/gid is also set properly. - **DOV-6114**: Add "doveadm mail dict" commands. These are similar to "doveadm dict" commands, but they're run in the mail user context. This way all user-specific settings are applied and process uid/gid is also set properly. - **DOV-6313**: Added global `http_server_*` settings. - **DOV-6485**: Added `passdb_fields { ... }` and `userdb_fields { ... }` that can be used to specify passdb/userdb extra fields. These can refer to the passdb/userdb lookup's results using %variables. These make the old "default_fields" and "override_fields" parameters unnecessary. - **DOV-6525**: Clarify warning reason if a query takes longer than `cassandra_warn_timeout`. - **DOV-6529**: Empty passdb/userdb_driver settings default to `passdb_name`/`userdb_name` settings. This allows using, e.g., `passdb passwd-file { ... }` without specifying the driver setting again. - **DOV-6693**: Added "sql_driver" field to sql events. - **DOV-6710**: Added support for groups includes in configuration file. See [[link,settings_groups_includes]]. - **DOV-7076**: Added built-in "@fs_dictmap_defaults", "@cluster_defaults", and "@metric_defaults" groups, which can be included in configuration files to pull required/recommended default settings. - **DOV-7174**: You can now iterate users from variable passwd-file paths if enough variables are provided. - **DOV-7197**: Added `%{generate:guid}`, `%{generate:guid128}`, and `%{generate:uuid}` variables. - **DOV-7199**: %variable encryption supports hashed key material generation with salt. - **DOV-7302**: Added `ssl_client` and `ssl_server` named filters for giving client/server-specific SSL settings. - **DOV-7338**: Default folder names can be changed easily in userdb by returning, e.g., "namespace/inbox/mailbox/trash/name=RenamedTrash". - **DOV-7368**: lua: Add event.set_forced_debug() and event.unset_forced_debug(). - **DOV-7399**: Added proxy_session_reconnecting event when login-proxy fails to login to remote proxy, but it will try to reconnect again. Also log this event as a warning. This could help indicate, e.g., network packet loss and other random failures that otherwise silently increase user-visible login latency. - **DOV-7445**: `passdb_user_worker=yes` & `userdb_use_worker=yes` can be set now with PostgreSQL and Cassandra drivers to run them in auth-worker processes. - **DOV-7515**: Added "@mailbox_defaults=english" settings group. - **DOV-8018**: Support site/backend IDs in all doveadm cluster commands' site/backend name parameters. - **DOV-8131**: Added `acl_dict_index` setting. This should be used with SQL/CQL based dict to more efficiently update ACL maps. Without it the whole table is iterated whenever updating a user's ACL mapping. #### Fixed Issues - **DOV-5767**: "-o" command line parameter expanded %variables for aliased settings. Mainly this meant "-o mail=..." expanded %variables, while "-o mail_location=..." didn't. - **DOV-5892**: Login processes ignored protocol-specific settings (e.g. imap_capability) specified inside `local_name` sections. - **DOV-5893**: `local_name { ... }` config filter couldn't be used for any post-login settings. - **DOV-6991**: If backend was removed, users could no longer login. Instead, Lua exception would be raised. - **DOV-7307**: fs-[aws-]s3: Do not automatically follow HTTP redirects. This is supposed to help discover misconfiguration. To allow redirects set `fs_s3/http_client_auto_redirect=yes`. - **DOV-7384**: Restore the counters for the `imap_logout_format` message when unhibernating. - **DOV-7429**: Azure FS driver was leaking memory. v3.0.1 regression. - **DOV-7436**: `auth_failure_delay` setting still affected auth requests that failed with internal failure, as well as the `auth_internal_failure_delay` setting. - **DOV-7440**: Submission: Pipelining AUTH with initial SASL response could have caused a hang. - **DOV-7480**: Wildcards didn't work in `local_name *.example.com { ... }`. v3.0 regression. - **DOV-7496**: OpenSSL 3 lib-dcrypt can cause SSL connection failure. - **DOV-7593**: Certain patterns would cause sieve to crash with Panic. - _Fixes_: Panic: file bits.c: line 17 (nearest_power): assertion failed: (num <= ((size_t)1 << (CHAR_BIT\*sizeof(size_t) - 1))) - _Fixes_: Panic: file mempool.c: line 16 (pool_get_exp_grown_size): assertion failed: (old_size < min_size) - **DOV-7675**: Using "\$SET:setting_key" as a setting value didn't work correctly inside setting filters. - **DOV-7763**: Sieve editheader handling may have crashed. - _Fixes_: Panic: file istream.c: line 358 (i_stream_read_memarea): assertion failed: (!stream->blocking) - **DOV-7768**: LMTP proxy client can crash during connection loss at DATA stage when more than a single RCPT command was accepted earlier. - **DOV-7784**: Login processes may have crashed in some situations. - _Fixes_: Panic: epoll_ctl(del, ...) failed: Bad file descriptor - **DOV-7787**: IMAP COMPRESS handling on proxies caused hangs sometimes. For now COMPRESS on proxies is disabled by default; use `imap_compress_on_proxy=yes` to enable it. (v3.0 regression) - **DOV-7871**: Configuration parsing and doveconf output had various issues when using @groups containing named [list] filters and overriding parts of them explicitly in the config. - **DOV-7873**: @group include in config file may have wrongly overridden a userdb or -o command line parameter settings override. - **DOV-8054**: fs-s3, fs-scality, fs-azure: Bulk deletes may have caused crashes in some situations. - **DOV-8056**: Metacache pull didn't close doveadm connection to source server. - **DOV-8081**: doveadm metacache pull crashed when trying to pull a user with an empty home directory. - **DOV-8089**: doveadm metacache pull didn't update metacache size tracking. - **DOV-8093**: metacache pull may have caused excessive memory usage in doveadm-server. - **DOV-8114**: doveadm metacache pull didn't pull FTS indexes. ### Dovecot Cluster Controller #### New Features - **DOV-8115**: Controller settings `USER_MOVE_START_TIMEOUT_SECS` and `USER_MOVE_FINISH_TIMEOUT_SECS` are now configurable with helm values "controller.userMoves.startTimeout" and "controller.userMoves.finishTimeout" respectively. - **DOV-8149**: New `HOST_FAILURE_FORCE_MOVE_PERCENTAGE_INCREASE_INTERVAL_SECONDS ` setting for cluster controller to control time interval between increases in percentage of users when a Backend is being evacuated in a force-move operation. This value is configurable with Helm value "hostFailure.forceMovePercentageIncreaseInterval" for kubernetes installations. #### Changes - **DOV-7799**: Normalize default geodb keyspace to 'geodb' and default dictmap keyspace to 'mails'. - **DOV-7816**: Cluster controller now gives up offling backends or moving users if 50% of all backends in the site are unhealthy (instead of 75% previously). - **DOV-7902**: Backend names are now unique across all sites. Prometheus scrapes only unique backends (with site suffix in the name). - **DOV-7947**: Cluster Controller's Redis images now switched to bitnamilegacy as a short-term work-around for the changes introduced by bitnami. - **DOV-8033**: JSON logger added automatic task name injection. - **DOV-8142**: func_name in logs are now populated with caller function when necessary. - **DOV-8144**: Default value for setting `HOST_FAILURE_BACKEND_NUM_THRESHOLD` reduced to "0.3". #### Removed Items - **DOV-7780**: There is no product support for connecting to external Prometheus service, so remove configuration that implied this was possible. - **DOV-7812**: There is no product support for connecting to external Redis service, so remove configuration that implied this was possible. #### Improvements - **DOV-7809**: Cleanup stale geodb entries in site_reachability, proxy_dest_stats, user_groups, and backend_stats tables. - **DOV-7810**: Function names are now logged as prefix to the Controller log messages. - **DOV-8020**: Controller now sends the reason for user moves to Backends for better logging. #### Fixed Issues - **DOV-7939**: Correctly handle external Prometheus addresses in controller. ### Kubernetes Deployments #### Changes - **DOV-7712**: Dovecot containers deployed with Kubernetes (currently, Controller ONLY) are now run as a non-root user for stricter security. All Dovecot processes are run as vmail user and root file system is read-only except for few selected paths where processes need write access. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2025-09
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2025-09
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2025-04
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.33, 1.32 ### Cluster Controller [[link,cluster_controller_installation]] ## Tika (for Dovecot FTS) Experimental

Apache Tika Version: 3.1.0.0-full

Registry Path: registry.open-xchange.com/dovecot-pro/apache-tika:3.1.0.0-full

## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.1.0 ``` ### Dovecot Pro Base [dovecot-pro-3.1.0-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.0-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.0-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.0-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1.0-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1.0-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.0-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.0-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.1.0 ``` ### Dovecot Pro Base # dovecot-pro-3.1.0 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.0 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.0 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.0 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.0 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.0 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.1.0 ``` ### Dovecot Pro Base # dovecot-pro-3.1.0 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.0 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.0 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.0 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.0 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.0 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.0 ``` ### Dovecot Pro Base [dovecot-pro-3.1.0-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.0-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.0-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.0-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.0-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.0-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.0 ``` ### Dovecot Pro Base [dovecot-pro-3.1.0-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.0-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1.0-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.0-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.0-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.0-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.0-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.0-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.1.0 ``` ### Dovecot Pro Base # dovecot-pro-3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.0 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.1.0 ``` ### Dovecot Pro Base # dovecot-pro-3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.0 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.0/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.1.1 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2025-11-24
Support End 2026-04-30
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.1.0](https://doc.dovecotpro.com/latest/release_notes/3.x/3.1.0.html)** ::: This is a minor release of the Dovecot Pro v3.1.x branch, which contains a security fix. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. ::: ::: danger Security Information See https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html for full details on the security incident. ::: ### Dovecot #### Fixed Issues - **DOV-8381**: SECURITY: Sending invalid base64 in SASL authentication caused auth process to disconnect the login process. This caused all other concurrent authentications from the login process to be aborted as well. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2025-09
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2025-09
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2025-09
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.33, 1.32 ### Cluster Controller [[link,cluster_controller_installation]] ## Tika (for Dovecot FTS) Experimental

Apache Tika Version: 3.1.0.0-full

Registry Path: registry.open-xchange.com/dovecot-pro/apache-tika:3.1.0.0-full

## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.1.1 ``` ### Dovecot Pro Base [dovecot-pro-3.1.1-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.1-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.1-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.1-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1.1-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1.1-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.1-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.1-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.1.1 ``` ### Dovecot Pro Base # dovecot-pro-3.1.1 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.1 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.1 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.1 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.1 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.1 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.1.1 ``` ### Dovecot Pro Base # dovecot-pro-3.1.1 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.1 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.1 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.1 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.1 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.1 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.1 ``` ### Dovecot Pro Base [dovecot-pro-3.1.1-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.1-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.1-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.1-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.1-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.1-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.1 ``` ### Dovecot Pro Base [dovecot-pro-3.1.1-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.1-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1.1-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.1-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.1-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.1-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.1-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.1-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.1.1 ``` ### Dovecot Pro Base # dovecot-pro-3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.1 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.1.1 ``` ### Dovecot Pro Base # dovecot-pro-3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.1 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.1/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.1.2 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-01-08
Support End 2026-05-31
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.1.1](https://doc.dovecotpro.com/latest/release_notes/3.x/3.1.1.html)** ::: This is a minor release of the Dovecot Pro v3.1.x branch, which contains bug fixes and optimizations. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. * The approximate user count shown in some Dovecot Controller UI views and in `doveadm cluster backend list` is not always updated correctly. A crashed or recovered backend may appear to have more active users than it actually does. ::: ### Dovecot #### Breaking Changes - **DOV-8537**: @fs_defaults=nfs and @fts_fs_defaults=nfs were missing fs metawrap, causing no metadata to be written for objects. Updating the dovecot_config_version adds the metawrap. WARNING: If there are any existing mail or index objects, they will become unreadable, so this fix requires data migration. If metawrap is not used, emails' received timestamps may become permanently lost on index rebuilds. #### Changes - **DOV-8327**: Allow OAUTH2 tokens to be used slightly after their expiration. Added `oauth2_token_expire_grace` setting for this (default 1 minute). #### Improvements - **DOV-8472**: storage-objectid-migrate-mails.sh and storage-objectid-migrate-index.sh scripts allow changing dict name with OBOX_DICT_NAME environment. - **DOV-8498**: imapc can now use the SORT IMAP extension to optimize sorting emails. #### Fixed Issues - **DOV-8206**: Corrupted virtual dovecot.index file may have caused a crash. - _Fixes_: Panic: file virtual-sync.c: line 673 (virtual_sync_mailbox_box_remove): assertion failed: (uidmap[src].real_uid == uid) - **DOV-8283**: imapc could have wrongly written empty header values into dovecot.index.cache, unless `imapc_features=no-fetch-header` was used. - **DOV-8327**: Just-generated OAUTH2 tokens sometimes fail with "Token is issued in future", because time can't be 100% synced. Allow timestamps 1 second into the future. - **DOV-8331**: IMAP "SEARCH MIMEPART FILENAME ENDS" command could have accessed memory outside allocated buffer, resulting in a crash. - **DOV-8410**: obox: azure: SAS based authentication has been appending an extra '/' to all object names in storage. This behaviour can be emulated by setting `fs_azure_add_trailing_slash=yes`. - **DOV-8449**: obox: If fs-auth failed to acquire a valid token, fs-s3 and fs-azure still sent requests which fail with an authentication error. These requests now fail earlier and us the fs-auth provided error. This affects azure SAS based authentication and S3 IAM. - **DOV-8467**: Using fts with sproxyd could have caused "400 Bad Reques"t errors as the `fs_http_url_suffix` setting was defaulting to "`%{user}/fts/`". The default is now changed to "" for sproxyd. - **DOV-8479**: doveadm HTTP server sent large replies inefficiently with too much CPU usage. - **DOV-8485**: "doveadm cluster localdb user status" crashed with users that hadn't been moved yet. - **DOV-8497**: Fixed memory leaks in metacache process. - **DOV-8498**: imapc ignored remote SEARCH command failures. It returned empty results instead. - **DOV-8498**: imapc sent UID STORE commands with uidsets ending with a comma. This wasn't valid IMAP protocol, although it seems many IMAP servers allow it. - **DOV-8499**: Process (ps) titles for imap, pop3, submission, and managesieve immediately after login were "[idling]" instead of containing the actual user that logged in. - **DOV-8500**: obox: Existing IMAP UIDs may become reused if mails are in the middle of being expunged when the backend crashes. This can also result in UIDNEXT value shrinking. - **DOV-8532**: IMAP NOTIFY was not working correctly for non-ASCII mailbox names. Their STATUS notifications were sent to the IMAP client with UTF8 encoding instead of mUTF-7. - **DOV-8551**: obox: Virtual folders may have lost dovecot.index.log from index bundles, which mainly meant opening them again was unnecessarily inefficient due to rebuilds. ### Dovecot Cluster Controller #### New Features - **DOV-8408**: Controller has new settings to select log level and the formatter (switching between structured and unstructured logging). #### Improvements - **DOT-2489**: Enhanced Docker Compose deployment with POSIX shell compatibility. The Dockerfile and related bootstrap scripts have been updated to use standard POSIX sh syntax instead of bash-specific features, improving portability and reliability across different environments. This change ensures consistent behavior in minimal container setups and reduces dependencies on bash-specific functionality. - **DOV-8587**: Improved controller helm chart security defaults. #### Fixed Issues - **DOV-8536**: Allow EVALSHA and SCRIPT commands because celery in the end wants these. - **DOV-8566**: Controller's load balancing algorithm was choosing backends that shouldn't have been chosen, e.g. because the backend was offline. - **DOV-8567**: User move could have gotten into a loop in an offline backend, trying to move users out repeatedly. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-01
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-01
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-01
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.34, 1.33 ### Cluster Controller [[link,cluster_controller_installation]] ## Tika (for Dovecot FTS) Experimental

Apache Tika Version: 3.1.0.0-full

Registry Path: registry.open-xchange.com/dovecot-pro/apache-tika:3.1.0.0-full

## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.1.2 ``` ### Dovecot Pro Base [dovecot-pro-3.1.2-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.2-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.2-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.2-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1.2-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1.2-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.2-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.2-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.1.2 ``` ### Dovecot Pro Base # dovecot-pro-3.1.2 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.2 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.2 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.2 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.2 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.2 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.1.2 ``` ### Dovecot Pro Base # dovecot-pro-3.1.2 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.2 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.2 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.2 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.2 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.2 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.2 ``` ### Dovecot Pro Base [dovecot-pro-3.1.2-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.2-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.2-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.2-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.2-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.2-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.2 ``` ### Dovecot Pro Base [dovecot-pro-3.1.2-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.2-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1.2-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.2-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.2-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.2-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.2-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.2-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.1.2 ``` ### Dovecot Pro Base # dovecot-pro-3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.2 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.1.2 ``` ### Dovecot Pro Base # dovecot-pro-3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.2 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.2/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.1.3 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-02-10
Support End 2026-06-30
Current Support Status NOT Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.1.2](https://doc.dovecotpro.com/latest/release_notes/3.x/3.1.2.html)** ::: This is a minor release of the Dovecot Pro v3.1.x branch, which contains security fixes. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. * The approximate user count shown in some Dovecot Controller UI views and in `doveadm cluster backend list` is not always updated correctly. A crashed or recovered backend may appear to have more active users than it actually does. ::: ::: danger Security Information See https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html for full details on the security incident. ::: ### Dovecot #### Changes - **DOV-8615**: SECURITY: Removed (insecure) decode2text.sh FTS attachment parser script. #### Fixed Issues - **DOV-8611**: SECURITY: ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response parameter. - **DOV-8632**: BLF-CRYPT could potentially leak through execution timing due to use of strcmp() rather than mem_equals_timing_safe() - **DOV-8633**: URLFETCH ignored the "user+" access identifier in the URL. This allowed any user with valid credentials to access the mail as long as they had somehow acquired the (secret) URL. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-01
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-01
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-01
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.34, 1.33 ### Cluster Controller [[link,cluster_controller_installation]] ## Tika (for Dovecot FTS) Experimental

Apache Tika Version: 3.1.0.0-full

Registry Path: registry.open-xchange.com/dovecot-pro/apache-tika:3.1.0.0-full

## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.1.3 ``` ### Dovecot Pro Base [dovecot-pro-3.1.3-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.3-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.3-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.3-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1.3-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1.3-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.3-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.3-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.1.3 ``` ### Dovecot Pro Base # dovecot-pro-3.1.3 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.3 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.3 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.3 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.3 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.3 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.1.3 ``` ### Dovecot Pro Base # dovecot-pro-3.1.3 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.3 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.3 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.3 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.3 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.3 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.3 ``` ### Dovecot Pro Base [dovecot-pro-3.1.3-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.3-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.3-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.3-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.3-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.3-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.3 ``` ### Dovecot Pro Base [dovecot-pro-3.1.3-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.3-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1.3-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.3-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.3-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.3-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.3-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.3-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.1.3 ``` ### Dovecot Pro Base # dovecot-pro-3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.3 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.1.3 ``` ### Dovecot Pro Base # dovecot-pro-3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.3 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.3/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.1.4 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-03-13
Support End 2026-08-31
Current Support Status Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.1.3](https://doc.dovecotpro.com/latest/release_notes/3.x/3.1.3.html)** ::: This is a minor release of the Dovecot Pro v3.1.x branch, which contains security fixes. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. * The approximate user count shown in some Dovecot Controller UI views and in `doveadm cluster backend list` is not always updated correctly. A crashed or recovered backend may appear to have more active users than it actually does. ::: ::: danger Security Information See https://documentation.open-xchange.com/dovecot/security/advisories/html/2026/oxdc-adv-2026-0001.html for full details on the security incident. ::: ### Dovecot #### Breaking Changes - **DOV-8804**: Variables in `ldap_base` are also now escaped by default, which can break some setups. Added `|safe` variable filter to disable escaping for safe variables. For example if `ldap_base` is set from a DN coming from a previous passdb lookup, use `%{passdb:classOfServiceDN | safe}`. #### Fixed Issues - **DOV-8647**: obox: azure: Objects that are chunked to be sent to Azure Blob Storage (Put Block List) are now correctly using the SAS-Token for authentication to storage. - **DOV-8803**: A large number of MIME header parameters caused excessive CPU usage. - **DOV-8804**: Passdb/userdb LDAP filters or DNs weren't escaped. If the default `auth_username_chars` was changed to allow characters that had to be escaped, this could have lead to ability to iterate which users exist on the system, and possibly bypass some of the LDAP filter checks. v3.1 regression. - **DOV-8805**: Passdb/userdb SQL queries weren't escaped. If the default `auth_username_chars` was changed to allow characters that had to be escaped, this could have lead to ability to log in as another user. v3.1 regression. - **DOV-8824**: imap-login process can be made to use excessive amount of memory by sending many '(' (open list) characters in the IMAP commands. Prevent this by limiting to just one '(' character per IMAP command in the imap-login process. For post-login imap process there is no explicit limit for this, since there are many other ways to grow memory usage. - **DOV-8827**: managesieve-login process could be easily crashed by sending an AUTHENTICATE command with an excessively large initial response parameter size. This would end up trying to allocate all the memory, leading to reaching process's `vsz_limit`. - **DOV-8830**: Doveadm HTTP and TCP client did not use timing safe credentials comparison, enabling attacker to do timing based attack to determine credentials. - **DOV-8835**: Doveadm HTTP and TCP client did not use timing safe credentials comparison, enabling attacker to do timing based attack to determine credentials. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-03
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-03
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-03
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.34, 1.33 ### Cluster Controller [[link,cluster_controller_installation]] ## Tika (for Dovecot FTS) Experimental

Apache Tika Version: 3.1.0.0-full

Registry Path: registry.open-xchange.com/dovecot-pro/apache-tika:3.1.0.0-full

## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.1.4 ``` ### Dovecot Pro Base [dovecot-pro-3.1.4-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.4-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.4-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.4-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1.4-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1.4-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.4-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.4-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.1.4 ``` ### Dovecot Pro Base # dovecot-pro-3.1.4 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.4 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.4 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.4 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.4 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.4 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.1.4 ``` ### Dovecot Pro Base # dovecot-pro-3.1.4 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.4 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.4 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.4 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.4 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.4 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.4 ``` ### Dovecot Pro Base [dovecot-pro-3.1.4-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.4-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.4-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.4-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.4-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.4-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.4 ``` ### Dovecot Pro Base [dovecot-pro-3.1.4-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.4-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1.4-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.4-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.4-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.4-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.4-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.4-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.1.4 ``` ### Dovecot Pro Base # dovecot-pro-3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.4 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.1.4 ``` ### Dovecot Pro Base # dovecot-pro-3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.4 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.4/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.1.5 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-05-12
Support End 2026-10-31
Current Support Status Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.1.4](https://doc.dovecotpro.com/latest/release_notes/3.x/3.1.4.html)** ::: This is a minor release of the Dovecot Pro v3.1.x branch, which contains security fixes, bug fixes, and optimizations. ::: danger SECURITY ISSUES This release includes fixes for vulnerabilities that have already been publicly disclosed. Because these issues are already public, they are being addressed in this regular minor release rather than through Dovecot Pro's usual security release process with coordinated CVE disclosure. ::: ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. * The approximate user count shown in some Dovecot Controller UI views and in `doveadm cluster backend list` is not always updated correctly. A crashed or recovered backend may appear to have more active users than it actually does. ::: ### Dovecot #### Security - **DOV-9216**: imapc allows IMAP command injection by using LF characters in SEARCH KEYWORDs. - **DOV-9217**: Sieve ":contains" and ":matches" operators could have been using excessive amount of CPU. Limit the CPU to `sieve_max_cpu_time`. - **DOV-9218**: IMAP SETACL command could be used with identifiers containing LF characters to introduce "anyone" entry, which allowed bypassing `imap_acl_allow_anyone` setting. - **DOV-9219**: imap-login process can be made to use excessive amount of memory by sending many '(' (open list) characters in the IMAP commands. Prevent this by limiting to just one '(' character per IMAP command in the imap-login process. For post-login imap process there is no explicit limit for this, since there are many other ways to grow memory usage. This is a second fix for this issue - the original fix was accidentally not working. - **DOV-9221**: SCRAM-SHA-\*-PLUS channel binding could be faked. MITM attacker with a certificate trusted by the client could have bypassed the requirement for channel binding. #### Changes - **DOV-8756**: Use [[setting,mail_access_groups,$SET:default_internal_group]] by default, and remove `service { extra_groups }` that did the same. - **DOV-9004**: Set indexer-worker's [[setting,service_restart_request_count]] to 1000 by default. Previously it was unset, which used the global default (unlimited). - **DOV-9007**: Drop privileges before executing local scripts via [[plugin,sieve-extprograms]] or [[setting,execute_driver,fork]]. - **DOV-9016**: Mail autoexpunging is no longer performed when Dovecot is shutting down or settings are reloaded. This was causing unnecessary load spikes. #### Improvements - **DOV-8649**: Changed [[doveadm,auth cache flush]] user parameters to user-mask parameters, which accept "\*" and "?" wildcards. - **DOV-8739**: Added `%{token}` variable for [[setting,oauth2_fields]]. This allows to configure proxy forwarding with oauth2 tokens. - **DOV-8746**: imapc: Optimize SEARCH MIMEPART if remote server support SEARCH=X-MIMEPART extension. - **DOV-8757**: Added [[setting,fs_fscache_log_path]], which can be used to specify fscache.log to be located outside the fscache partition. This prevents fscache from leaking files if it runs out of disk space, making the situation worse. #### Fixed Issues - **DOV-8570**: When virtual mailbox was configured to use metadata filters, the mailbox opening failed if there were any "\Nonexistent" mailboxes matching the mailbox name filter. For example with obox when creating "parent/child" mailbox, the parent mailbox is "\Nonexistent". - **DOV-8649**: doveadm-server: authCacheFlush HTTP API call crashed. - **DOV-8737**: If metacache was too small, mailbox creation or opening might have failed with an internal error if it was being cleaned at the same time by another process. - **DOV-8738**: obox: Fixed a deadlock. This was visible as a locking timeout on either .state file or dovecot.index.list.log file. - **DOV-8740**: [[plugin,trash]] would cause a signal 11 crash if a `mailbox { ... }` was configured without a [[setting,trash_priority]] setting. - **DOV-8741**: Headers with malicious content were only flagged as warning rather than blocked from being added. - **DOV-8743**: Submission: Login proxy can crash at the AUTH command when the backend cannot connect to the SMTP relay. - **DOV-8744**: Pigeonhole: Delivery fails with spurious error when personal script storage is not configured, not found by auto-detection, and the default storage is configured as a directory. - **DOV-8745**: dovecot-lda should exit with temporary failure (75) if config reading fails. v3.0 regression. - **DOV-8748**: submission-login may have crashed if it was disconnected from auth process. - _Fixes_: Panic: file sasl-server.c: line 524 (sasl_server_auth_begin): assertion failed: (auth_client_is_connected(auth_client)) - **DOV-8749**: Configuration silently ignored when a regular setting was attempted to be used as a section name, e.g. `mail_driver { ... }`. - **DOV-8750**: [[setting,passdb_ldap_bind_userdn]] didn't work correctly with auth caching, unless `%{user}` was also specified in [[setting,passdb_ldap_filter]] or [[setting,ldap_base]]. - **DOV-8751**: If shared INBOX folder was accessed without uppercasing (e.g. "Inbox") it wasn't handled correctly, causing, e.g., wrong imapc cache directory to be used. - **DOV-8753**: Dovecot master process wasn't creating child processes as fast as it could have, possibly resulting in various errors when users were logging in too fast. - **DOV-8758**: Pigeonhole: Including a global Sieve script from a storage that lacks access permissions causes the interpreter to crash. - **DOV-8759**: Pigeonhole: Script before/after sequences can terminate delivery with a temporary failure if a script is not found. - **DOV-8761**: Pipelining IMAP IDLE+DONE+COPY commands crashes. - _Fixes_: Panic: file cmd-copy.c: line 51 (fetch_and_copy): assertion failed: (o_stream_is_corked(client->output) || client->output->stream_errno != 0) - **DOV-8789**: Using missing field with "oauth2:<value>" provider would cause a crash. - **DOV-8793**: [[doveadm,cluster backend add,--self]] always failed. - **DOV-8923**: cluster-backend-test failed if dovecot.conf contained relative `!include` paths. - **DOV-8925**: obox with fs-posix didn't work with [[setting,lazy_expunge_only_last_instance,yes]]. - **DOV-8926**: HTTP server component allows a client to specify both a Content-Length and a Transfer-Encoding header. Currently, it silently ignores (and removes) the Content-Length header, rather than failing the request with an error, thereby theoretically facilitating request smuggling in a reverse proxying scenario. - **DOV-8927**: Configuration errors weren't delayed as they should have been in some situations. For example, if dovecot-lda was run as non-root, it failed if it couldn't read [[setting,ssl_server_key_file]]. - **DOV-8928**: doveadm mail commands did not work with dictionaries needing user-specific variables, like `%{home}`. - **DOV-8930**: Personal Sieve script storage with no configuration for [[setting,sieve_script_active_path]] causes a panic. This can also surface for other script storage types when the administrator forgets to configure the type, causing the storage to default to a personal storage. - **DOV-8937**: Various bugs in Sieve ":matches" operator can cause crashes or wrong behavior. - **DOV-8939**: ManageSieve logins with Palomar enabled resulted in errors. - _Fixes_: cluster: Error: ...: Request ID 56273 (session ...) timed out in 527 seconds - **DOV-9006**: Using "safe" filter would incorrectly taint all subsequent pipelines as safe too. - **DOV-9010**: obox+NFS: When index directories were separate from mail directories, deleting a folder didn't delete the folder index directory. Also user root directories weren't deleted with [[doveadm,obox user delete]]. - **DOV-9011**: POP3 DELE command leaked memory after RSET. - **DOV-9012**: Doing full text search in a virtual folder might cause a crash. - _Fixes_: Panic: file virtual-search.c: line 192: unreached - **DOV-9013**: Add back default http client settings for the OX push-notification driver. v3.1.0 regression. - **DOV-9015**: Partial (multi-byte) character at the end of a MIME part was leaked into beginning of the next MIME part. This could have resulted in broken decoding, or possibly a crash. - _Fixed_: Panic: file message-decoder.c: line 232 (translation_buf_decode): assertion failed: (orig_size < CHARSET_MAX_PENDING_BUF_SIZE) - **DOV-9017**: imap-hibernate process segfaults if fd_send() call fails in client unhibernation. - **DOV-9023**: Using [[doveadm,acl remove]] didn't fully remove the user identifier from ACLs. It just left it as having no rights. - **DOV-9024**: obox: metacache pull: When storage is initialized before metacache is pulled and the list index is attempted to be rebuilt, it failed because force-resync could not happen during merging of the root bundle. - **DOV-9068**: When using Cassandra with SSL, and there was a 30 second pause between Cassandra accesses, the dict process created new Cassandra connections and leaked the old ones. - **DOV-9097**: dict process may have crashed at deinit when Cassandra was used with SSL. - **DOV-9113**: Login processes sometimes crashed when handling SSL connections. - {_}Fixes{_}: Panic: file iostream.c: line 28 (iostream_fd_unref): assertion failed: (ref->refcount > 0) - **DOV-9143**: Fix imap process panic. - _Fixes_: Panic: file imap-client.c: line 1123 (client_check_command_hangs): assertion failed: ((io_loop_find_fd_conditions(current_ioloop, client->fd_out) & IO_WRITE) != 0) - **DOV-9222**: Normally auth cache automatically handles when a password is changed by ignoring the cache if the previous login with the cached password was successful. When using `auth_cache_verify_password_with_worker=yes` this check didn't happen, causing login failures with password changes. - **DOV-9229**: `proxy_session_failure` default metric wasn't correctly filtering out connections reaching `mail_max_userip_connections`. This could have resulted in wrong load balancing or health decisions by Cluster Controller. ### Dovecot Cluster Controller #### New Features - **DOV-8934**: Add `global.cassandra.port` helm value to configure the external Cassandra port. #### Fixed Issues - **DOV-8755**: Correctly register the site load balancer during controller bootstrap in Docker Compose deployment when `CLUSTER_SITE_LOAD_BALANCER` is set. - **DOV-9150**: Re-enable Redis EVALSHA and SCRIPT commands, as they are needed by internal Controller services. ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-05
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-05
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-05
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.35, 1.34 ### Cluster Controller [[link,cluster_controller_installation]] ## Tika (for Dovecot FTS) Experimental

Apache Tika Version: 3.1.0.0-full

Registry Path: registry.open-xchange.com/dovecot-pro/apache-tika:3.1.0.0-full

## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.1.5 ``` ### Dovecot Pro Base [dovecot-pro-3.1.5-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.5-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.5-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.5-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1.5-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1.5-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.5-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.5-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.1.5 ``` ### Dovecot Pro Base # dovecot-pro-3.1.5 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.5 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.5 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.5 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.5 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.5 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.1.5 ``` ### Dovecot Pro Base # dovecot-pro-3.1.5 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.5 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.5 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.5 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.5 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.5 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.5 ``` ### Dovecot Pro Base [dovecot-pro-3.1.5-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.5-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.5-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.5-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.5-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.5-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.5 ``` ### Dovecot Pro Base [dovecot-pro-3.1.5-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.5-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1.5-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.5-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.5-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.5-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.5-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.5-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.1.5 ``` ### Dovecot Pro Base # dovecot-pro-3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.5 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.1.5 ``` ### Dovecot Pro Base # dovecot-pro-3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.5 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.5/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro 3.1.6 Permalink to Release Documentation
Upgrading Information:
## Status
First Customer Shipment 2026-07-23
Support End TBD
Current Support Status Supported
## Release Notes ::: info Previous Version **[Dovecot Pro v3.1.5](https://doc.dovecotpro.com/latest/release_notes/3.x/3.1.5.html)** ::: This is a minor release of the Dovecot Pro v3.1.x branch, which contains security fixes and bug fixes. ::: warning Known Issues * Deploying [[link,cluster_controller,Dovecot Pro Palomar Controller]] with docker-compose is experimental. * The approximate user count shown in some Dovecot Controller UI views and in `doveadm cluster backend list` is not always updated correctly. A crashed or recovered backend may appear to have more active users than it actually does. ::: ::: danger Security Embargo The changelog and details of the security fix will be disclosed following the public announcement. ::: ## Lua Support These versions of [Lua](https://www.lua.org) are supported: * [Lua 5.3](https://www.lua.org/manual/5.3/) ## Cassandra Support These versions of Cassandra are supported: * Apache Cassandra 4.0.17 ## Obox Testing ### AWS S3
Testing Date 2026-05
Testing Region(s) eu-central-1
API Version(s) Tested 2006-03-01
API Documentation (at time of testing) https://docs.aws.amazon.com/AmazonS3/latest/API/Welcome.html
### Azure Blob
Testing Date 2026-05
Testing Region(s) northeurope
API Version(s) Tested 2023-08-03
API Documentation (at time of testing) https://learn.microsoft.com/en-us/rest/api/storageservices/version-2023-08-03
### Scality sproxyd
Testing Date 2026-06
API Version(s) Tested 8.5.8.6
API Documentation (at time of testing) https://documentation.scality.com/RING/8.5.8/reference/connectors/sproxyd/index.html
## Kubernetes Components ### Kubernetes Support [[link,kubernetes_support,Supported Kubernetes versions]]: 1.35, 1.34 ### Cluster Controller [[link,cluster_controller_installation]] ## Tika (for Dovecot FTS) Experimental

Apache Tika Version: 3.1.0.0-full

Registry Path: registry.open-xchange.com/dovecot-pro/apache-tika:3.1.0.0-full

## Repository Information ### Amazon Linux 2023 ::: details Configuration to stay on 3.1.6 ``` ### Dovecot Pro Base [dovecot-pro-3.1.6-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.6-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.6-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1.6-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1.6-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1.6-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.6-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.6-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Amazon Linux 2023 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Amazon Linux 2023 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Amazon Linux 2023 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_lua-extras] name=Amazon Linux 2023 - Extra Lua libraries baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/lua-extras/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Object Storage plugin [dovecot-pro-3.1-stable-obox] name=Amazon Linux 2023 - Dovecot Pro Object Storage plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search plugin [dovecot-pro-3.1-stable-fts] name=Amazon Linux 2023 - Dovecot Pro Full Text Search plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Amazon Linux 2023 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Amazon Linux 2023 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Amazon Linux 2023 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Amazon Linux 2023 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Amazon Linux 2023 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Amazon Linux 2023 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/AmazonLinux2023 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Debian 11 (Bullseye) ::: details Configuration to stay on 3.1.6 ``` ### Dovecot Pro Base # dovecot-pro-3.1.6 Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.6 Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.6 Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.6 Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.6 Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.6 Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/devtools/fsserver/DebianBullseye ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBullseye ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 11 (Bullseye) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBullseye ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBullseye ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBullseye ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBullseye ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBullseye ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBullseye ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBullseye ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 11 (Bullseye) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBullseye ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 11 (Bullseye) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBullseye ./ ``` ::: ### Debian 12 (Bookworm) ::: details Configuration to stay on 3.1.6 ``` ### Dovecot Pro Base # dovecot-pro-3.1.6 Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.6 Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.6 Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.6 Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.6 Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.6 Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/devtools/fsserver/DebianBookworm ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/DebianBookworm ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Debian 12 (Bookworm) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/DebianBookworm ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/DebianBookworm ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/DebianBookworm ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/DebianBookworm ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/DebianBookworm ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/DebianBookworm ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/DebianBookworm ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Debian 12 (Bookworm) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/DebianBookworm ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Debian 12 (Bookworm) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/DebianBookworm ./ ``` ::: ### Red Hat Enterprise Linux 8 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.6 ``` ### Dovecot Pro Base [dovecot-pro-3.1.6-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.6-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.6-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.6-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.6-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.6-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 8 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 8 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 8 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 8 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 8 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL8 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Red Hat Enterprise Linux 9 ::: warning Requires EPEL/CRB This distribution assumes **[EPEL](https://docs.fedoraproject.org/en-US/epel/)** and **[CRB/CodeReady](https://wp.me/p8e0as-2fmr)** are enabled. ::: ::: details Configuration to stay on 3.1.6 ``` ### Dovecot Pro Base [dovecot-pro-3.1.6-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1.6-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1.6-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1.6-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1.6-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.6-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1.6-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1.6-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base [dovecot-pro-3.1-stable-base] name=Red Hat Enterprise Linux 9 - Dovecot Pro Mail Server baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Mandatory 3rd Party Libraries [dovecot-pro-3.1-stable-3rdparty_cassandra-cpp-driver] name=Red Hat Enterprise Linux 9 - DataStax C/C++ Driver for Apache Cassandra baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 [dovecot-pro-3.1-stable-3rdparty_libexttextcat] name=Red Hat Enterprise Linux 9 - Exttextcat library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/libexttextcat/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Plugin [dovecot-pro-3.1-stable-obox] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Plugin [dovecot-pro-3.1-stable-fts] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search plug-in baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fts-ja-kuromoji-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-3rdparty_kuromoji] name=Red Hat Enterprise Linux 9 - Atilika Kuromoji Library baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 priority=1 enabled=1 ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access [dovecot-pro-3.1-stable-vault-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Vault plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-sieve-zimbra-compat-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro Sieve Zimbra compatibility plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-imap-proxyauth-plugin] name=Red Hat Enterprise Linux 9 - Dovecot Pro IMAP Proxy Authentication plugin baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access [dovecot-pro-3.1-stable-fsserver] name=Red Hat Enterprise Linux 9 - Dovecot Pro Object Storage Development Tools - fs-server backend baseurl=https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/RHEL9 gpgkey=https://software.open-xchange.com/0xDFD4BCF6-oxbuildkey.pub gpgcheck=1 enabled=1 ``` ::: ### Ubuntu 22.04 LTS (Jammy Jellyfish) ::: details Configuration to stay on 3.1.6 ``` ### Dovecot Pro Base # dovecot-pro-3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.6 Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_22.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_22.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_22.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_22.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_22.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_22.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 22.04 LTS (Jammy Jellyfish) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_22.04 ./ ``` ::: ### Ubuntu 24.04 LTS (Noble Numbat) ::: details Configuration to stay on 3.1.6 ``` ### Dovecot Pro Base # dovecot-pro-3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1.6 Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1.6/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: ::: details Configuration to stay on 3.1-stable ``` ### Dovecot Pro Base # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Mail Server deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/base/Ubuntu_24.04 ./ ### Dovecot Pro Mandatory 3rd Party Libraries # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - DataStax C/C++ Driver for Apache Cassandra deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/cassandra-cpp-driver/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/obox/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Plugin # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Full Text Search plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/fts/Ubuntu_24.04 ./ ### Dovecot Pro Full Text Search Kuromoji Tokenizer for Japanese # fts-ja-kuromoji plugin requires a separate OX License # Please contact support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/fts-ja-kuromoji-plugin/Ubuntu_24.04 ./ # Kuromoji library requires a separate OX License # Please contact to support@open-xchange.com to get access deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/3rdparty/kuromoji/Ubuntu_24.04 ./ ### Dovecot Pro Sieve Zimbra compatibility plugin # sieve-zimbra-compat plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Pigeonhole Sieve Zimbra compatibility plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/pigeonhole-sieve-zimbra-compat-plugin/Ubuntu_24.04 ./ ### Dovecot Pro IMAP Proxy Authentication plugin # imap-proxyauth plugin requires a separate OX License # Please contact support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro IMAP Proxy Authentication plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/imap-proxyauth-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Vault plugin # vault plugin requires a separate OX License # Please contact to support@open-xchange.com to get access # # dovecot-pro-3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Vault plugin deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/plugin/vault-plugin/Ubuntu_24.04 ./ ### Dovecot Pro Object Storage Development Tools - fs-server backend # fs-server requires a separate OX License # Please contact support@open-xchange.com to get access # dovecot-pro- 3.1-stable Ubuntu 24.04 LTS (Noble Numbat) - Dovecot Pro Object Storage Development Tools - fs-server backend deb https://LDBACCOUNT:PASSWORD@software.open-xchange.com/products/dovecot-pro/3.1-stable/devtools/fsserver/Ubuntu_24.04 ./ ``` ::: # Dovecot Pro Release History The Release Notes are the canonical document providing upgrade and installation instructions and detailed changes for any given version. ## Releases ### 3.x #### Visualization A visualization of Dovecot Pro 3.x releases: ### 2.3.x See [https://doc.dovecot.org/2.3/installation_guide/dovecot_pro_releases/](https://doc.dovecot.org/2.3/installation_guide/dovecot_pro_releases/). # Obox: Administration The object storage plugin administration is mainly related to making sure that the mail cache and the index cache perform efficiently and they don't take up all the disk space. ## Service Stop and Restart When the dovecot service is stopped, it flushes all pending changes. The idea is to ensure users are not able to re-login onto backends you want to stop. For this you should propagate changes and kick users repeatedly: * First run [[doveadm,metacache flushall,-i]] to flush all pending important changes. * Since the important changes are usually flushed every 5 minutes, the flushes aren't expected to take excessively long. * Make sure all new imap, pop3, managesieve, submission and lmtp connections are stopped. * Use [[doveadm,kick,'*']] to kick all the existing imap, pop3 and managesieve connections. * LMTP connections can't be kicked. However, they're assumed to finish rather quickly. * Re-run [[doveadm,metacache flushall,-i]] to flush the important changes that might have happened while stopping the connections. * Wait approx. 1 second. * Re-run [[doveadm,kick,'*']] again - just in case there were a few more clients that managed to log in. * Run [[doveadm,metacache flushall,-i"]] one final time. * Run `service dovecot stop` to shut down the dovecot processes. This flushing isn't performed when restarting the service or when doing a package upgrade. There's also `metacache-flush.service` that can be manually stopped if the flushall isn't wanted to be run. ### Simple Upgrade The simplest way to upgrade Dovecot backend is to run `yum upgrade` or `apt-get upgrade` (depending on your distribution you might run another package manager). This causes very little downtime on that server, so most clients can successfully reconnect back to the server after getting disconnected. This method also has the advantage that all the caches are filled up for the users. ::: info Make sure that the backend is still online in the cluster after the update: [[doveadm,cluster backend status]] ::: ### Complex Upgrade Sometimes in-place upgrades aren't wanted. Instead the backends are upgraded by first shutting down the backend, upgrading, and then bringing the server back up. See below for problems related to this. ## Problems with Backend Shutdown * Users are moved to new backends with empty caches. Filling the caches causes temporary object storage I/O spikes. * "Unimportant changes" are changes that can be regenerated in case of a backend crash. This most importantly means data added to `dovecot.index.cache` file. Usually these get flushed while the indexes get flushed for other reasons, for example every 10th new mail delivery. Indexes with only unimportant changes are automatically flushed to object storage only when metacache disk space runs out and metacache process decides to clean up some disk space. It flushes the indexes before deleting them so nothing is lost. However, if there is enough available disk space in metacache this may mean that after shutting down Dovecot there may be a lot of indexes in metacache with unimportant changes. This has two problems: * When user is moved to a new backend, these missing unimportant changes may need to be regenerated. Usually this means reading a maximum of 9 mails per folder ([[setting,obox_max_rescan_mail_count,10]]), but in some rare situations the cache may have just had huge changes. These changes will need to be re-done on the new backend, which may be expensive. * Metacache directories with unimportant changes are left lying around. * Normally this shouldn't actually cause problems, because: * Eventually they may become cleaned up to free up disk space, which normally causes them to be flushed to object storage. However, the flushing isn't performed when another server has already changed the indexes. So an obsolete index bundle won't actually be written to object storage. * When opening an obsolete metacache directory with only unimportant changes, it's not used if there's already a newer index bundle. The obsolete directory just gets deleted. Only if there are important changes it performs dsync-merging. There are some things that can be done to help problems caused by these: * Run [[doveadm,metacache flushall]] every night. This way there won't be highly out-of-date indexes lying around. * Delete really old obsolete indexes from all backends before shutting down backends. Ideally only when the user isn't assigned to the backend before the shutdown - otherwise it could unnecessarily delete indexes for users who simply haven't been accessed for a while but don't have any newer indexes anywhere. * When starting up a backend also delete rather old (e.g. >1 day) indexes from metacache. * Use the `last-access(0)` timestamp in [[doveadm,metacache list]] output to determine the user's last access timestamp. * If the user isn't found from the list at all, then it's definitely an old index that hasn't so far been accessed in this backend since Dovecot was started up. ::: tip You can't currently use [[doveadm,metacache clean]] to delete changed indexes. The only alternative is to just forcibly `rm -rf` the directory. However, if the user happens to be accessed during the `rm -rf` this can cause index corruption, which can have rather bad consequences (like redownloading all mails). This is why it should verify whether this is the user's currently assigned backend, and only `rm -rf` users whose backend is elsewhere. ::: ## Backend Crashes Dovecot doesn't use metacache for users that were accessed before the backend crashed the last time. This is done using `/var/lib/dovecot/reboots` file. When starting up, Dovecot gets `/proc`'s ctime and adds it to the reboots file. At a clean dovecot service shutdown this timestamp is marked to be "clean". Each `.state` file in metacache directories contains the `/proc` ctime when it was last modified. If opening metacache finds that there's been a crash since the last metacache write, the metacache directory is assumed to be corrupted and is deleted. Normally this works as expected and admin doesn't need to worry about this. ## Mail Fscache The mail cache size is specified via the [[setting,fs_fscache_size]] setting and is commonly set to 1-2 GB. The `fs cache` is a [[link,fs_wrappers,fs wrapper]] that can be used to enable caching for the wrapped [[link,fs,fs driver]]. If fscache runs out of disk space, most operations won't return user-visible failures (although errors are still logged). Currently the "mail prefetching" can't transparently handle such failures though, so these errors can result in user-visible failures. If fscache runs out of disk space, it's usually because one of: * `fscache.log` doesn't match the actual disk space usage. Maybe due to a bug, or maybe due to crashes. * Users are accessing/saving too large emails. See [[setting,quota_mail_size]] setting. * Mail files are being kept open for a long time, resulting in already deleted files reserving disk space on the filesystem. For example because a client is downloading a large mail with a slow internet connection. Generally the problem goes away by syncing `fscache.log` with reality by running [[doveadm,fscache rescan]]. This will update the `fscache.log` to contain the correct size. It also prints whether the current size was correct or not. It's possible also to manually delete files from fscache by using the rm command. The [[doveadm,fscache rescan]] command must be run afterwards. Many of our customers are running the [[doveadm,fscache rescan]] command in a cronjob every hour. This makes sure that the fscache won't be wrong for too long. ## Index Metacache The metacache index size is specified in the [[setting,metacache_max_space]] setting. This should ideally be as large as possible to reduce both object storage `GET`s for the indexes and also local filesystem writes when the indexes are unpacked to local cache. Metacache is rarely large enough to contain indexes for all the users in the backend. This is why it also supports priorities, which attempts to keep the most useful information in the metacache longest to reduce the object storage IO. For example, `INBOX` and `\Junk` folders are usually accessed more often than other folders (due to mail deliveries), so they're prioritized higher than other folders. User's root indexes are prioritized the highest, mainly because they're always required whenever a user is accessed, but also because they're small enough that they can be cheaply kept in metacache for a long time. The metacache performance can be monitored by looking at the number of index `GET` and `PUT` requests. Metacache cleans are also logged by metacache-worker. To list all users currently known to be in metacache, run [[doveadm,metacache list]]. There are 4 priorities for index files: | Priority | Description | | -------- | ----------- | | 0 (highest) | User root indexes | | 1 | FTS indexes | | 2 | `INBOX` and `\Junk` folder indexes | | 3 (lowest) | Other folders' indexes | You can also manually clean some older indexes from cache by running [[doveadm,metacache clean,-u user@domain]] If the indexes aren't fully uploaded to the object storage, the clean command will fail. You can manually upload indexes to object storage with: ```sh doveadm metacache flush -u user@domain doveadm metacache flushall ``` It's also possible to flush only indexes with specified priority (and below) with the `-p` parameter. If a user no longer actually exists on filesystem, it can be removed from metacache process with [[doveadm,metacache remove,user@domain]]. This command also supports wildcards, so you can remove e.g. `testuser*` or even `*` for everyone. If multiple backends do changes to the same mailbox at the same time, Dovecot will eventually perform a dsync-merge for the indexes. Due to dsync being quite a complicated algorithm, there's a chance that the merging may trigger a bug/crash that won't fix itself automatically. If this happens, the bug should be reported to get it properly fixed, but a quick workaround is to run: ```sh doveadm -o metacache_index_merging=none force-resync -u user@domain INBOX ``` ::: tip To allow easier migration of users and to support the new needs brought up with Palomar, the [[doveadm,metacache pull]] command has been implemented. This command allows to pull the metacache for specific users(s) from another backend. ```sh doveadm metacache pull -u user@domain --latest-only --clean 10.0.0.5 ``` ::: ## Restarting obox backend with minimal user impact This procedure is generic procedure to perform backend maintenance with minimal user impact. ::: tip The best way to avoid any user impact is to avoid having to use this procedure in the first place: * Upgrading can be done with installing new Dovecot packages. * Configuration changes can be done by modifying the config file and running `doveadm reload`. If there are configuration mistakes, the reload will fail and preserve the original configuration. Although this only happens for syntax mistakes and other mistakes that can [[man,doveconf]] can catch - not mistakes that are detected only at runtime. ::: ### Shutting Down Backend See [[link,palomar_backend_evacuate]] for different options how to evacuate a backend. ### Starting Up Backend 1. Synchronize metacache Metacache database may not be fully synchronized with the index files that actually exist on filesystem. It's recommended at this stage to either delete the metacache or rescan it. * Rescan metacache: [[doveadm,metacache rescan]] * Delete metacache: 1. Remove old metacache database files. As metacache service is now reduced to one file the old files need to be removed. ```sh rm -f /var/lib/dovecot/metacache/metacache-users* ``` 2. Remove metacache from filesystem: ```sh rm -rf /var/dovecot/vmail/* ``` 2. Restart dovecot. ```sh systemctl start dovecot ``` 3. Verify with test user that the backend is usable. ```sh # Fetches mailbox list from metacache. # This is fetched from storage now as metacache is reset. doveadm mailbox list -u # Fetches more info from metacache doveadm mailbox status -u messages "*" # Verifies Dovecot can fetch mail objects from storage doveadm fetch -u text all > /dev/null ``` 4. If all of the above commands succeed, the backend can be put back to production. 5. Add the backend to the cluster (making sure the load factor is restored): [[doveadm,cluster backend update,--load-factor 100 --status online <backend host>]] ## Delete User Mailbox After an end user has ended their contract with the service provider providing mailbox service, the mail data needs to be removed from not only the (object) storage but also from Cassandra and cached information also needs to be removed from the serving backend. 1. Before the actual doveadm commands the user should be disabled in the userdb (e.g. LDAP) to disallow IMAP/POP/LMTP connections but not be removed from the userdb; if user doesn't exist in the userdb, doveadm commands for that user will fail. 2. After the user is disabled their existing connections should be closed. This is most easily done in the proxy, which forwards the kick command to the user's current backend. This can also be managed by a provisioning system issuing a [[link,doveadm_http_api]] call. [[doveadm,cluster kick,john@example.com]] 3. Delete the user from the storage running the [[doveadm,obox user delete]] command in the proxy (or via the provisioning system that needs to issue [[link,doveadm_http_api]] calls to proxy): [[doveadm,obox user delete,-u john@example.com]] This command removes: * All mail data in object storage (mails, index bundles, FTS indexes), * all fs-dictmap data in Cassandra, and * user's metacache in the user's currently active backend (same backend as where the user was kicked in step 2). Note that this command does NOT remove: * User's objects from fscaches (which is usually rather short-lived, so it doesn't take long for the objects to drop out of the cache anyway). * User's metacache in backends where the user was accessed earlier, but which wasn't cleaned. These metacaches should become cleaned when disk space pressure pushes them out. * Any other dict data that is not deleted automatically while folders or mails are deleted (e.g. [[link,quota_clone]] plugin, [[link,last_login]] plugin). 4. After the user's data is deleted the user can be removed from userdb. Whether or not that is wanted right away depends on the policy and the provisioning system, whether the provisioning system can keep that email address reserved for typical 6 months before it's assigned to another user or if the userdb needs to keep that information for that period of time. ## Troubleshooting ### Storage Workarounds These settings may be useful if some emails are inaccessible. * Issue: An email is inaccessible during a FETCH. * Workaround: Finish the FETCH as well as possible and return a tagged NO reply. The default is to disconnect the IMAP client immediately on the failure. It depends on the IMAP client whether this behavior is useful or not. * Setting: [[setting,imap_fetch_failure,no-after]] * Issue: How to handle Cassandra: `Object exists in dict, but not in storage` errors. * Workaround: Return empty emails to the IMAP client. The tagged FETCH response will be `OK` instead of `NO`. * Setting: [[setting,obox_fetch_lost_mails_as_empty,yes]] ```doveconf[dovecot.conf] remote { obox_fetch_lost_mails_as_empty = yes } ``` # Cassandra (and Dovecot Pro) [Cassandra](https://cassandra.apache.org/) is an open source NoSQL distributed database that offers scalability and high availability without compromising performance. Cassandra is an important component of Dovecot Pro, required for obox and Palomar and optionally used for other features (e.g., last login). This page contains suggestions and recommendations on how to configure and operate Cassandra in your installation. ::: warning Documentation on this page is for informational purposes only. These are not requirements, and Open-Xchange/Dovecot cannot provide direct Cassandra support. For specific assistance with a local Cassandra installation, consultation with a Cassandra expert is recommended. ::: ## Dovecot Pro Cassandra Administration Pre-install deployment checklist: 1. Turn off swap on every Cassandra node. 2. Open Cassandra ports in firewall. 3. Configure system limits. 4. Implement Network Time Protocol (NTP) daemon. 5. Install latest Java JVM with G1 garbage collector. 6. Implement the Dovecot Pro dictmap fs driver on every Dovecot backend server. This is a requirement for Dovecot Pro, as it is necessary for obox operation. ### Cassandra Repair Apache Cassandra is a distributed database with tunable consistency. The normal Dovecot configuration implements `quorum` consistency. Quorum provides strong consistency with failure toleration. With a replication factor of 3, `quorum` is $2 * ({ sum\_of\_replication \over 2 } + 1)$. This means it is entirely possible for the data to be inconsistent on one node. Cassandra `nodetool repair` is the AntEntropy service that uses Merkle trees to detect and repair inconsistencies in data between replicas. Another important element is `gc_grace_seconds` (`10 days` by default) which is the tombstone time to live marker. If a node is missing the tombstone after the `gc_grace_seconds` period, the deleted data will be resurrected. In the Dovecot Pro log file, if you start seeing `Object exists in dict, but not in storage` errors, then you most likely have resurrected deleted data. Resurrected deleted data will have to be manually deleted. See [[link,obox_troubleshooting_object_exists_in_dict_but_not_in_storage]]. ::: tip To prevent Cassandra data resurrection, you must regularly run `nodetool repair` within `gc_grace_seconds` via cron for the entire cluster. ::: ### Reducing Tombstones Dovecot attempts to prevent creating too many tombstones within the same cluster key. Sometimes it may not have worked properly though, and Cassandra queries start failing (timing out) towards a specific cluster key due to too many tombstones. This can be repaired by getting rid of the tombstones: * Run Cassandra repair to make sure all tombstones are replicated. * Change `gc_grace_seconds` to a smaller value that includes the tombstones (e.g. 1 day). * Run Cassandra compact. * Change `gc_grace_seconds` back to the original value (10 days). Other potential changes that may help: * Enable [[setting,cassandra_page_size,1000]] so large results would be paged into multiple queries. * Increase Cassandra's request timeout. * Increase Cassandra's `tombstone_failure_threshold`. ### Replication Factor #### NetworkTopologyStrategy For multiple data centers, the replication NetworkTopologyStrategy is recommended for production environments. When the `mails` keyspace is created, set replication to NetworkTopologyStrategy. This example sets replication factor to 3 in each data center: ``` CREATE KEYSPACE 'mails' IF NOT EXIST WITH REPLICATION = { 'class' : 'NetworkTopologyStrategy', 'dc1_name' : 3, 'dc2_name' : 3 } ``` #### GossipingPropertyFileSnitch ::: tip Every node will only define itself. ::: A snitch determines which data centers and racks nodes belong to. The replication (in this case NetworkTopologyStrategy) places the replicas based on snitch information. The GossipingPropertyFileSnitch uses Cassandra's gossip protocol to automatically update snitch information when adding new nodes. This is the recommended snitch for production. Configure GossipingPropertyFileSnitch on each node with only localhost information. Cassandra discovers all the nodes in the ring via Gossip protocol on start up. This configuration is set in `cassandra-rackdc.properties`. Examples: ::: code-group ```[Node1, dc1_name] DC=dc1_name RAC=rack1 ``` ```[Node 2, dc1_name] DC=dc1_name RAC=rack2 ``` ```[Node 1, dc2_name] DC=dc2_name RAC=rack1 ``` ::: ### Endpoint Snitch Modify the `cassandra.yaml` file and change "endpoint_snitch" to use "GossipingPropertyFileSnitch". ``` endpoint_snitch: GossipingPropertyFileSnitch ``` ## Cassandra Configuration ### Cassandra Server layout Cassandra nodes should have at least 2 disk and 2 network interfaces. One disk is for the commit log which should be fast enough to receive all writes as sequential I/O. The size of the commit log is controlled by "commit log_total_space_in_mb" setting in cassandra.yaml file. The other disk is for data which should be fast enough to satisfy both read and write I/O. The recommendation is to limit space utilization to more than 50% of the total disk size for repair and compaction operations. ### File System Layout Ideally there is a separate set of mirrored OS disk and a separate disk for the Cassandra commit log. If you are sharing the OS disk with Cassandra commit log, use the following paths: ``` /var/lib/cassandra/commitlog /var/lib/cassandra/saved_caches /var/lib/cassandra/hints_directory ``` If you have a dedicated disk for Cassandra commit log, you should create a mount point named `/var/lib/cassandra` and use the path names above. The Cassandra data disk should be a dedicated SSD drive. You should create the mount point `/var/lib/cassandra/data`. ::: tip Cassandra configuration files are normally located in `/etc/cassandra` and logs are located in `/var/log/cassandra`. ::: The path names above are the default values in the ``cassandra.yaml`` file. ``` # Directory where Cassandra should store hints. # If not set, the default directory is $CASSANDRA_HOME/data/hints. hints_directory: /var/lib/cassandra/hints # Directories where Cassandra should store data on disk. Cassandra # will spread data evenly across them, subject to the granularity of # the configured compaction strategy. # If not set, the default directory is $CASSANDRA_HOME/data/data. data_file_directories: - /var/lib/cassandra/data # commit log. when running on magnetic HDD, this should be a # separate spindle than the data directories. # If not set, the default directory is $CASSANDRA_HOME/data/commitlog. commitlog_directory: /var/lib/cassandra/commitlog # saved caches # If not set, the default directory is $CASSANDRA_HOME/data/saved_caches. saved_caches_directory: /var/lib/cassandra/saved_caches ``` ### Network Cassandra gives you the ability to segregate inter-node from client traffic. Most deployments go with a single IP address for both Cassandra inter-node and client communication. In Cassandra the `listen_address: / listen_interface:` are used for inter-node cluster communication. Cassandra replication, repair, gossip, and compaction can generate significant traffic from time to time. Isolating cluster traffic onto its own IP address range (cluster vlan), if possible, can improve network performance / reduce network latency within the Cassandra cluster. In the case of multi-site, you may need a vlan over wan solution. The Cassandra `rpc_address: / rpc_interface:` are for client communication. This would be the IP address (client access vlan) that Dovecot backends would be configured to use. ### Ports Inter-node (default) ports: | Port | Service | | ---- | ------- | | 7000 | Inter-node | | 7001 | Inter-node (SSL) | | 7199 | JMK | Client (default) ports: | Port | Service | | ---- | ------- | | 9042 | Client Port | | 9160 | Thrift | | 9142 | Native | ### Memory Cassandra runs inside JAVA JVM. The JVM settings are defined in "cassandra-env.sh" (older) or jvm.options file in `/etc/cassandra` configuration directory. The run settings are computed during startup based on system resources. Recommendation is to use default settings and monitor the system. ### cassandra.yaml Various tips to assist in Cassandra configuration. #### Cluster Name ``` # The name of the cluster. This is mainly used to prevent machines in # one logical cluster from joining another. cluster_name: cluster1 ``` #### Seed Nodes Configure the first and fourth nodes in each data center to be your seed nodes (example IPs only): ``` - seeds: "172.16.0.1,172.16.0.4,172.16.1.1,172.16.1.4" ``` #### Concurrency Configure the following `concurrent_*` values: ``` # For workloads with more data than can fit in memory, Cassandra's # bottleneck will be reads that need to fetch data from # disk. "concurrent_reads" should be set to (16 * number_of_drives) in # order to allow the operations to enqueue low enough in the stack # that the OS and drives can reorder them. Same applies to # "concurrent_counter_writes", since counter writes read the current # values before incrementing and writing them back. # # On the other hand, since writes are almost never IO bound, the ideal # number of "concurrent_writes" is dependent on the number of cores in # your system; (8 * number_of_cores) is a good rule of thumb. concurrent_reads: 32 ← 1 SSD set to 16 concurrent_writes: 32 ← 8 cores set to 64 concurrent_counter_writes: 32 ``` #### Compactors Configure the `concurrent_compactors` values: ``` # concurrent_compactors defaults to the smaller of (number of disks, # number of cores), with a minimum of 2 and a maximum of 8. # # If your data directories are backed by SSD, you should increase this # to the number of cores. concurrent_compactors: 1 ← 8 cores set to 8 ``` #### Compaction Throughput Adjust based on actual sstable monitoring ratios: ``` # Throttles compaction to the given total throughput across the entire # system. The faster you insert data, the faster you need to compact in # order to keep the sstable count down, but in general, setting this to # 16 to 32 times the rate you are inserting data is more than sufficient. # Setting this to 0 disables throttling. Note that this account for all types # of compaction, including validation compaction. compaction_throughput_mb_per_sec: 16 ``` #### Streaming Throughput Adjust based on wan capacity: ``` # Throttles all streaming file transfer between the datacenters, # this setting allows users to throttle inter dc stream throughput in addition # to throttling all network stream traffic as configured with # stream_throughput_outbound_megabits_per_sec # When unset, the default is 200 Mbps or 25 MB/s # inter_dc_stream_throughput_outbound_megabits_per_sec: 200 ``` #### Timeouts Adjust timeouts: ``` read_request_timeout_in_ms: 5000 range_request_timeout_in_ms: 10000 write_request_timeout_in_ms: 2000 counter_write_request_timeout_in_ms: 5000 cas_contention_timeout_in_ms: 1000 truncate_request_timeout_in_ms: 60000 request_timeout_in_ms: 10000 slow_query_log_timeout_in_ms: 500 ``` #### Internode Compression ``` # internode_compression controls whether traffic between nodes is compressed. # Can be: # # all # all traffic is compressed # # dc # traffic between different datacenters is compressed # # none # nothing is compressed. internode_compression: dc ``` #### Garbage Collection Long stop-the-world GC pauses are bad, may want to adjust: ``` # GC Pauses greater than gc_warn_threshold_in_ms will be logged at WARN level # Adjust the threshold based on your application throughput requirement # By default, Cassandra logs GC Pauses greater than 200 ms at INFO level gc_warn_threshold_in_ms: 1000 ``` ### JVM Configure your JVM (in `jvm.options`) to use G1 garbage collector. By default, `jvm.options` uses the older CMS garbage collector. ::: details ``` ################# # GC SETTINGS # ################# ### CMS Settings -XX:+UseParNewGC -XX:+UseConcMarkSweepGC -XX:+CMSParallelRemarkEnabled -XX:SurvivorRatio=8 -XX:MaxTenuringThreshold=1 -XX:CMSInitiatingOccupancyFraction=75 -XX:+UseCMSInitiatingOccupancyOnly -XX:CMSWaitDuration=10000 -XX:+CMSParallelInitialMarkEnabled -XX:+CMSEdenChunksRecordAlways # some JVMs will fill up their heap when accessed via JMX, see CASSANDRA-6541 -XX:+CMSClassUnloadingEnabled ### G1 Settings (experimental, comment previous section and uncomment section below to enable) ## Use the Hotspot garbage-first collector. #-XX:+UseG1GC # ## Have the JVM do less remembered set work during STW, instead ## preferring concurrent GC. Reduces p99.9 latency. #-XX:G1RSetUpdatingPauseTimePercent=5 # ## Main G1GC tunable: lowering the pause target will lower throughput and vise versa. ## 200ms is the JVM default and lowest viable setting ## 1000ms increases throughput. Keep it smaller than the timeouts in cassandra.yaml. #-XX:MaxGCPauseMillis=500 ## Optional G1 Settings # Save CPU time on large (>= 16GB) heaps by delaying region scanning # until the heap is 70% full. The default in Hotspot 8u40 is 40%. #-XX:InitiatingHeapOccupancyPercent=70 # For systems with > 8 cores, the default ParallelGCThreads is 5/8 the number of logical cores. # Otherwise equal to the number of cores when 8 or less. # Machines with > 10 cores should try setting these to <= full cores. #-XX:ParallelGCThreads=16 # By default, ConcGCThreads is 1/4 of ParallelGCThreads. # Setting both to the same value can reduce STW durations. #-XX:ConcGCThreads=16 ### GC logging options -- uncomment to enable -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintHeapAtGC -XX:+PrintTenuringDistribution -XX:+PrintGCApplicationStoppedTime -XX:+PrintPromotionFailure #-XX:PrintFLSStatistics=1 #Xloggc:/var/log/cassandra/gc.log ← recommend you enable gc logging and rotate the logs -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=10 -XX:GCLogFileSize=10M ``` ::: ### Cassandra Tuning The following is an OS tuning script provided by DataStax. ::: tip This was created for use with CentOS 6; it may not reflect settings needed for more modern versions of Linux. ::: ::: details ```bash #!/usr/bin/env bash echo deadline > /sys/block/vda/queue/scheduler echo 0 > /proc/sys/vm/zone_reclaim_mode # readahead to 64 blockdev --setra 64 /dev/vda1 # swap off echo 0 > /proc/sys/vm/swappiness swapoff --all # user limits grep -q -F '* - nproc 32768' /etc/security/limits.d/90-nproc.conf || echo '* - nproc 32768' >> /etc/security/limits.d/90-nproc.conf grep -q -F 'vm.max_map_count = 131072' /etc/sysctl.conf || echo 'vm.max_map_count = 131072' >> /etc/sysctl.conf ``` ::: ## Cassandra Monitoring ### Cassandra Metrics JSON Output This describes the format of the JSON output produced when the metrics configuration option is activated. Source: https://docs.datastax.com/en/developer/cpp-driver/2.17/api/struct.CassMetrics/ ::: details ```json { "Requests": { # Minimum in microseconds "min": [Number: integer], # Maximum in microseconds "max": [Number: integer], # Mean in microseconds "mean": [Number: integer], # Standard deviation in microseconds "stddev": [Number: integer], # Median in microseconds "median": [Number: integer], # 75th percentile in microseconds "percentile_75th": [Number: integer], # 95th percentile in microseconds "percentile_95th": [Number: integer], # 98th percentile in microseconds "percentile_98th": [Number: integer], # 99th percentile in microseconds "percentile_99th": [Number: integer], # 99.9th percentile in microseconds "percentile_999th": [Number: integer], # Mean rate in requests per second "mean_rate": [Number: fraction], # 1 minute rate in requests per second "one_minute_rate": [Number: fraction], # 5 minute rate in requests per second "five_minute_rate": [Number: fraction], # 15 minute rate in requests per second "fifteen_minute_rate": [Number: fraction] }, "stats": { # The total number of connections "total_connections": [Number: integer], # The number of connections available to take requests "available_connections": [Number: integer], # Occurrences when requests exceeded a pool's water mark "exceeded_pending_requests_water_mark": [Number: integer], # Occurrences when number of bytes exceeded a connection's water mark "exceeded_write_bytes_water_mark": [Number: integer] }, "queries": { # Number of queries sent to Cassandra "sent": [Number: integer], # Number of successful responses "recv_ok": [Number: integer], # Number of requests that couldn’t be sent, because the local # Cassandra driver’s queue was full. "recv_err_queue_full": [Number: integer], # Number of requests that didn’t succeed because the Cassandra # driver couldn’t connect to the server. "recv_err_no_hosts": [Number: integer], # Number of requests that didn’t succeed because the Cassandra # driver timed out while waiting for response from server. "recv_err_client_timeout": [Number: integer], # Number of requests that didn’t succeed because the Cassandra # server reported a timeout communicating with other nodes. "recv_err_server_timeout": [Number: integer], # Number of requests which couldn’t succeed, because not enough # Cassandra nodes were available for the consistency level. "recv_err_server_unavailable": [Number: integer] # Number of requests which couldn’t succeed for other reasons. "recv_err_other": [Number: integer] }, "errors": { # Occurrences of a connection timeout "connection_timeouts": [Number: integer], # [No description provided] "pending_request_timeouts": [Number: integer], # Occurrences of requests that timed out waiting for a connection "request_timeouts": [Number: integer] } } ``` ::: # Obox: Configuration An annotated configuration example: ```doveconf[dovecot.conf] # Load the obox plugin mail_plugins { obox = yes } # How many mails to download in parallel from object storage. # # A higher number improves the performance, but also increases the local disk # usage and number of used file descriptors. mail_prefetch_count = 10 # Override setting for writes, copies, or deletes. # They default to 0, which expands to `mail_prefetch_count` + 1. obox_max_parallel_writes = 0 #mail_prefetch_count + 1 obox_max_parallel_copies = 0 #mail_prefetch_count + 1 obox_max_parallel_deletes = 0 #mail_prefetch_count + 1 ``` How much disk space metacache can use before old data is cleaned up. Generally, this should be set at ~90% of the available disk space. ```doveconf[dovecot.conf] metacache_max_space = 200G ``` How much disk space on top of `metacache_max_space` can be used before Dovecot stops allowing more users to login. ```doveconf[dovecot.conf] metacache_max_grace = 10G ``` How often to upload important index changes to object storage? This mainly means that if a backend crashes during this time, message flag changes within this time may be lost. A longer time can however reduce the number of index bundle uploads. ```doveconf[dovecot.conf] metacache_upload_interval = 5min ``` If user was accessed this recently, assume the user's indexes are up-to-date. If not, list index bundles in object storage (or Cassandra) to see if they have changed. This typically matters only when user is being moved to another backend and soon back again, or if the user is simultaneously being accessed by multiple backends. Default is 2 seconds. ```doveconf[dovecot.conf] metacache_close_delay = 2secs ``` Core settings ------------- ```doveconf[dovecot.conf] mail_home = /var/vmail/%{user | sha1 % 256 | hex(2)}/%{user} ``` Specifies the location for the local mail cache directory. This will contain Dovecot index files and it needs to be high performance (e.g. SSD storage). Alternatively, if there is enough memory available to hold all concurrent users' data at once, a tmpfs would work as well. The "%{user | sha1 % 256 | hex(2)}" shards the username so everything isn't in one directory. ```doveconf[dovecot.conf] mail_uid = vmail mail_gid = vmail ``` UNIX UID & GID which are used to access the local cache mail files. ```doveconf[dovecot.conf] mail_fsync = never ``` We can disable fsync()ing for better performance. It's not a problem if locally cached index file modifications are lost. ```doveconf[dovecot.conf] mail_temp_dir = /tmp ``` Directory where downloaded/uploaded mails are temporarily stored to. Ideally all of these would stay in memory and never hit the disk, but in some situations the mails may have to be kept for a somewhat longer time and it ends up in disk. So there should be enough disk space available in the temporary filesystem. ::: tip `/tmp` should be a good choice on any recent OS, as it normally points to `/dev/shm`, so this temporary data is stored in memory and will never be written to disk. However, this should be checked on a per installation basis to ensure that it is true. ::: ```doveconf[dovecot.conf] mailbox_list_index = yes ``` Enable mailbox list indexes. This is required with obox format. ```doveconf[dovecot.conf] mailbox_list_index_include_inbox = yes ``` If [[setting,mailbox_list_index_prefix]] resides in tmpfs, INBOX status should be included in list index. ## Obox Configuration Options ## Other Dovecot Settings ### Mail Cache Settings There is no need to add `date.save` to the various cache settings, as this data is always stored in dovecot.index file by obox. ### `mail_fsync` With obox, this setting is recommended to be set to `never`. In obox installastions, this option only affects the local metacache operations. If a server crashes, the existing metacache is treated as potentially corrupted and isn't used, so `never` provides the best performance. ### `mail_prefetch_count` For obox, this setting affects reading multiple mails in parallel from object storage to local disk without waiting for previous reads to finish. The downside is that each mail uses a file descriptor and disk space in `mail_temp_dir`. For obox, a good value is likely between `10` to `100`. ### `mail_sort_max_read_count` As a special case with obox when doing a `SORT (ARRIVAL)`, the SORT will always return OK. When it reaches the limit, it starts getting the received-timestamps from the time the object was saved. This is commonly the same as the received-timestamp, but not always. Often this produces mostly the same result, especially in the INBOX. ### Quota Over Scripts obox installations using [[setting,quota_over_status]] must also have [[setting,quota_over_status_lazy_check]] enabled. Otherwise the [[setting,quota_over_status_current]] checking may cause a race condition with metacache cleaning, which may end up losing folder names or mail flags within folders. ## Dovecot Features ### Compression (`fs-compress`) For an overview of compression features see: * [[plugin,mail_compress]], and * [[plugin,fs_compress]]. #### Example configuration ```doveconf[dovecot.conf] fs_s3_url = https://s3.example.com/ fs_s3_access_key = ACCESSKEY fs_s3_secret = SECRET fs_s3_bucket = mails fs_compress_write_method = zstd obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_objectid_prefix = %{user}/mails/ #lock_path = /tmp # Set only without lazy_expunge plugin } fs s3 { } } metacache { fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs s3 { } } fts dovecot { fs fts-cache { } fs fscache { size = 512M path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs s3 { } } ``` Note that these both work and don't have any practical difference, because [[link,dictmap]] doesn't modify the object contents in any way: ```doveconf[dovecot.conf] # compress before dictmap metacache { fs compress { } fs dictmap { } fs sproxyd { } } # compress after dictmap metacache { fs dictmap { } fs compress { } fs sproxyd { } } ``` With encryption enabled: ```doveconf[dovecot.conf] obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs compress { } fs crypt { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_objectid_prefix = %{user}/mails/ #lock_path = /tmp # Set only without lazy_expunge plugin } fs s3 { } } # Similarly add for metacache { .. } and fts dovecot { .. } ``` ### Encryption To encrypt mails in-rest you can use the fs-crypt plugin. Using the mail-crypt plugin is not recommended with obox. It is not recommended to put the fs-crypt plugin before the fs-cache plugin for performance reasons. The plugin is intended for encrypting data at-rest in remote storage. #### Configuration First, one needs to generate a keypair. This can be done with OpenSSL. Dovecot Pro 3 supports EDDSA with X25519, ECDSA and RSA. RSA is not recommended for performance and size reasons. To generate a key, you can use ``` openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out private.pem ``` or ``` openssl genpkey -algorithm X25519 -out private.pem ``` Once private key is generated, you can generate public key with ``` openssl pkey -in private.pem -out public.pem -pubout ``` ::: danger WARNING: If you ever lose the private key, all data encrypted with it will be IRREVOCABLY lost. There is no way to recover mails without the private key. ::: To use the private key, configure ```doveconf[dovecot.conf] crypt_global_public_key_file = /etc/dovecot/public.pem crypt_global_private_key main { crypt_private_key_file = /etc/dovecot/private.pem } ``` ### Lazy Expunge It is highly recommended to use lazy_expunge plugin. ::: tip If autoexpunging is done on the lazy_expunge folder, it must be larger than any potentially slow object storage operation. For example 15 minutes should be a rather safe minimum. ::: ```doveconf[dovecot.conf] mail_plugins { lazy_expunge = yes } lazy_expunge_mailbox = .EXPUNGED namespace inbox { mailbox .EXPUNGED { autoexpunge = 7 days } } ``` #### `lazy_expunge_only_last_instance` This is recommended to be enabled for all installations. Obox does reference counting in Cassandra (fs-dictmap), and this setting takes advantage of that setup. #### `obox_track_copy_flags` Lazy expunge allows reduction of Cassandra dictmap lookups by removing the [[setting,fs_dictmap_lock_path]] setting and enabling the [[setting,obox_track_copy_flags]] setting. ```doveconf[dovecot.conf] obox_track_copy_flags = yes ``` ### Mailbox Indexes Dovecot mailbox indexes are required when using obox. ### Virtual Plugin When using the virtual plugin with obox, the virtual INDEX location must point to a directory named "virtual" in the user home directory. This way the virtual indexes are added to the obox root index bundles and will be preserved when user moves between backends or when metacache is cleaned. ```doveconf[dovecot.conf] mail_driver = virtual mail_path = /etc/dovecot/virtual mail_index_path = ~/virtual ``` The virtual indexes will be stored in the user root bundle. It is possible to disable storing virtual indexes in the user root bundle using `metacache_disable_secondary_indexes`. ## DNS (Domain Name System) lookups Particularly with obox, Dovecot nodes need to do frequent DNS lookups. It is recommended that the underlying platform provides either a performant DNS service or deploys a local DNS cache on the Dovecot nodes. Software that is known to work in this regard is [PowerDNS](https://www.powerdns.com/) as a service and [nscd](https://www.gnu.org/software/libc/libc.html) for local caching. In environments where reaching a particular packets per second (PPS) rate for DNS or all packets combined, can lead to harsh throttling, it is recommended to select a local caching option, such as nscd. The same applies to certain virtualized environments, where the layer between virtual machine and hypervisor can drop packets under high load, leading to DNS timeouts. Additionally, Amazon AWS instances have been known to react adversely when an undocumented PPS rate is reached. ## Optimizations ### Disable Journaling (ext4) In order to reduce I/O on the backends, it is recommended to disable the ext4 journal: ```sh tune2fs -O ^has_journal /dev/vdb e2fsck -f /dev/vdb ``` ### Disable atimes Dovecot doesn't require atimes, so you can mount the filesystem with noatime: ```sh mount -o defaults,discard,noatime /dev/vdb /metacache ``` ::: details Example: Disable journaling on ext4 volume ssd drive including setting discard, noatime, nodiratime (on CentOS 7) ```[bash] $ umount /metacache $ tune2fs -O ^has_journal /dev/sdc1 tune2fs 1.42.9 (28-Dec-2013) $ fsck.ext4 -f /dev/sdc1 e2fsck 1.42.9 (28-Dec-2013) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Pass 5: Checking group summary information /dev/sdc1: 11/16777216 files (0.0% non-contiguous), 1068533/67108608 blocks $ tune2fs -o discard /dev/sdc1 tune2fs 1.42.9 (28-Dec-2013) $ dumpe2fs /dev/sdc1 | grep discard dumpe2fs 1.42.9 (28-Dec-2013) Default mount options: user_xattr acl discard $ blkid /dev/sdc1 /dev/sdc1: UUID="5d20d432-3152-4ccf-98e3-94e7500cfd40" TYPE="ext4" $ vi /etc/fstab UUID=5d20d432-3152-4ccf-98e3-94e7500cfd40 /metacache ext4 defaults,noatime,nodiratime 0 0 $ mount /metacache $ mount | grep metacache /dev/sdc1 on /metacache type ext4 (rw,noatime,nodiratime,seclabel) ``` ::: ### Temporary Directory To further reduce IOPs on the metacache volume when using the mail compression or mail crypt plugins, set the dovecot temp directory to a tmpfs volume: ```doveconf[dovecot.conf] mail_temp_dir = /dev/shm/dovecot ``` ## Maintenance ### Obox Metacache Maintenance It can be useful to flush unimportant changes in metacache every night when the system has idle capacity. This way if users are moved between backends, there's somewhat less work to do on the new backends since caches are more up-to-date. This can be done by running `doveadm metacache flushall` in a cronjob. ## Compression ### Index Objects ```doveconf[dovecot.conf] metacache { fs compress { } ... } ``` All of the object storage backends should be set up to compress index bundle objects. This commonly shrinks the indexes down to 20-30% of the original size (with zstd compression). See this documentation for supported algorithms and their settings: [[plugin,fs-compress]]. ### Email Objects Email object (a/k/a message blob data) compression is recommended to be done with the [[link,fs_compress]] [[link,fs_wrappers, fs-wrapper]]. Example: ```doveconf[dovecot.conf] fs_compress_write_method = zstd obox { fs fscache { } fs compress { } #... } ``` By using compress fs after the [[link,obox_fscache,fscache fs]] [[link,fs_wrappers,fs wrapper]], the mails are stored uncompressed in the fscache and reading is more efficient. If [[setting,fs_compress_read_plain_fallback,yes]], the compression status of email object data is auto-detected. Therefore, [[setting,fs_compress_write_method]] may safely be added to a currently existing system; existing non-compressed mail objects will be identified correctly. An alternative to [[link,fs_compress]] for mails is to use the [[plugin,mail-compress]] plugin. However, the problem with this with obox is that the mail files are written compressed to fscache, which can be inefficient. ## Dictmap Using obox with Cassandra is done via the fs-dictmap [[link,fs_wrappers,wrapper]]. Configuration information can be found at [[link,dictmap]]. ## fscache ### Multiple fscache Directories It's possible to split fscaches over multiple independent directories by including %variables in the path. This is typically done based on username hashing, e.g. `/var/cache/mails/%{user | sha1 % 4} ` would use 4 fscache directories. This is especially recommended with larger fscaches (>10 GB). The main benefit of split fscaches is that any cache trashing caused by a few users will be limited only to those users' fscaches. The filesystem would normally be shared for the 4 directories, i.e. mount it to `/var/cache/mails`. The `fscache.log` files should be stored outside the fscache partition to avoid leaking files when it runs out of disk space. For example if Dovecot is internally rebuilding caches for a single user, the 1 GB fscache could quickly be filled only with that one user's emails. But if the fscache is slit over multiple directories, the other directories won't be affected and may still contain useful cache for other users. ### Limitations The fscache plugin relies on filesystem usage information to be consistent. For example ZFS provides different information on block usage depending on when the information is queried, making fscache not work. ::: warning ZFS support has been currently explicitly disabled. ::: ### Example Configuration ```doveconf[dovecot.conf] obox { fs fscache { size = 2G path = /var/cache/mails log_path = /var/cache/mails.log } } # Or split users to multiple directories (4 * 512MB = 2GB total): obox { fs fscache { size = 2G path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } } ``` # Obox: Design Dovecot obox format is split into two main categories: mail object handling and index object handling. ![obox design](./images/ObjectStoragePlugin.png) ## Mail Objects The mail object handling is easy enough: Each mail is stored in its own separate object. The object name is a uniquely generated name, which we call object ID (OID). The mails are also cached locally using a fscache wrapper, which uses a global cache directory with a configurable max size, local to the backend. If the object storage access is fast, this cache doesn't need to be very large, but it should still exist. A small cache that usually stays in memory (tmpfs) is likely good (e.g. 1-2 GB). The mail object names look like: `user-hash/user@domain/mailboxes/folder-guid/oid` For example: `b5/899/user@example.com/mailboxes/00d7d12ea08a3153175e0000dfbea952/d88ff1001d4bf753a1b800001accfe22` ## Index Objects Dovecot obox format uses the normal Dovecot index file formats, except they are packed into index bundles when they are stored to object storage. The indexes are written lazily to the object storage in order to minimize the object storage I/O. Before writing the indexes to object storage they are cached on the backend in metacache where the index tree structure is unbundled as in traditional Dovecot index structure. Metacache is local to the backend. There are two types of index bundles: base bundles and diff bundles. The base bundles may be large and they are updated somewhat rarely. The diff bundles contain the latest changes since the base bundle and are the ones usually updated. This is done to avoid constantly uploading large index objects even though very little had changed. All objects are created with unique object names. This guarantees that two servers can't accidentally overwrite each others' changes. Instead, what happens is that there may be two conflicting index bundle objects. If Dovecot notices such conflict, it merges the conflicting indexes using dsync algorithm without data loss. This allows active-active multi-site setups to run safely during a split brain. The base index object names look like: `user-hash/user@domain/mailboxes/folder-guid/idx/bundle.timestamp-secs.timestamp-usecs.unique-id` For example: `b5/899/user@example.com/mailboxes/00d7d12ea08a3153175e0000dfbea952/idx/bundle.53f74dc2.0fbcf.c96d802b5d4df75307bb00001accfe22` The diff index object names look the same, except another "-unique-id" is appended after the base bundle name. ## Metacache The metacache is the local (on backend) cache used to manage index files for use with user's sessions. The obox code is responsible for bundling and uploading these files to object storage when needed. The code also actively manages metacache data in the background to free-up disk space. ## fs-cache The fs-cache is a [[link,fs_wrappers,fs wrapper]] that is used for cached storage of pre-fetched mail messages. It is enabled via the [[setting,fs_fscache_size]] setting. # Obox: Dictmap Dictmap is a required component of obox. Using obox with Cassandra is done via the fs-dictmap [[link,fs_wrappers,wrapper]], which translates internal "lib-fs paths" into dict API. The dict API paths in turn are translated to SQL/CQL queries via dict-sql. ::: info It is recommended to use [[setting,@fs_defaults,cassandra]]. Using this setting will set these settings by default: ::: details Click to show settings ```doveconf[dovecot.conf] obox { dict proxy { name = mails socket_path = dict-async } } metacache { dict proxy { name = mails socket_path = dict-async } } dict_server { dict mails { driver = sql sql_driver = cassandra } # (dict_maps stripped out) } ``` ::: ## Requirements Cassandra requires installing Dovecot Pro Cassandra plugin package and the cpp-driver from 3rdparty repository. ## Settings For obox, dictmap requires using the Cassandra dictionary. ::: tip Cassandra support is done via Dovecot's SQL dict, because Cassandra CQL is implemented as a lib-sql driver. ::: ### Dict Paths The fs-dictmap uses the following dict paths: * Main Access * `shared/dictmap/` * If refcounting-table is used * `shared/dictrevmap//mailboxes//` * For adding new references. * `shared/dictrevmap//` * For deleting. * `shared/dictrevmap/` * For lookups if any object references exist after deletion. If [[setting,fs_dictmap_diff_table]] is used: * `shared/dictdiffmap//idx/` * Latest self/diff bundle for the user created by the `` * `shared/dictdiffmap//mailboxes//idx/` * Latest self/diff bundle for the folder created by the `` ### Example Configuration See [[link,sql_cassandra]] for all Cassandra-specific settings. ```doveconf[dovecot.conf] cassandra_hosts = cassandra-host-3 cassandra-host-2 cassandra-host-1 dict_server { dict mails { driver = sql sql_driver = cassandra cassandra_keyspace = mails } } @fs_dictmap_defaults = cassandra ``` The Cassandra settings are described in more detail in [[link,sql_cassandra]]. The following base tables are always needed by fs-dictmap: * `user_index_objects` * `user_mailbox_index_objects` * `user_mailbox_objects` * `user_mailbox_buckets` * `user_fts_objects` For more details on Cassandra, see: * [[link,dovecot_pro_cassandra]] and * [[link,dovecot_pro_cassandra_replication_factor]]. ### Optimize Index Diff & Self-Bundle Updates Cassandra doesn't handle row deletions very efficiently. The more rows are deleted, the larger number of tombstones and the longer it takes to do lookups from the same partition. Most of the deletions Dovecot does are index diff & self-bundle updates. Each Dovecot Backend server always writes only a single such object per folder, which allows storing them with (user, folder, host) primary key and updating the rows on changes, instead of inserting & deleting the rows. The fs-dictmap [[setting,fs_dictmap_diff_table]] setting enables this behavior. Diff-table requires these additional tables to exist in Cassandra: * `user_index_diff_objects` * `user_mailbox_index_diff_objects` ### Reference Counting table Reference counting allows a single mail object to be stored in multiple mailboxes, without the need to create a new copy of the message data in object storage. There are two downsides to it though: * It requires an additional large Cassandra table that keeps track of the references. * It requires listing objects in Cassandra to find out if we just deleted the last reference or not. Only on the last reference deletion we want to delete the actual object from object storage. However, the benefits outweigh the concerns as reference counting exchanges expensive storage operations with relatively cheap Cassandra row updates. The fs-dictmap [[setting,fs_dictmap_refcounting_table]] setting enables this behavior. Reference counting requires an additional table: * user_mailbox_objects_reverse ### Quorum Configuration There are only two configurations that are currently recommended: Quorum within a single datacenter (default): ```doveconf[dovecot.conf] cassandra_read_consistency = local-quorum cassandra_write_consistency = local-quorum cassandra_delete_consistency = local-quorum ``` Local-quorum guarantees that reads after writes are always returning the latest data. Dovecot requires strong consistency within a datacenter. Quorum within multiple datacenters: ```doveconf[dovecot.conf] cassandra_read_consistency = local-quorum #cassandra_read_fallback_consistency = quorum cassandra_write_consistency = each-quorum cassandra_write_fallback_consistency = local-quorum cassandra_delete_consistency = each-quorum cassandra_delete_fallback_consistency = local-quorum ``` As long as the datacenters are talking to each other, this uses each-quorum for writes. If there's a problem, Cassandra nodes fallback to local-quorum and periodically try to switch back to each-quorum. The main benefit of each-quorum is that in case the local datacenter suddenly dies and loses data, Dovecot will not have responded OK to any mail deliveries that weren't already replicated to the other datacenters. Using local-quorum as fallback ensures that in case of a network split the local Palomar still keeps working. Of course, if the local datacenter dies while the network is also split, there will be data loss. Using [[setting,cassandra_read_fallback_consistency,quorum]] allows reads to succeed even in cases when multiple Cassandra nodes have failed in the local datacenter. For example: * 2 datacenters, each having a replica count of 3 * This means a total replica count of 6, so quorum requires 4 replicas * Local datacenter 2 two Cassandra nodes * If a read finds 3 replicas from the remote datacenter and 1 replica from local datacenter, the read will still succeed. Note that if there are only a total of 3 Cassandra nodes per datacenter and 2 of them are lost, writes can't succeed with either each-quorum or local-quorum. In this kind of a configuration having `read_fallback_consistency=quorum` is not very useful. Also note that there are no consistency settings that allow Dovecot to reliably continue operating if Cassandra in the local datacenter no longer has quorum, i.e. at least half of its nodes have gone down. In this case writes will always fail. If this happens, all users should be moved to be processed by another datacenter. ### Fallback Consistency Dovecot normally sends the Cassandra queries with the primary consistency setting. If a write fails because either 1. There aren't enough nodes available for the consistency level, or 2. Cassandra server timed out connecting to all the necessary nodes, Dovecot attempts the query again using the fallback consistency. When this happens, Dovecot also switches all the following queries to use the fallback consistency for a while. The consistency will be switched back when a query with the primary consistency level succeeds again. While fallback consistency is being used, the queries are periodically still retried with primary consistency level. The initial retry happens after 50 ms and the retries are doubled until they reach the maximum of 60 seconds. ### Uncertain Writes Cassandra doesn't perform any rollbacks to writes. When Cassandra reports a write as failed, it only means that it wasn't able to verify that the required consistency level was reached yet. It's still likely/possible that the write was successful to some nodes. If even a single copy was written, Cassandra will eventually be consistent after hinted handoffs or repairs. This means that even though a write may initially have looked like it failed, the data can become visible sooner or later. [[changed,dictmap_no_cleanup_uncertain_change]] When this happens, Dovecot attempts to revert the Cassandra write by deleting it. If this deletion was successful, the object is deleted from storage as well. This is indicated as adding `- Object ID ... deleted` after the original write error message. If the deletion was unsuccessful, it logs `file write state is uncertain for object ID ...` For some writes the revert isn't possible, and `success is uncertain, not deleting object ID ...` is logged. This also happens when `no-cleanup-uncertain` parameter is used. In these cases the object is not deleted in storage. When the revert wasn't performed, the Cassandra write may become visible at some point later (possibly leading to duplicate mails). If it doesn't become visible, the object becomes leaked in the storage. Currently to avoid these situations an external tool has to be monitoring the logs or exported events, and fixing up these uncertain writes when Cassandra is again working normally. See [[event,fs_dictmap_dict_write_uncertain]]. ### Deletes Objects are deleted from Cassandra first, and only then from the object storage. If any Cassandra deletion fails, the deletion process stops. This means that if a Cassandra delete appears to fail, but actually succeeds later on, the object is leaked in the object storage. Also if deleting the object from the object storage fails, the object is leaked. Mail objects have a reverse table for tracking the email object reference count. The deletion algorithm is: * Delete object from Cassandra's `user_mailbox_objects` table. * Delete object from Cassandra's `user_mailbox_objects_reverse` table. * If there are no references to the object in the `user_mailbox_objects_reverse` table, delete the object from object storage. ### Path Based Object Storages fs-dictmap can be used also with object storages which are accessed by paths rather than by object IDs (e.g. S3). This needs special configuration to avoid unnecessary Cassandra lookups. Use [[setting,fs_dictmap_storage_objectid_prefix,<prefix>]] inside [[setting,obox]] { ... } filter to enable fake object IDs for email objects. These fake object IDs are stored in Dovecot index files, which can be translated into object paths without doing a Cassandra lookup. The translation is simply `/`, unless the migrate feature is used. Use [[setting,fs_dictmap_storage_passthrough_paths,full]] inside [[setting,metacache]] { ... } and [[setting_text,fts,fts dovecot]] { ... } filters to enable passthrough object IDs. With these the object ID is the same as the object path. The object ID is written as an empty string into Cassandra. If this setting is used, the object can't be copied (which is fine, because it is not done for index bundle or FTS objects). #### Migrating Path Based Object Storages to Dictmap Use [[setting,fs_dictmap_storage_objectid_migrate]] to enable migration. Also make sure to disable periodic metacache uploads during migration by setting [[setting,metacache_upload_interval]] to `infinite`. Use the [[man,storage-objectid-migrate-mails]] and [[man,storage-objectid-migrate-index]] scripts to migrate the indexes and mails. These scripts list all (index bundle, fts and email) objects for the user and add them to Cassandra. Note that the user must be completely inaccessible (imap, pop3, managesieve, mail deliveries) while these scripts are run to avoid data loss. Also, avoid any background index bundle changes during the script run by running [[doveadm,metacache,flush]] for the user first. Before migration the mails are stored in `/mailboxes//` paths. The migration script adds all these mails to Cassandra using `` as the object ID. The obox-raw-id record is also set to ``. The "extra data" byte in the `` for path based object storages is always 0. For all newly written emails when `storage-objectid-prefix` is non-empty, the `0x80` bit is set for the "extra data" byte. This allows generating the object ID from the obox-raw-id (``) without a Cassandra lookup: * 0x80 bit set: object_id = `/` * 0x80 bit unset: object_id = `/mailboxes//` Note that listing object IDs with e.g. `doveadm fs iter --object-ids` doesn't add the path prefix. It only returns the ``. Newly saved mails can be efficiently copied within dictmap, but migrated mails must first be copied from `/mailboxes//` to `/`. ### Cassandra Keyspace/Tables ::: details Cassandra keyspace/table creation ```cql CREATE KEYSPACE IF NOT EXISTS mails WITH replication = { 'class': 'SimpleStrategy', 'replication_factor': 3 }; USE mails; CREATE TABLE IF NOT EXISTS user_index_objects ( u text, n text, i blob, primary key (u, n) ); CREATE TABLE IF NOT EXISTS user_mailbox_index_objects ( u text, g blob, n text, i blob, primary key ((u, g), n) ); CREATE TABLE IF NOT EXISTS user_mailbox_objects ( u text, g blob, b int, n blob, i blob, primary key ((u, g, b), n) ); CREATE TABLE IF NOT EXISTS user_mailbox_buckets ( u text, g blob, b int, primary key ((u, g)) ); CREATE TABLE IF NOT EXISTS user_fts_objects ( u text, n text, i blob, primary key (u, n) ); CREATE TABLE IF NOT EXISTS user_index_diff_objects ( u text, h text, m text, primary key (u, h) ); CREATE TABLE IF NOT EXISTS user_mailbox_index_diff_objects ( u text, g blob, h text, m text, primary key (u, g, h) ); CREATE TABLE IF NOT EXISTS user_mailbox_objects_reverse ( u text, g blob, n blob, i blob, primary key (i, n) ); ``` ::: ## Dictmap Mappings fs-dictmap works by providing a view to Cassandra that ends up looking like a filesystem, which is compatible with the obox mailbox format. There are several hardcoded paths necessary to accomplish this. The mapping between the filesystem and the dict keys is: | Filesystem Path | Dict Keys (`shared/` prefix not included) | Files | | --------------- | ----------------------------------------- | ----- | | `$user` | | Hardcoded idx/ and mailboxes/ | | `$user/idx/` |
  • `dictmap/$user/idx/$object_name`
  • `dictdiffmap/$user/idx/$host`
| User root index bundles | | `$user/mailboxes/` |
  • `dictmap/$user/mailboxes/`
  • `$mailbox_guid`
| Folder GUID directories | | `$user/mailboxes/$mailbox_guid/` |
  • `dictmap/$user/mailboxes/`
  • `$mailbox_guid/`
  • `$bucket/$object_name`
| Email objects | | `$user/mailboxes/$mailbox_guid/idx/` |
  • `dictmap/$user/mailboxes/`
  • `$mailbox_guid/`
  • `idx/$object_name`
  • `dictdiffmap/$user/mailboxes/`
  • `$mailbox_guid/idx/$host`
| Folder index bundles | | `$user/fts/` |
  • `dictmap/$user/fts/$object_name`
| Full text search index objects | The filesystem can be accessed using the `doveadm fs` or `doveadm mail fs` commands. The `config-filter-name` parameter is either `obox` or `metacache`. You're accessing email objects or index objects. ## Script: List Filesystem Names The included [[man,obox-user-objects]] and [[man,obox-user-iter]] scripts can be used to list all objects for a user. ## Data Access Patterns Below is a list of operations that dictmap does for accessing data.

Cassandra operations | Object storage operations

* Refreshing user root index * Frequency: very often – nearly every time a user logs in or a mail is delivered * Cached for the duration of [[setting,metacache_close_delay]] * Lookup object names from user_index_objects for the given username. * Lookup object names from user_index_diff_objects for the given username. * Download any missing index bundle objects * Refreshing folder index * Frequency: somewhat often * This lookup is usually done only when saving the index to local cache for the first time. Afterwards it's not done unless the user's cache becomes invalidated (user modified by another backend or the folder cache deleted). * Lookup object names from user_mailbox_index_objects for the given (username, folder GUID). * Lookup object names from user_mailbox_index_diff_objects for the given (username, folder GUID). * Lookup max_bucket from user_mailbox_buckets for the given (username, folder GUID) * Lookup object names from user_mailbox_objects for the given (username, folder GUID, 0..max_bucket). This is necessary for finding any newly delivered emails since the last folder index upload. * Download any missing index bundle objects * Writing user root self/diff index * Frequency: often * The first time this backend modifies the user's mailbox in any way. * Whenever user's folders are created/renamed/deleted. * Whenever user's Sieve script or METADATA is modified. * Within 5 minutes ([[setting,metacache_upload_interval]]) after any folder has had flag changes. * Insert to user_index_diff_objects (which overwrites the existing row) * Upload new index bundle object * Delete old index bundle objects * Writing user root base index * Frequency: rarely * Normally self/diff index is updated; only after there have been a lot of changes a new base index is created. * Insert to user_index_objects * Delete from user_index_objects by (user, object name) * Upload new index bundle object * Delete old index bundle objects * Writing folder diff/self index * Frequency: often * Every 10th mail delivery * Every 5 minutes after IMAP client has changed the folder (flag changes, deletions) * Insert to user_mailbox_index_diff_objects (which overwrites the existing row) * Upload new index bundle object * Delete old index bundle objects * Writing folder base index * Frequency: not very often * Normally self/diff index is updated; only after there have been a lot of changes a new base index is created. * Insert to user_mailbox_index_objects * Delete from user_mailbox_index_objects by (user, folder GUID, object name) * Upload new index bundle object * Delete old index bundle objects * Delivering a new email via LMTP, or saving a new email via IMAP APPEND * Frequency: Write folder index (as described above) for every 10th mail delivery (default) * Insert to user_mailbox_objects * Upload new email object * Reading email * Usually no lookup, because object ID is stored also in Dovecot indexes * Download email object (unless it's already in fscache) * Deleting email * Lookup object ID from user_mailbox_objects_reverse to get list of (user, folder, object name). Dovecot only cares if the result is empty or non-empty. * Delete from user_mailbox_objects (user, folder, object name) and user_mailbox_objects_reverse (object ID) * Folder index is written lazily within the next 5 minutes * Delete email object * Copying email * Lookup object ID from user_mailbox_objects_reverse to get list of (user, folder, object name). Dovecot only cares if the result is empty or non-empty. * Write folder index (as described above) for every 10th mail delivery (default) * Moving email * This is identical to a combination of copying and then deleting the email. * Running "doveadm force-resync" * Frequency: Rarely, and always a manual operation * Refresh user & folder indexes as described above. * Lookup folder GUIDs from user_mailbox_index_diff_objects for the specified user to find any missing folders. With Cassandra this returns several duplicates (one per each index object in folder), which are de-duplicated internally. ## Disaster Recovery In the (extremely unlikely) case that all Cassandra (fs-dictmap) data is lost, it is possible to recover this information by iterating through all objects stored in the object store. A rough overview of the process is as follows: ### Index Objects Recovery 1. List index objects in object storage 2. Use HEAD requests to determine the index objects' metadata 3. Add recovered index objects to Cassandra ### Mail Objects Recovery 1. Read & refresh indices for each user/mailbox 2. Dump index data and add object information to Cassandra 3. OPTIONAL: Look for unattached mail objects and remove them (in a background process) ## Cassandra Administration ### Sizing Per benchmark data, sizing of the Cassandra node can be estimated by assuming 50 bytes/email is required to store each message. Thus, assuming 512 GB total storage per Cassandra node (= 256 GB of usable storage + 256 GB for repairs/rebuilds), this means that each node can store data on up to 5.1 billion emails. ### High Availability For high availability, a minimum of three nodes is required for each data center. ### Memory The Cassandra cpp-driver library requires a lot of VSZ memory. Make sure dict process doesn't immediately die out of memory (it may also be visible as strange crashes at startup). By default, dict process [[setting,service_vsz_limit,2G]] and lower values should be avoided. Usually there should be only a single dict-async process running, because each process creates its own connections to the Cassandra cluster increasing its load. The Cassandra cpp-driver can use multiple IO threads as well. This is controlled by the [[setting,cassandra_io_thread_count]] setting. Each IO thread can handle 32k requests simultaneously, so usually 1 IO thread is enough. Note that each IO thread creates more connections to Cassandra, so again it's better not to creates too many threads unnecessarily. If all the IO threads are full of pending requests, queries start failing with "All connections on all I/O threads are busy" error. ### Repair If you encounter `Object exists in dict, but not in storage` errors in the Dovecot Pro log file you most likely have resurrected deleted data, which happened because of inconsistencies due to replication. See: - [[link,dovecot_pro_cassandra_repair]] and - [[link,obox_troubleshooting_object_exists_in_dict_but_not_in_storage]]. # Obox Storage Support: AWS S3 This page describes support for the S3 service directly provided by [Amazon Web Services (AWS)](https://aws.amazon.com/s3/). :::: info It is recommended to use [[setting,@fs_defaults,aws-s3]] to configure this provider. Using this setting will set these settings by default: ::: details Click to show settings ::: If you are using [[link,fts_dovecot_fs]] you should also set [[setting,@fts_fs_defaults,aws-s3]], which expands to: ::: details Click to show settings ::: :::: ::: warning For details on "S3 Compatible" storage support from non-AWS providers, see [[link,obox_s3_compatible]]. ::: ## Technical Requirements ::: danger **A Dovecot Pro/Palomar installation is only supported in a single AWS region.** This is because AWS S3 only offers asynchronous data replication across regions, which is not supported by obox. ::: Palomar can be setup using multiple Availability Zones (AZs) within a region. Each AZ is considered a "site" for purposes of Palomar. ::: danger **Availability Zones must be treated as separate Palomar "sites".** It is not supported to simply randomly distribute proxy and backend nodes between various AZs. ::: ### Dictmap Palomar with AWS S3 requires [[link,palomar_storage_dictmap]]. Dovecot Pro does NOT support AWS DynamoDB (as it uses a different protocol than CQL). Managed services exist that provide the necessary CQL infrastructure on AWS, such as [DataStax Astra DB](https://www.datastax.com/platform/amazon-web-services) or [ScyllaDB Cloud](https://www.scylladb.com/product/scylla-cloud/). OX does not support configuration or operation of these managed services, and cannot provide recommendations or operational advice. ::: danger UNSUPPORTED [AWS Keyspaces](https://aws.amazon.com/keyspaces/) cannot be used with Dovecot Pro as it lacks support for certain Dovecot-required Cassandra features. ::: ## Configuration Using the `aws-s3` driver is a simpler way to configure the S3 driver for AWS. Currently it's the same as using the `fs-s3` driver with the following default settings: Currently it's the same as using the generic [[link,obox_s3_compatible_config]] scheme with the following additional settings automatically added: | Parameter | Description | | --------- | ----------- | | [[setting,fs_http_add_headers]]/`x-amz-security-token` = `%{auth:token}` | Enable using security token if returned by IAM lookup. | | [[setting,fs_http_log_headers]]/`x-amz-request-id` = `yes`
[[setting,fs_http_log_headers]]/`x-amz-id-2` = `yes` | Include these headers' values in all log messages related to the request. This additional information helps when [troubleshooting][troubleshooting]. | Example debug log message, which shows how the `x-amz-*` headers are included: ``` Debug: http-client: conn 1.2.3.4:443 [1]: Got 200 response for request [Req1: GET https://test-mails.s3-service.com/?prefix=user%2Fidx%2F]: OK (x-amz-request-id:AABBCC22BB7798869, x-amz-id-2:DeadBeefanXBapRucWGAD1+aWwYMfwmXydlI0mHSuh4ic/j8Ji7gicTsP7xpMQz1IR9eydzeVI=) (took 63 ms + 140 ms in queue) ``` ### AWS Signature Version The obox S3 driver uses the AWS signature version 4 method by default, but version 2 can be used by adding the [[setting,fs_s3_signing]] setting: ```doveconf[dovecot.conf] fs_s3_signing = v2 ``` ### Example Configuration ::: warning All text indicated by `{{VARIABLE NAME}}` in the examples below **MUST** be replaced with your local configuration value(s). ::: ::: tip [[link,dictmap]] must also be configured to use this storage driver. ::: ```doveconf[dovecot.conf] mail_driver = obox # BUCKET_NAME: Storage bucket name to use. # REGION: AWS region to use for storage. # S3ACCESS: IAM role to use for storage access. fs_s3_url = https://{{BUCKET_NAME}}.s3.{{REGION}}.amazonaws.com/ fs_s3_region = {{REGION}} fs_s3_auth_role = {{S3ACCESS}} fs_compress_write_method = zstd obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_objectid_prefix = %{user}/mails/ #lock_path = /tmp # Set only without lazy_expunge plugin } fs aws-s3 { } } metacache { fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs aws-s3 { } } fts dovecot { fs fts-cache { } fs fscache { size = 512M path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs aws-s3 { } } ``` Without IAM use the settings: ```doveconf[dovecot.conf] fs_s3_access_key = {{ACCESSKEY}} fs_s3_secret = {{SECRET}} ``` ## Settings ### Default HTTP Settings `fs-s3` overrides some of the default HTTP client settings: * [[setting,http_client_max_idle_time,1s]] * [[setting,http_client_max_parallel_connections,10]] * [[setting,http_client_max_connect_attempts,3]] * [[setting,http_client_request_max_redirects,2]] * [[setting,http_client_request_max_attempts,5]] * [[setting,http_client_connect_backoff_max_time,1s]] * [[setting,http_client_user_agent,Dovecot/VERSION]] * [[setting,http_client_connect_timeout,5s]] * [[setting,http_client_request_timeout,10s]] You can override these and any other HTTP client or SSL settings by placing them inside [[setting,fs_s3]] named filter. ## Authentication Options ### IAM Authentication ::: info This is the recommended way of authentication with AWS S3. ::: Dovecot supports AWS Identity and Access Management (IAM) for authenticating requests to AWS S3 using the AWS EC2 Instance Metadata Service (IMDS) when using Amazon EC2 or IAM Roles for Service Accounts (IRSA) when using Amazon Elastic Kubernetes Service (Amazon EKS). Version 2 of IMDS (IMDSv2) is supported. Using IAM allows running Dovecot with S3 Storage while not keeping the credentials in the configuration. When using IAM you must ensure that the `fs-auth` service has proper permissions/owner. Configure the user for the fs-auth listener to be the same as for `mail_uid`. ```doveconf[dovecot.conf] mail_uid = vmail service fs-auth { unix_listener fs-auth { user = vmail } } ``` #### IAM Authentication in EC2 A requirement for using IMDSv2 is that Dovecot is running on an AWS EC2 instance, otherwise the IMDS will not be reachable. Additionally an IAM role must be configured which allows trusted entities, EC2 in this case, to assume that role. The role (for example `s3access`) that will be assumed must have the `AmazonS3FullAccess` policy attached. The `auth_role` can be configured as a URL parameter which specifies the IAM role to be assumed. If no `auth_role` is configured, no IAM lookup will be done. ::: details More Information for IAM on EC2 * [IAM roles for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) * [IAM UserGuide](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) ::: #### IAM Authentication in EKS When using EKS and IRSA, Dovecot is using environment variables provided to the backend pods to acquire temporary credentials using the `AssumeRoleWithWebIdentity` API by the AWS Security Token Service (STS). To allow Dovecot access to these variables, [[setting,import_environment]] must be configured accordingly: ```doveconf[dovecot.conf] import_environment { AWS_REGION = $ENV:AWS_REGION AWS_ROLE_ARN = $ENV:AWS_ROLE_ARN AWS_WEB_IDENTITY_TOKEN_FILE = $ENV:AWS_WEB_IDENTITY_TOKEN_FILE } ``` To allow the `AssumeRoleWithWebIdentity` call to successfully assume a Role and fetch temporary credentials an IAM role with the "AssumeRole" policy from a Service Account must be configured. The Service Account must be assigned to the backend pods that will call the STS API. The `auth_role` is used as `RoleSessionName`, it can be freely chosen when running in EKS. The role name can be viewed by administrators to help identify who performed an action in AWS. See [sts:RoleSessionName](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html#ck_rolesessionname) for more details on the `RoleSessionName`. ::: details More Information for IAM on EKS * [Identity and access management for Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/security-iam.html) * [Assign IAM roles to Kubernetes service accounts](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) ::: ### Manual Authentication Get `ACCESSKEY` and `SECRET` from "AWS -> My account -> Security credentials -> Access credentials". Create the `BUCKETNAME` "from AWS Management Console -> S3 -> Create Bucket". If the `ACCESSKEY` or `SECRET` contains any special characters, they can be %hex-encoded. ## Partition Prefix AWS S3 used to recommend having explicit partition prefixes for better distributing the S3 load. However, this is no longer necessary. AWS automatically creates the prefixes as needed and rebalances the data. (See [Best Practices Design Patterns: Optimizing Amazon S3 Performance][aws-optimizing-performance]). ### Partition Behavior When a S3 bucket is created, AWS creates a single shared partition for the bucket with a default limit of 3,500 requests/second for PUTs/DELETEs/POSTs and 5,500 requests/second for GETs. This 3,500 TPS limit is generally too small and quickly surpassed by Dovecot obox installations, which results in a spike of `503: Slow Down` log events. AWS automatically eventually splits the partitions when reaching request limits. However, it's better to ask AWS support to split the partition early on before users see any errors. ## DNS AWS instances are known to react badly when high packets per second network traffic is generated. DNS lookups for S3 storage access can generate large numbers of requests. A local DNS caching system should be used in order to reduce the network load. ## AWS S3 API ### AWS S3 REST API Calls | `PUT /latest/api/token` (always sent to `169.254.169.254`) | Lookup operation for IMDSv2 token for IAM authentication (EC2 only). | | `GET /latest/meta-data/iam/security-credentials/` | Lookup operation for IAM credentials (EC2 only). | | `GET https://sts..amazonaws.com/`
`?Action=AssumeRoleWithWebIdentity`
`&DurationSeconds=3600`
`&RoleArn=`
`&RoleSessionName=`
`&WebIdentityToken=`
`&Version=2011-06-15` | Lookup operation for temporary IAM credentials via the AWS Security Token Service (EKS/IRSA only). The token is read from the file given by `AWS_WEB_IDENTITY_TOKEN_FILE`. The requested session duration of 1 hour (3600 seconds) matches the STS default. [AWS API](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) | ### AWS S3 Object ID Format ## Migration From Dovecot Pro 2.3.x Dovecot Pro 3 supports using AWS S3 only with [[link,dictmap]]. To allow the in-place migration of user data without the need to actually copy all user data fs-dictmap provides options and scripts to do so. See [[link,path_based_object_storages]] for more details on how to use path based object storages, like Amazon S3 with dictmap. The in-place migration can be done using the `storage-objectid-migrate` setting and the scripts `storage-objectid-migrate-mails.sh`, `storage-objectid-migrate-index.sh` to migrate indexes and mails. For more details refer to [[link,migrating_path_based_object_storages_to_dictmap]]. [aws-optimizing-performance]: https://docs.aws.amazon.com/AmazonS3/latest/dev/optimizing-performance.html> [aws-iam-roles]: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html [aws-iam-userguid]: https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html [troubleshooting]: https://docs.aws.amazon.com/AmazonS3/latest/API/RESTCommonResponseHeaders.html # Obox Storage Support: Azure :::: info It is recommended to use [[setting,@fs_defaults,azure]] to configure this provider. Using this setting will set these settings by default: ::: details Click to show settings ::: If you are using [[link,fts_dovecot_fs]] you should also set [[setting,@fts_fs_defaults,azure]], which expands to: ::: details Click to show settings ::: :::: ## Configuration There are different ways to authenticate with the Azure blob storage ### Authentication #### User SAS This is the preferred way to authenticate with Azure blob storage. It is using [Microsoft Entra](https://www.microsoft.com/en-us/security/business/microsoft-entra) credentials to authenticate. User Shared Access Signature (SAS) uses tenant-id, client-id and client_secret to authenticate to Microsoft Entra IDM via oauth2. With the Bearer token retrieved from https://login.microsoftonline.com a user-delegation-key is requested at ACCOUNT.blob.core.windows.net this key is requested with a limited lifetime. With these credentials User SAS token are generated and used to authenticate requests against the Azure blob storage. User SAS is enabled by setting [[setting,fs_azure_auth_type,user-sas]] and providing [[setting,fs_azure_account_name]], [[setting,fs_azure_user_sas_tenant_id]], [[setting,fs_azure_user_sas_client_id]] and [[setting,fs_azure_user_sas_client_secret]] settings alongside with `CONTAINER`. When using any SAS you must ensure that the `fs-auth` service has proper permissions/owner. Configure the user for the `fs-auth` listener to be the same as for [[setting,mail_uid]]. ```doveconf[dovecot.conf] fs_azure_container_name = CONTAINER #fs_azure_auth_type = user-sas # default fs_azure_account_name = ACCOUNT fs_azure_auth_user_sas_tenant_id = TENANT_ID fs_azure_auth_user_sas_client_id = CLIENT_ID fs_azure_user_sas_client_secret = BASE64_CLIENT_SECRET service fs-auth { unix_listener fs-auth { user = vmail } } ``` #### Prerequisites for using User SAS * Creating a resource group that will contain the storage account(s) used with Dovecot Pro; see `resourceGroup1` and `resourceGroup2` below * Having the correct subscription ID for the Resource groups you want to grant access on (To retrieve current subscription ID with azure cli, run `az account show --query id --output tsv`); see how the placeholder value `{{guid}}` is used below. * Creating a service principal for Dovecot Pro * Allow the service principal access to specific Azure resources There are different ways to configure the aforementioned prerequisites using the Azure Portal or Azure cli are probably the most well known. ##### Create a service principal and configure its access to Azure resources using azure cli This section is giving an example for how to Setup the needed credentials used with User SAS. It assumes that there already is a blob storage created as well as a Resource Group containing it. The following example uses the `az` command. This is the Azure Command-Line Interface (CLI) which can be used to execute execute administrative commands on Azure resources. See [for more details on how to use az, the Azure CLI tool](https://learn.microsoft.com/en-us/cli/azure/ad/sp?view=azure-cli-latest#az-ad-sp-create-for-rbac) for more details on how to run this command. Replace subscription ID placeholder "`{{guid}}`" with your subscription ID. ``` az ad sp create-for-rbac --name dovecot-pro-azure-auth \ --role "Storage Blob Data Contributor" \ --scopes /subscriptions/{{guid}}/resourceGroups/resourceGroup1 /subscriptions/{{guid}}/resourceGroups/resourceGroup2 ``` If successfully executed command will reply with the following fields: ``` "appId": "39c6f374-78f2-43e6-a7a0-376586891af0", // Generated client-id "displayName": "dovecot-pro-azure-auth", // The role name you choose "password": "dmVyeV9sb25nX3NlY3VyZV9wYXNzd29yZAo=", // Generated password (base64 encoded) "tenant": "f0a1bf88-062f-4751-bf32-df2e4daf8ded" // Generated tenant-id ``` This fields are to be used in the Dovecot Pro configuration: | Azure cli reply fields | Dovecot Pro Setting | | ---------------------- | ------------------- | | `appId` | [[setting,fs_azure_user_sas_client_id]] | | `password` | [[setting,fs_azure_user_sas_client_secret]] | | `tenant` | [[setting,fs_azure_user_sas_tenant_id]] | | `displayName` | `` | #### Service SAS Service SAS is enabled by setting [[setting,fs_azure_auth_type,service-sas]], and providing [[setting,fs_azure_account_name]] and [[setting,fs_azure_service_sas_secret]] to create SAS Tokens with a limited scope and validity. This can be used for testing with local Azure blob storage emulation. When using any SAS you must ensure that the `fs-auth` service has proper permissions/owner. Configure the user for the fs-auth listener to be the same as for [[setting,mail_uid]]. ```doveconf[dovecot.conf] fs_azure_container_name = CONTAINER fs_azure_auth_type = service-sas fs_azure_account_name = ACCOUNT fs_azure_service_sas_secret = BASE64_SHARED_KEY service fs-auth { unix_listener fs-auth { user = vmail } } ``` The `SHARED_KEY` should be passed base64 encoded as shown above (`SHARED_KEY_BASE64`). Additionally it needs to be %hex-encoded. ### Configuration Parameters ## Settings ### Default HTTP Settings `fs-azure` overrides some of the default HTTP client settings: * [[setting,http_client_max_idle_time,1s]] * [[setting,http_client_max_parallel_connections,10]] * [[setting,http_client_max_connect_attempts,3]] * [[setting,http_client_request_max_redirects,2]] * [[setting,http_client_request_max_attempts,5]] * [[setting,http_client_connect_backoff_max_time,1s]] * [[setting,http_client_user_agent,FS_HTTP_USER_AGENT]] * [[setting,http_client_connect_timeout,5s]] * [[setting,http_client_request_timeout,10s]] You can override these and any other HTTP client or SSL settings by placing them inside [[setting,fs_azure]] named filter. ### Example Configuration ::: warning All text indicated by `{{VARIABLE NAME}}` in the examples below **MUST** be replaced with your local configuration value(s). ::: ::: tip [[link,dictmap]] must also be configured to use this storage driver. ::: ```doveconf[dovecot.conf] mail_driver = obox mail_path = %{user} # Storage container name to use. fs_azure_container_name = {{CONTAINER}} # Azure account name for storage access. fs_azure_account_name = {{ACCOUNT}} # TenantId to be used for authentication against Entra IDM fs_azure_user_sas_tenant_id = {{TENANT_ID}} # ClientId to be used for authentication against Entra IDM fs_azure_user_sas_client_id = {{CLIENT_ID}} # Client secret to be used for authentication against Entra IDM (base64 encoded) fs_azure_user_sas_client_secret = {{CLIENT_SECRET}} fs_http_reason_header_max_length = 200 fs_compress_write_method = zstd obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_objectid_prefix = %{user}/mails/ #lock_path = /tmp # Set only without lazy_expunge plugin } fs azure { } } metacache { fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs azure { } } fts dovecot { fs fts-cache { } fs fscache { size = 512M path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs azure { } } ``` ## Azure Blob API Calls | URL | Notes | | --- | ----- | | `GET /CONTAINERNAME/` | Read operations to Azure blob storage | | `HEAD /CONTAINERNAME/` | Read metadata operations to Azure blob storage | | `PUT /CONTAINERNAME/?blockid=&comp=block` | Writing objects to Azure blob storage, objects bigger then 4 Mb are written in blocks | | `DELETE /CONTAINERNAME/` | Deleting objects from Azure blob storage | | `POST https://login.microsoftonline.com/TENANT_ID/oauth2/token` | Retrieve a Bearer token for Authentication with Entra IDM (User SAS only) | | `POST /?restype=service&comp=userdelegationkey` | Retrieve a user delegation key from the Azure blob storage (User SAS only) | ## Azure Object ID Format URI Path we write to: `////` | Key | Description | | --- | ----------- | | `` | From URL config (optional; empty if not specified) | | `` | Extracted from `azure` scheme URL | | `` | From the [[setting,mail_path]] setting. Recommended value (see XXX) gives two levels of dispersion of the format: `[0-9a-f]{2}/[0-9a-f]{3}` | | `` | Dovecot internal path to file. Example: `$user/mailboxes/$mailboxguid/$messageguid` | Internal Path Variables: | Variable | Description | | -------- | ----------- | | `$user` | Dovecot unique username (installation defined) | | `$mailboxguid` | 32 byte randomly generated UID defining a mailbox | | `$messageguid ` | 32 byte randomly generated UI defining a message blob | ## Debugging To be able to easily track requests outgoing from Dovecot and incoming from the Azure storage, the default configuration contains: ```doveconf[dovecot.conf] fs_http_log_headers { x-ms-request-id = yes x-ms-client-request-id = yes } ``` If `x-ms-client-request-id` header is logged, this additionally enables sending `x-ms-client-request-id` header in HTTP requests to Azure. This uses the current session-id, which allows to correlate Dovecot activities with requests that the server receives. The `x-ms-request-id` header is added by the Azure storage to identify individual requests. ## Dictmap: Cosmos DB As with all other object-storage drivers, Azure Blob storage requires [[link,dictmap,dictmap]] to do object IDs to Dovecot lib-fs mappings. [Cosmos DB](https://azure.microsoft.com/en-us/products/cosmos-db) is a service provided by Azure that advertises full Cassandra/CQL API compatibility. ::: warning Cosmos DB is not supported or tested by Open-Xchange, and cannot provide recommendations or operational advice. See [[link,dictmap_managed_services]]. The documentation provided here is based on feedback from customers that are using Azure Blob storage with Cosmos DB, and is for informational purposes only. ::: ### Page Size Cosmos DB has paging enabled by default, the Cassandra driver doesn't realize this without the [[setting,cassandra_page_size]] setting, leading to data loss. Thus Cosmos DB requires the [[setting,cassandra_page_size]] setting to be configured. ### Bucket Size Shrink fs-dictmap's [[setting,fs_dictmap_bucket_size]] from `10000` to `1000`, which distributes data across more Cosmos DB partitions. This is intended to reduce costs. # Obox Storage Support: NFS :::: info It is recommended to use [[setting,@fs_defaults,nfs]] to configure this provider. Using this setting will set these settings by default: ::: details Click to show settings ::: If you are using [[link,fts_dovecot_fs]] you should also set [[setting,@fts_fs_defaults,nfs]], which expands to: ::: details Click to show settings ::: :::: ## Prerequisites To use Obox over NFS you need at least NFSv3 capable storage shared to all your backends. All your hosts must be using clock syncronization. Not using clock synchronization will cause problems. Mail delivery must be set to use LMTP for deliveries. ## Setting up You need to provision NFS shares, either all in one, or one for mail, and one for indexes. FTS indexes can be stored in same place as indexes. Recommendation is to have FTS and index shares on fast disk and mail storage can be on slower disk. If all the disks are fast, you can also have all on same share. ## Configuration Assumptions: * `/var/cache/mails` filesystem is either tmpfs or a fast local disk * `/var/cache/fts` filesystem is either tmpfs or a fast local disk * `/data` is the NFS mountpoint ::: code-group ```doveconf[Recommended, dovecot.conf] # Path for obox mails and metacache index bundles under fs_posix_prefix. # Use 256 hash directories for users stored in NFS. # Note that FTS needs its own separate configuration. mail_path = %{user | sha1 % 256 | hex(2)}/%{user} # Local metacache directory. Don't place this to NFS. Also, it doesn't have to # have the same directory hierarchy as mail_path. mail_home = /var/vmail/%(user | sha1 % 256 | hex(2)}/%{user} @fs_defaults = nfs obox { fs posix { prefix = /data/mails/ } } @fts_fs_defaults = nfs fts dovecot { fs posix { # Use 256 hash directories for users stored in NFS prefix = /data/mails/fts/%{user | sha1 % 256 | hex(2)}/%{user}/ } } ``` ```doveconf[Recommended with split mails and indexes, dovecot.conf] # Path for obox mails and metacache index bundles under fs_posix_prefix. # Use 256 hash directories for users stored in NFS. # Note that FTS needs its own separate configuration. mail_path = %{user | sha1 % 256 | hex(2)}/%{user} # Local metacache directory. Don't place this to NFS. Also, it doesn't have to # have the same directory hierarchy as mail_path. mail_home = /var/vmail/%(user | sha1 % 256 | hex(2)}/%{user} @fs_defaults = nfs obox { fs posix { prefix = /data/mails/ } } metacache { fs posix { prefix = /data/index/ } } @fts_fs_defaults = nfs fts dovecot { fs posix { # Use 256 hash directories for users stored in NFS prefix = /data/fts/%{user | sha1 % 256 | hex(2)}/%{user}/ } } ``` ```doveconf[Explicit, dovecot.conf] # Path for obox mails and metacache index bundles under fs_posix_prefix. # Use 256 hash directories for users stored in NFS. # Note that FTS needs its own separate configuration. mail_path = %{user | sha1 % 256 | hex(2)}/%{user} # Local metacache directory. Don't place this to NFS. Also, it doesn't have to # have the same directory hierarchy as mail_path. mail_home = /var/vmail/%(user | sha1 % 256 | hex(2)}/%{user} fs_compress_write_method = zstd obox { fs fscache { path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log size = 512 M } fs compress { } fs crypt { } fs metawrap { } fs posix { prefix = /data/mails/ } } metacache { fs compress { } fs crypt { } fs metawrap { } fs posix { prefix = /data/index/ } } fts dovecot { fs fts-cache { } fs fscache { path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log size = 512 M } fs compress { } fs crypt { } fs metawrap { } fs posix { # Use 256 hash directories for users stored in NFS prefix = /data/fts/%{user | sha1 % 256 | hex(2)}/%{user}/ } } ``` ::: It is recommended to use encryption and compression with obox and fts indexes for security and performance reasons. See [[link,obox_configuration]]. ::: warning If you **do not** use [[setting,@fs_defaults,nfs]] or [[setting,@fts_fs_defaults,nfs]], you must remember to include [[link,fs_metawrap,fs metawrap]] before [[link,fs_posix,fs posix]]. Not using metawrap can cause severe performance issues. ::: ## NFS tuning NFS has many tunings, please consult your NFS vendor for details. For Dovecot, these are strongly recommended: - `actimeo=60`: This or the more specific settings can be used to control NFS caching. Increasing this can reduce NFS traffic. It should be at least 60 seconds. - `nordirplus`: Disable readdirplus operations, which aren’t needed by Dovecot. They can also slow down some NFS servers. - `noatime`: Disable updating atime. Dovecot doesn’t need this and it may slow down NFS servers. - `root_squash`: Dovecot doesn’t care about this. Typically Dovecot doesn’t store any root-owned files in NFS. - `nolock` / `local_lock=all`: Dovecot obox format doesn't care about this. There are no locks used on NFS server side. # Obox Storage Support: S3 Compatible :::: info It is recommended to use [[setting,@fs_defaults,s3]] to configure this provider. Using this setting will set these settings by default: ::: details Click to show settings ::: If you are using [[link,fts_dovecot_fs]] you should also set [[setting,@fts_fs_defaults,s3]], which expands to: ::: details Click to show settings ::: :::: ::: warning Dovecot Pro/obox only directly supports the S3 service as provided directly by [[link,aws_s3,Amazon Web Services (AWS)]]. Dovecot Pro has a lower-tier of SLA support for other "S3-compatible" systems, but it is the customer's responsibility to ensure that system adequately implements the same behavior as AWS's S3 service. S3 is not defined as an official protocol or API. "S3-compatible" systems attempt to replicate AWS's service offering. ::: ## Dictmap Palomar with S3 Compatible storage requires [[link,palomar_storage_dictmap]]. Managed services exist that provide the necessary CQL infrastructure on AWS, such as [DataStax Astra DB](https://www.datastax.com/platform/amazon-web-services) or [ScyllaDB Cloud](https://www.scylladb.com/product/scylla-cloud/). OX does not support configuration or operation of these managed services, and cannot provide recommendations or operational advice. ::: danger UNSUPPORTED [AWS Keyspaces](https://aws.amazon.com/keyspaces/) cannot be used with Dovecot Pro as it lacks support for certain Dovecot-required Cassandra features. ::: ## Configuration S3 Compatible storage uses the `s3` scheme for configuration: ```doveconf[dovecot.conf] fs_s3_url = https://s3.example.com/ fs_s3_access_key = ACCESSKEY fs_s3_secret = SECRET ``` ### S3 Example Configuration ::: warning All text indicated by `{{VARIABLE NAME}}` in the examples below **MUST** be replaced with your local configuration value(s). ::: ::: tip [[link,dictmap]] must also be configured to use this storage driver. ::: ```doveconf[dovecot.conf] mail_driver = obox mail_path = %{user} fs_s3_url = https://{{S3_STORAGE_URL}}/ fs_s3_access_key = {{ACCESSKEY}} fs_s3_secret = {{SECRET}} fs_s3_bucket = mails fs_s3_region = region fs_s3_auth_role = s3access fs_compress_write_method = zstd obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_objectid_prefix = %{user}/mails/ #lock_path = /tmp # Set only without lazy_expunge plugin } fs s3 { } } metacache { fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs s3 { } } fts dovecot { fs fts-cache { } fs fscache { size = 512M path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } storage_passthrough_paths = full } fs s3 { } } ``` ## Settings ## S3 API ### S3 REST API Calls S3 Compatible servers must match the API behavior of [[link,aws_s3_api]] (without IAM): ### S3 Object ID Format # Obox Storage Support: Scality (sproxyd) :::: info It is recommended to use [[setting,@fs_defaults,sproxyd]] to configure this provider. Using this setting will set these settings by default: ::: details Click to show settings ::: If you are using [[link,fts_dovecot_fs]] you should also set [[setting,@fts_fs_defaults,sproxyd]] ::: details Click to show settings ::: :::: ## Configuration ### Authentication HTTP Basic authentication can be configured as part of the [[setting,fs_sproxyd_url]]. URL escaping is used, so if password is `foo/bar` the URL is `http://user:foo%2fbar@example.com/`. ```doveconf[dovecot.conf] obox { fs sproxyd { fs_sproxyd_url = https://user:foo%2fbar@example.com/ # password is foo/bar } } ``` ### Example Configuration ::: warning All text indicated by `{{VARIABLE NAME}}` in the examples below **MUST** be replaced with your local configuration value(s). ::: ::: tip [[link,dictmap]] must also be configured to use this storage driver. ::: ```doveconf[dovecot.conf] mail_driver = obox mail_path = %{user} # SPROXYD_SCALITY_URL: The URL to the sproxyd interface. fs_sproxyd_url = http://{{SPROXYD_SCALITY_URL}} fs_sproxyd_class = 2 fs_http_reason_header_max_length = 200 fs_compress_write_method = zstd obox { fs fscache { size = 512M path = /var/cache/mails/%{user | sha1 % 4} log_path = /var/cache/mails-%{user | sha1 % 4}.log } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } #lock_path = /tmp # Set only without lazy_expunge plugin } fs sproxyd { } } metacache { fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } } fs sproxyd { } } fts dovecot { fs fts-cache { } fs fscache { size = 512M path = /var/cache/fts/%{user | sha1 % 4} log_path = /var/cache/fts-%{user | sha1 % 4}.log } fs compress { } fs dictmap { dict proxy { name = cassandra socket_path = dict-async } } fs sproxyd { # It may be OK to store fewer copies of FTS indexes, because they can # be rebuilt if they become completely lost. class = 1 } } ``` ## Settings ### Default HTTP Settings `sproxyd` overrides some of the default HTTP client settings: * [[setting,http_client_max_idle_time,1s]] * [[setting,http_client_max_parallel_connections,10]] * [[setting,http_client_max_connect_attempts,3]] * [[setting,http_client_request_max_redirects,2]] * [[setting,http_client_request_max_attempts,5]] * [[setting,http_client_connect_backoff_max_time,1s]] * [[setting,http_client_user_agent,Dovecot/VERSION]] * [[setting,http_client_connect_timeout,5s]] * [[setting,http_client_request_timeout,10s]] You can override these and any other HTTP client or SSL settings by placing them inside [[setting,fs_sproxyd]] named filter. ## `sproxyd` API See [Scality sproxyd][scality-sproxyd]. ## sproxyd Object ID Format Dovecot uses its own Scality key format, which encodes the object type also to the key itself. ### Key Format (160 bits) | Size | Description | | ---- | ----------- | | 152 bits | Entropy | | 4 bits | Class | | 4 bits | Replica | #### "Entropy" Component Definition of entropy component of Scality's Universal Key Scheme (UKS): | Size | Description | | ---- | ----------- | | 24 bits | Dispersion (**important**) | | 64 bits | Object ID | | 32 bits | Volume ID | | 8 bits | Service ID (**important**) | | 24 bits | App-specific | So if we use 128 bit MD5 of the GUID as our unique key, this means we can do: | Size | Description | | ---- | ----------- | | 8 bits | Service ID = `FS_SPROXYD_SERVICE_ID_DOVECOT = 0x83` | | 8 bits | MD5 part suffix | | 8 bits | Object type (*see below*) | | 8 bits | Unused (`0x00`) | | 4 bits | Class ID (configurable) | | 4 bits | Replica ID (`0x00`) | Where "object type" is: | Internal Type | Value | | ------------- | ----- | | `FS_SPROXYD_OBJECT_TYPE_UNKNOWN` | `0x00` | | `FS_SPROXYD_OBJECT_TYPE_MAIL` | `0x01` | | `FS_SPROXYD_OBJECT_TYPE_OLD_FTS_INDEX` | `0x02` | | `FS_SPROXYD_OBJECT_TYPE_FTS_INDEX` | `0x03` | | `FS_SPROXYD_OBJECT_TYPE_USER_INDEX_SELF` | `0x08 \| 0x01` | | `FS_SPROXYD_OBJECT_TYPE_USER_INDEX_BASE` | `0x08 \| 0x02` | | `FS_SPROXYD_OBJECT_TYPE_USER_INDEX_DIFF` | `0x08 \| 0x03` | | `FS_SPROXYD_OBJECT_TYPE_BOX_INDEX_SELF` | `0x08 \| 0x04 \| 0x01` | | `FS_SPROXYD_OBJECT_TYPE_BOX_INDEX_BASE` | `0x08 \| 0x04 \| 0x02` | | `FS_SPROXYD_OBJECT_TYPE_BOX_INDEX_DIFF` | `0x08 \| 0x04 \| 0x03` | For listing index objects, these can be helpful masks: | Internal Type | Value | | -------------- | ----- | | `FS_SPROXYD_OBJECT_TYPE_BIT_INDEX` | `0x08` | | `FS_SPROXYD_OBJECT_TYPE_BIT_BOX_INDEX` | `0x04` | | `FS_SPROXYD_OBJECT_TYPE_BIT_DIFF_OR_SELF` | `0x01` | ### Utility Script The [[man,scality-keys]] script installed with the obox package takes a 160bit hex-encoded sproxyd Scality ID as input and outputs the object type. [scality-sproxyd]: https://documentation.scality.com/RING/latest/reference/connectors/sproxyd/index.html # Cassandra - Operation timed out For example: ``` Query 'SELECT i,n FROM dovecot.user_mailbox_objects WHERE u = '1@2' AND g = 0xc92f64f79f0d1ed01e6d5b314f04886c AND b = 0' failed: Operation timed out - received only 0 responses. ``` This typically means that there are too many tombstones. Dovecot is supposed to prevent this from happening by dividing mails into buckets that have maximum of 10k messages. However, that doesn't always work perfectly. There are two common possibilities for the "Operation timed out": * There are so many tombstones that Cassandra is too slow to go through them all and give a response. This will trigger a timeout on Cassandra side. You may get a warning in Cassandra logs about it, e.g.: ``` ReadCommand.java:569 - Read 6 live rows and 50000 tombstone cells for query ... ``` * There are so many tombstones that Cassandra reaches the maximum number of tombstones before the query is aborted. Cassandra logs about it, e.g.: ``` MessageDeliveryTask.java:76 - Scanned over 100001 tombstones during query ...; query aborted ``` If the query doesn't fail entirely / always, you can use `TRACING ON;` in `cqlsh` before running the `SELECT` to see what it reports. ## Maximum Tombstones Reached If Cassandra reaches `tombstone_failure_threshold` (in `cassandra.yaml`, default: 100000) the query processing is stopped and an error is logged by Cassandra. This is still visible to Dovecot as "Operation timed out". Potential solutions: * [[link,cassandra_tombstones_compact,Compact away the tombstones]] * Increase `tombstone_failure_threshold` ## Query Timeout If Cassandra reaches read timeout in processing, the query fails with "Operation timed out". Potential solutions: * [[link,cassandra_tombstones_compact,Compact away the tombstones]] * Enable Cassandra paging with [[setting,cassandra_page_size]]. This should tell Cassandra servers to send the output in smaller chunks and prevent the timeout. Of course, going through the pages can still take a long time. * Increase Cassandra read timeout. On Dovecot side this is controlled by the [[setting,cassandra_request_timeout]] setting in. However, this can't be set higher than `read_request_timeout` (or `read_request_timeout_in_ms`) in Cassandra server's `cassandra.yaml`. ## Compact Tombstones To remove the tombstones immediately: * Shrink `gc_grace_seconds` in the affected Cassandra table to a small enough value. It needs to be lower than the tombstone creation time. * Run Cassandra compaction (`nodetool compact`). * Grow `gc_grace_seconds` back to the original value. It may be useful to shrink `gc_grace_seconds` permanently. Its idea is to prevent zombie rows from coming back to life when Cassandra nodes are out of service for a while. However, most installations already see these zombie rows anyway and [[link,obox_troubleshooting_object_exists_in_dict_but_not_in_storage,have ways to handle them]]. # Deduplicate email objects via storage In situations where there are tens of millions of emails in a single folder obox might crash. To start fixing up the situation safely, duplicate GUIDs can be deleted directly using the object storage operations: ::: warning It may not be safe to run 5-8) multiple times without some further changes, because on the next run it might decide to leave a different already deleted mail object as the non-deleted one, causing all the mails to be deleted. Also it would try to re-delete already deleted mails. This could be fixable by updating `all-mails.txt` and deleting `metadata.*` for mails that were deleted. ::: ::: tip To make sure this procedure isn't a waste of time (and to monitor progress), you can run steps 5-6) while 4) is still running. You can see in `duplicate-guids.txt` where it's finding lots of duplicates or not. Once step 4) is finished, run 5-6) steps again and finish with 7-8). ::: 1. `cd` into some directory which you won't lose easily. This will contain a local copy of all the mails' metadata. 1. Get list of all mail objects: ```sh doveadm mail fs iter -u user@example user@example/mailboxes/$mailbox_guid > all-mails.txt ``` 1. Verify that `all-mails.txt` contains all of the relevant entries (compare lines in file with number of emails): ```sh wc -l all-mails.txt ``` 1. Save metadata for all mail objects locally (this could take days): ```sh while read oid; do doveadm mail fs metadata -u user@example obox user@example/mailboxes/$mailbox_guid/$oid > metadata.$oid done < all-mails.txt ``` While it's running, verify that the `metadata.*` files' contents look reasonable. Especially verify that they contain a line such as: "guid=00410a00f49fa463fe5e2c0071396a78" 1. Get a list of "email-GUID OID" lines sorted by GUIDs: ```sh find . -name 'metadata.*' | while read fname; do grep '^guid=' $fname | sed 's/guid=//' | tr -d '\n' echo $fname | sed 's:^\./metadata\.: :' done | sort > guid-oid.txt ``` 1. Show a list of GUIDs that exist multiple times as OIDs: ```sh cat guid-oid.txt | cut -d ' ' -f 1 | sort | uniq -cd > duplicate-guids.txt ``` You can also see from the first number how many such duplicates there are. 1. Get a list of duplicate OIDs that need to be deleted. One of the OIDs is left undeleted: ```sh cat duplicate-guids.txt | awk '{print $2}' | while read guid; do grep "^$guid " guid-oid.txt | sed "s/^$guid //" | tail -n +2 done > delete-oids.txt ``` 1. Delete these duplicate OIDs: ```sh cat delete-oids.txt | while read oid; do doveadm mail fs delete -u user@example obox user@example/mailboxes/$mailbox_guid/$oid done ``` You may also want to use [[doveadm,mail fs metadata]] and [[doveadm, mail fs get]] commands to save a backup of the mail before deleting it, in case anything went wrong. # `doveadm mail fs` The object storage can be used to access with [[man,doveadm-fs]] and [[man,doveadm-mail-fs]] commands. The [[man,doveadm-mail-fs]] commands perform userdb lookup to get any user-specific (storage) settings. ## How to get `storage_user` `storage_user` is the user key which represents/identifies a user in cassandra tables for obox. This is typically some kind of a unique identifier, which is different from user@domain email address. It is set in the [[link,userdb]] by replacing/overriding the `user` field. Below snippet is an example of replacing `user` field with a user attribute `userUUID` in LDAP configuration: ```doveconf[dovecot.conf] userdb ldap { ldap_filter = (&(mail=%{user})(objectClass=mailAccount)) fields { # => user is replaced by the userUUID attribute in LDAP user = %{ldap:userUUID}, quota_storage_size = %{ldap:quota}B ... } } ``` If there is no such `user` replacement in the userdb, `storage_user` is identical to the user login id (typically mail address). You can see the `storage_user` using [[doveadm,user]]: ```sh doveadm user -f user testuser@example.net 4e353905-a9fa-5aaa-974a-01d8f03aebf2 ``` ## Common `doveadm mail fs` samples ### Command line samples for mailbox #### Iterating mailboxes (get list of mailbox guids) You use [[doveadm,mail fs iter-dirs]] with `metacache` parameter: ```sh doveadm mail fs iter-dirs -u metacache /mailboxes/ ``` Command-line ex.1: if `` is `testuser@example.net` and its `storage_user` is same as the username: ```sh doveadm mail fs iter-dirs -u testuser@example.net metacache testuser@example.net/mailboxes/ ``` Command-line ex.2: if `` is `testuser@example.net` and its `storage_user` is `4e353905-a9fa-5aaa-974a-01d8f03aebf2`: ```sh doveadm mail fs iter-dirs -u testuser@example.net metacache 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/ ``` Below is an example command line and its output when username is `testuser@example.net` and its `storage_user` has the UUID `4e353905-a9fa-5aaa-974a-01d8f03aebf2`: ```sh # For , use "{storage_user}/mailboxes/" doveadm mail fs iter-dirs -u testuser@example.net metacache 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/ 08e3d21425d5a861b97c0000fb67425d 78519d25d9a0a861432d0000fb67425d 78a3011a1ed5a861b27c0000fb67425d 8068212321d5a861b57c0000fb67425d b39cd138716aa961800c0000fb67425d ``` You see above that it prints mailbox-GUIDs (`08e3d21425d5a861b97c0000fb67425d`, `78519d25d9a0a861432d0000fb67425d`, ...) for those mailboxes the user has. #### Finding/Iterating mailbox index bundle(s) for a mailbox (then download to local and unpack) - You use [[doveadm,mail fs iter]] with `metacache` to iterate mailbox index-bundle(s), - then you use [[doveadm,mail fs get]] to download index-bundle from the `iter` output, - you can unpack the index-bundle using [[doveadm,metacache unpack]], and then - run [[doveadm,dump,-t index ...]]. Below is an example when username is `testuser@example.net` and its `storage_user` is in UUID `4e353905-a9fa-5aaa-974a-01d8f03aebf2`: ```sh # For , use "{storage_user}/mailboxes/{mailbox-GUID}/idx/" doveadm mail fs iter -u testuser@example.net metacache 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/2819a631168aa8611c7a0000fb67425d/idx/ bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. ``` The resulting `bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt.` index-bundle is a `self-bundle` as implied by the trailing dot. See the [[man,fname-parse]] script for a convenient way to find out the type and creation timestamp of a bundle. You can download that index-bundle using [[doveadm,mail fs get]]: ```sh # For , use "{storage_user}/mailboxes/{mailbox-GUID}/idx/{bundle-name}" doveadm mail fs get -u testuser@example.net metacache \ 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/2819a631168aa8611c7a0000fb67425d/idx/bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. \ > /tmp/tempfile-for-self-bundle ``` Then you can unpack the downloaded index-bundle to a temp directory, and run [[doveadm,dump]]: ```sh # create a directory where the index-bundle will be unpacked to mkdir /tmp/unpack-dir # use 'doveadm metacache unpack' to unpack bundle doveadm metacache unpack /tmp/tempfile-for-self-bundle /tmp/unpack-dir # then dump it doveadm dump -t index /tmp/unpack-dir ``` When the mailbox has both base index-bundle and diff-index-bundle, both will be shown like below (mailbox-GUID `78519d25d9a0a861432d0000fb67425d`). ```sh # For , use "{storage_user}/mailboxes/{mailbox-GUID}/idx/" doveadm mail fs iter -u testuser@example.net metacache 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/78519d25d9a0a861432d0000fb67425d/idx/ bundle.61a8d665.2cd53.380cf20a65d6a8618b7d0000fb67425d ``` `bundle.61a8d665.2cd53.380cf20a65d6a8618b7d0000fb67425d-e881a13576d7a8617b7d0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt` is a `diff-bundle`. You download both base- and diff- bundles using [[doveadm,mail fs get]]: ```sh # is {storage_user}/mailboxes/{mailbox-GUID}/idx/{bundle-name} # download base index-bundle doveadm mail fs get -u testuser@example.net metacache \ 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/78519d25d9a0a861432d0000fb67425d/idx/bundle.61a8d665.2cd53.380cf20a65d6a8618b7d0000fb67425d > /tmp/tmp-for-base # download diff index-bundle doveadm mail fs get -u testuser@example.net metacache \ 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/78519d25d9a0a861432d0000fb67425d/idx/bundle.61a8d665.2cd53.380cf20a65d6a8618b7d0000fb67425d-e881a13576d7a8617b7d0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eip \ > /tmp/tmp-for-diff ``` Then unpack them, in the order base-bundle then diff-bundle and [[doveadm,dump]]: ```sh mkdir /tmp/unpack-dir # unpack base bundle doveadm metacache unpack /tmp/tmp-for-base /tmp/unpack-dir # unpack diff bundle on top of base (you cannot unpack diff alone if base is not unpacked yet) doveadm metacache unpack /tmp/tmp-for-diff /tmp/unpack-dir # then dump it doveadm dump -t index /tmp/unpack-dir ``` #### `doveadm mail fs stat` and `doveadm mail fs metadata` to bundle [[doveadm,mail fs stat]] for index-bundle (it looks its output is `size=...` only): ```sh # is {storage_user}/mailboxes/{mailbox-GUID}/index/{bundle-name} # same to doveadm mail fs get doveadm mail fs stat -u testuser@example.net metacache \ 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/2819a631168aa8611c7a0000fb67425d/idx/bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/2819a631168aa8611c7a0000fb67425d/idx/bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. size=768 ``` [[doveadm,mail fs metadata]] for index-bundle, metadata (:X-Dovecot-fs...., username, size, mailbox-guid, ...) is in the output: ```sh # is {storage_user}/mailboxes/{mailbox-GUID}/index/{bundle-name} # same to doveadm mail fs get doveadm mail fs metadata -u testuser@example.net metacache \ 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/2819a631168aa8611c7a0000fb67425d/idx/bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. :/X-Dovecot-fs-api-OrigPath=4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/2819a631168aa8611c7a0000fb67425d/idx/bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. username=4e353905-a9fa-5aaa-974a-01d8f03aebf2 size=1680 mailbox-guid=2819a631168aa8611c7a0000fb67425d fname=bundle.61a893ab.4c6f8.c338a912ab93a861717b0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. ``` ### Command line samples for user index #### Iterating user indexes You use [[doveadm,mail fs iter]] with `metacache` parameter: ```sh # is {storage_user}/idx/ doveadm mail fs iter -u testuser@example.net metacache 4e353905-a9fa-5aaa-974a-01d8f03aebf2/idx/ bundle.61a96b9e.25a31.684f30099e6ba961180c0000fb67425d.dovebe%2dbnd%2dcb001%2edovebe%2eipt. ``` This returns the `self-bundle` for the user-index. ### Command line samples for mail objects #### Iterating mail objects ::: info You cannot get the bucket-id easily. If the number of mails in a mailbox is small, you can assume that bucket-id is zero. But if there are many mails in a mailbox (more than approximately 10.000), or after many mails have been expunged so that bucket-id is not zero you can not know what bucket-id a mail is in. ::: You use [[doveadm,mail fs iter]] with `obox` parameter: ```sh # is {storage_user}/mailboxes/{mailbox-GUID}/{bucket-id}/ doveadm mail fs iter -u testuser@example.net obox \ 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/3839a60b4685a861bc790000fb67425d/0/ 28d6f0154685a861bc790000fb67425d # OID of mail object 487ea534bb97a861567c0000fb67425d 70c75739bd97a8615a7c0000fb67425d b83dfb36ba97a861517c0000fb67425d e02a950abd97a861587c0000fb67425d ``` #### Downloading a mail object You use [[doveadm,mail fs get]] with `obox` parameter: ```sh # is {storage_user}/mailboxes/{mailbox-GUID}/{bucket-id}/{OID} doveadm mail fs get -u testuser@example.net obox \ 4e353905-a9fa-5aaa-974a-01d8f03aebf2/mailboxes/3839a60b4685a861bc790000fb67425d/0/28d6f0154685a861bc790000fb67425d > /tmp/mail-file ``` ### Command line samples for fts indexes #### Iterating fts objects You use [[doveadm,mail fs iter]] with `fts/dovecot` parameter: ```sh # is "" (empty) doveadm mail fs iter -u testuser@example.net fts/dovecot "" fts.D_62fb830256d2a861c5560000fb67425d.00000174-000004cc.0001 fts.D_64e7d91038d2a861c5560000fb67425d.000003b3-00001358.0001 fts.D_6d6c562fb9d1a86169550000fb67425d.00000980-0000505c.0001 fts.D_792dea2e41d6a8617a7d0000fb67425d.000000ab-00000200.0001 fts.L_62fb830256d2a861c5560000fb67425d.00000174-000600ae.0001 fts.L_64e7d91038d2a861c5560000fb67425d.000003b3-001a02f2.0001 fts.L_6d6c562fb9d1a86169550000fb67425d.00000980-006e0c76.0001 fts.L_792dea2e41d6a8617a7d0000fb67425d.000000ab-0001cbeb.0001 fts.W_62fb830256d2a861c5560000fb67425d.00000174-00001ddc.0001 fts.W_64e7d91038d2a861c5560000fb67425d.000003b3-00001ddc.0001 fts.W_6d6c562fb9d1a86169550000fb67425d.00000980-00001ddc.0001 fts.W_792dea2e41d6a8617a7d0000fb67425d.000000ab-00001de8.0001 ``` #### Downloading an fts object You use [[doveadm,mail fs get]] with `fts/dovecot` parameter: ```sh # is simply a fts object name doveadm mail fs get -u testuser@example.net fts/dovecot fts.D_62fb830256d2a861c5560000fb67425d.00000174-000004cc.0001 > /tmp/fts-D-file ``` # Find lost objects on Scality The obox package contains a script `scality-find-lost-objects.pl` that looks up the objects from Scality by fetching the HEAD using `curl --head`. If the objects can be found in Scality they are then retrieved from Cassandra with [[doveadm,dict get]]. ::: info The default Scality URL to retrieve the objects from is `http://localhost:801`. You may have to change this by editing the line `my $HOST = "localhost:801";` in the script to your specific setup. ::: ## Input The script expects a list of object IDs via stdin, each one on a separate line. ## Output Depending on its result the following results are possible: - OK: Scality object exists and matches Cassandra object, - Mismatch: Scality object exists but does not match Cassandra object, - Error: [[doveadm,dict get]] returned with a non-zero status code, - Not Found: The scality object was not found in Cassandra. Additionally the following general errors might occur: - Scality does not contain the given object ID, - Scality returned no valid response for the given object ID, - Scality returned a valid response but it doesn't contain a valid index file in Cassandra. # Fixing folder list index (dovecot.list.index) Dovecot is supposed to fix `dovecot.list.index*` files automatically. If for whatever reason there is some error that Dovecot can't fix automatically, it's possible to rebuild the indexes from scratch. This should be possible without losing the folder names, because the latest folder names are stored in the per-folder indexes as well. ::: warning This operation shouldn't lose any folder names because of the 1. step below, but for extra safety get a copy of the `dovecot.list.index*` files so no matter what happens, the folder names are still possible to recover later on. ::: 1. Access the user's all folders to make sure the folder names exist in the folder indexes: ```sh doveadm fetch -u user@domain uid 1 > /dev/null ``` 1. Take a copy of folder indexes: ```sh cp dovecot.list.index* /some/backup/ ``` 1. Open IMAP session for user to make sure it's not removed from metacache: ```sh doveadm exec imap -u user@domain ``` 1. While IMAP session is open, delete indexes: ```sh rm dovecot.list.index* ``` 1. ```sh doveadm force-resync -u user@domain '*' ``` 1. Make sure the folders are properly shown without errors and without having lost any folders: ```sh doveadm mailbox list -u user@domain ``` # Index rescan/rebuild When a folder is accessed for the first time within the backend or the first time after the folder is accessed after it was cleaned up from metacache dovecot may log "info" level messages such as: ``` Info: obox INBOX: Rescanned index in testuser/mailboxes/c92f64f79f0d1ed01e6d5b314f04886c: 0 new mails, 0 mails lost, 100 kept (iter took 0.003 secs + 0 GUID lookups in 0.000 secs) ``` Similar "warning" level messages are logged when something unexpected happens. It should always be preceded by an error message: ``` Warning: obox INBOX: Rebuilt index in testuser/mailboxes/c92f64f79f0d1ed01e6d5b314f04886c: 4 new mails, 1 mails lost, 3 kept (iter took 0.033 secs + 4 GUID lookups in 0.075 secs) ``` Message parts: - new mails: These mails were found from Cassandra, but not from `dovecot.index`. They're added to index. - mails lost: These mails were found from `dovecot.index`, but not from Cassandra. They're assumed to be expunged, so they're removed from index. - kept: These mails were found from both `dovecot.index` and Cassandra. Nothing is done for them. - assumed temporarily lost: These mails were found from Cassandra, but not from `dovecot.index`. When sending a HEAD to Scality to find their GUID, Scality returned 404. Dovecot is now assuming that the mails are only temporarily lost in Scality and will come back later (due to some temporary problem like a split brain). Dovecot keeps rescanning the user every 30 mins until the mails are either gone from Cassandra or visible in Scality. If you're seeing these in logs, you should try to get rid of them since they're causing unnecessary Cassandra lookups. One way of doing this is to set [[setting,fs_dictmap_delete_dangling_links,yes]] when running [[doveadm,force resync]] (`doveadm -o fs_dictmap_delete_dangling_links=yes force-resync -u user INBOX`). - unexpectedly lost during resync: These mails were found from Cassandra, but not from `dovecot.index`. When sending a HEAD to Scality to find their GUID, Scality returned 404. Also the mail no longer existed in Cassandra. This shouldn't happen unless another Dovecot backend was deleting the user's mails at the same time. Can also happen with CDMI when Scality indexes are out of sync and [[obox,obox_autofix_storage,yes]]. # List all user's objects The [[man,obox-user-objects]] script is used to list all objects for a user. It uses [[doveadm,mailbox status]], so it's going to read the user's indexes into local metacache. ``` Usage: ./obox-user-objects.sh user[@domain] [storage-user] ``` # `recovered-lost-folder-*` folders ::: info - There is an automated fixup script in the obox package: [[man,recover-mailbox]] ::: Dovecot stores the list of folder GUID ↔ folder name mappings in `dovecot.list.index` and `dovecot.list.index.log` files as part of the user's root index bundle. If these files get lost or corrupted for any reason, the folder names may become lost. Dovecot writes the folder names also to the folder indexes (`dovecot.index*`) directly when the folder is opened. This means that when a folder is renamed, the new name is written to `dovecot.list.index` but not immediately to the folder's own index - that's delayed until the folder is opened for the next time. When opening the folder even though the name is immediately written to `dovecot.index*` files, the folder index bundle won't be uploaded to object storage until something else forces it to be flushed. In any case, eventually all folders should have their (usually up-to-date) names in the folder index bundles. When Dovecot finds that `dovecot.list.index` has become lost/corrupted, it starts fixing up the situation. First it lists all the folder GUIDs that exist in object storage and adds any missing ones to the `dovecot.list.index`. Initially it names them `recovered-lost-folder-`. Then it opens the lost folders, which causes Dovecot to look for the latest known folder name from the `dovecot.index*`. If it exists, the folder is renamed to the previous name. In some situations the folder may already exist - for example a new INBOX may have been autocreated before the fixup was fully finished. In this situation the folder is renamed to the `recovered-lost-folder-`, e.g. `INBOX-recovered-lost-folder-123456`. These can be fixed manually with doveadm: ```sh doveadm move -u user@domain INBOX-recovered-lost-folder-123456 mailbox INBOX all doveadm mailbox delete -e -u user@domain INBOX doveadm mailbox rename -u user@domain INBOX-recovered-lost-folder-123456 INBOX ``` The fixing is done in this direction, because the new INBOX folder is likely almost empty while the `INBOX-recovered-lost-folder-123456` might have a lot of mails. So it avoids moving potentially a huge number of mails to INBOX. Also if the fix is done early enough, it preserves the INBOX's IMAP UIDs so clients won't re-download mails. The `-e` parameter to [[doveadm,mailbox delete]] guarantees that the INBOX won't be deleted if there are any mails in it. It's possible that a newly arriving mail to INBOX causes the mailbox delete or rename to fail. In that case the commands need to be run again. If the folder name doesn't exist in `dovecot.index*` yet, there's nothing in Dovecot indexes that can be used to find out its correct name. However, Dovecot often logs about rescanning indexes and those log lines contain both the folder name and the folder GUID. By looking at the log files it's possible to find the missing names and fix them. For example: ``` Mailbox Drafts: Rescanned index in 1@2/mailboxes/a6a03ff3d6ec9066b46013f4affb109a: 0 new mails, 0 mails lost, 0 kept ``` If there are folders whose original names can't be found, they should be made visible to the user by subscribing to them, and let the user figure out the name: ```sh doveadm mailbox subscribe -u user@domain foldername ``` The `recovered-lost-folder-` prefix is configurable with [[obox,obox_lost_mailbox_prefix]] setting. There have been at least 4 known issues that causes the `dovecot.list.index*` corruption in the first place: - Various generic bugs (usually related to race conditions with other processes) in Dovecot's index file handling that causes it to think they are corrupted. These should have been fixed. - Accessing corrupted metacache after a server crash. Dovecot now correctly keeps track of server crashes and won't use potentially corrupted metacache. - If metacache filesystem runs out of disk space, it's possible that the index file error handling code doesn't work perfectly and thinks that the indexes are corrupted instead. These should have been fixed. - Using [[setting,quota_over_status]] but WITHOUT [[setting,quota_over_status_lazy_check,yes]] has a race condition that can cause the `dovecot.list.index*` to be deleted while they're still being used by other processes, which results in corruption. It would be a good idea to enable [[setting,quota_over_status_lazy_check,yes]] in any case. See [[setting,quota_over_status_lazy_check]]. This is still unfixed (DOP-128). It's possible that there are still bugs left, so whenever this still happens, please send us all logs (at least error/warning logs, preferably also all logs that show concurrent imap/pop3/lmtp accesses). We can then try to figure out based on the logs what could have caused it. ## Cassandra: Recovering folders invisible to force-resync [[doveadm,force resync]] (and folder list rebuilding in general) works by listing all rows for the user in the `user_mailbox_index_diff_objects` table. Normally this should list all folders that may have any mails. If for whatever reason a folder exists, but doesn't have a row in this table, it's invisible to the list rebuild. If a folder with a known GUID needs to be recovered, it can be done by inserting a row to the `user_mailbox_index_diff_objects` table: ```sql INSERT INTO user_mailbox_index_diff_objects (u, g, h, m) VALUES ('USERID', 0xc92f64f79f0d1ed01e6d5b314f04886c, 'recoveryhost', ''); ``` Afterwards [[doveadm,force resync]] will find the folder and create an index for it. The "recoveryhost" string can be anything really, and its row can be deleted after [[doveadm,force resync]]. The main problem is how to find the GUIDs: - Log files may contain the GUIDs when logging about rescanning a folder. - If full text search indexes are enabled, downloading all the `fts.D_*` files and dumping them may show the missing GUIDs. - It may be possible to find the user's old metacache files in one of the backends (where the user isn't currently active). Using `doveadm dump dovecot.list.index` will show the GUIDs. - It may be possible to find the user's old root index bundle objects in some way, [[doveadm,metacache unpack]] it and [[doveadm,dump,dovecot.list.index]] - For example: `grep` for PUTs for the user in HAProxy logs, filter out object IDs that aren't user root index bundles (see [[link,obox_sproxyd_object_id_format]]), undelete the object ID from Scality. - In a similar way, could also `grep` for folder index bundle PUTs, unpack the and doveadm dump to find its GUID from the index header - The above two cases are more complicated when the PUT is found for a diff bundle instead of base/self bundle. It might not be possible to unpack a diff bundle without its base being first unpacked. - There's no CQL query that can return the missing folder GUIDs, but it would be possible to dump the Cassandra `sstables` and parse the `(u, g)` pairs. There are 3 possibilities: 1. `user_mailbox_index_objects` : This table is relatively small, so it can be checked first. However, there's no guarantees that it will contain the missing GUIDs. 1. `user_mailbox_buckets` : Again, this table is relatively small, but it's not filled out until a folder has more than 10k mails. 1. `user_mailbox_objects` : This table definitely has the missing GUIDs, but it's huge and dumping and parsing it entirely may take a long time. # Making data human-readable General overview: - For indexes, index bundles, and fts indexes: Use [[doveadm,dump]]. - Scality object ID: Use the [[man,scality-keys]] script from the obox package. - Filenames: See the next section for how to dump timestamps in index bundles, fts and mail filenames. ## Timestamps in filenames This is especially useful when trying to figure out if some object was created recently or not. For example with the [[link,obox_troubleshooting_object_exists_in_dict_but_not_in_storage]] errors whether the object was created before or after upgrading to a version that fixed it. (Although that's not perfect either, because already orphaned objects can be copied.) See script [[man,fname-parse]] in the obox package. ## UNIX Timestamps Many places in Dovecot store UNIX timestamps. These can be converted to human-readable timestamps with for example: ```sh #!/bin/sh # unix2date.sh date -d "1970-01-01 UTC $1 seconds" ``` To get the timestamps in another timezone, use e.g.: `TZ=Japan unix2date.sh 1503848486` ## Timestamps in GUIDs Dovecot stores a timestamp as part of the GUIDs it generates. For example OIDs, mail GUIDs, folder GUIDs, etc. As a special case, dsync+imapc uses truncated SHA1 of the folder name as the GUID for the migrated folders, because IMAP protocol doesn't support the concept of GUIDs. If a folder GUID timestamp appears to be impossible, it's most likely because it's not a real GUID but a migrated folder. ```sh #!/bin/bash # guid2date.sh guid=$1 hex=`printf $guid|cut -c 9-16|sed 's/\(..\)\(..\)\(..\)\(..\)/\4\3\2\1/'` dec=`printf "%d" 0x$hex` time=`date -d "1970-01-01 UTC $dec seconds"` printf "$guid\nhex: $hex\ndec: $dec\ntime: $time\n" ``` ## Migrated folder GUIDs If a folder GUID doesn't seem to have a proper timestamp (as explained above), it most likely was created by dsync+imapc migration. That creates GUIDs based on the truncated 128bit SHA1 hash of folder names. So multiple users can be sharing these same "GUID"s. It's possible to verify whether a folder name results in such a GUID with: ```sh echo -n "Folder name" | sha1sum | cut -c 9- ``` Remember not to include the linefeed when calculating the hash (use echo -n or printf). For example: - INBOX: c92f64f79f0d1ed01e6d5b314f04886c - Sent: bfb2e03fdce327671e82bf173b1ccb8b - Sent Messages: 821ad6df633fb0d4e5cfa2c2dadecc41 - Trash: 7f5af7ba291b2df1a11d573bdb55d7e9 - Drafts: e0187b65e763143666d22094cedfe6a4 - Spam: 59c97b78ad43f83b1f91e47936e7e7d1 - Junk: 87680557f26fcb26843f739f7427e8c4 - Notes: a3dc2e079f23ee1c57dfa76669b732aa # Object classifications When troubleshooting issues in object storage environments you sometimes need to classify the objects in the object storage. The following indicators can be found in the object name which determines what type of object it is. All index objects start with `bundle.`. | Indicator | Bundle type | Sample | |---|---|---| | contains `-` | diff bundle | `bundle.5c61070c.a7d9c.63a9fa280c07615c313600005b667219-c0e54721ec07615c613700005b667219.server1132nd1%252erouen%252ecustomer%252ecom` | | ends with `.` | self bundle | `bundle.5c6107ec.a46f3.38252528ec07615c613700005b667219.server1132nd1%252erouen%252ecustomer%252ecom.` | | (none) | base bundle | `bundle.5c6107e9.72eaf.9f5b0e1ce907615c613700005b667219` | The [[man,fname-parse]] script simplifies identification of file type and creation timestamps. # Object exists in dict, but not in storage This error message means that an object (mail, index bundle or fts) is listed as existing in Cassandra, but the referred object ID doesn't exist in the configured object storage. This situation is not fixed automatically to make sure there's no accidental data loss. There have been various reasons in the past why this has happened, but new instances still seem to happen even after the latest fixes. This may be due to operational issues with Cassandra causing data to become undeleted, since it's not happening in all customer installations. These errors can also happen temporarily if there are delays with the object storage or Cassandra replication. For example during network splits. In this situation the errors will go away automatically once the object storage and Cassandra replication catches up. This is the only expected reason why these errors should happen. These errors usually show up when users are moved between backends (e.g. after backend failures). This is because normally Dovecot doesn't do any unnecessary Cassandra work, so it doesn't notice when these problems happen. When a user/folder is accessed for the first time in a new backend, Dovecot lists all the index/mail objects instead of using the locally cached lists. This is to make sure there aren't any changes lost when a backend crashes. This object listing is what usually notices that there are suddenly some new objects listed in Cassandra, and when Dovecot tries to access them they aren't found from the object storage after all. If users rarely move between backends, the original problem that causes the situation could have happened even months earlier. These errors can happen for email objects even years after they were originally lost. This is because old email objects are not generally accessed. But perhaps years later either the user accesses the mail, or e.g. FTS index rebuild tries to access the mail. So for old installations these may keep showing up due to old, already fixed, bugs. The only way to fix them would be to go through all the users' all objects and cleanup the broken ones. ## Known reasons / How to prevent it The problem is usually that an object that was already deleted in Cassandra becomes undeleted. This means at least one Cassandra node sees the object, but its tombstone is gone from the Cassandra nodes being requested. ### Cassandra Repairs Cassandra repairs must be run at least once every `gc_grace_seconds` (default: 10 days) to prevent already deleted objects from becoming undeleted. From the Cassandra manual in https://cassandra.apache.org/doc/latest/operating/repair.html : > At a minimum, repair should be run often enough that the gc grace period > never expires on unrepaired data. Otherwise, deleted data could reappear. > With a default gc grace period of 10 days, repairing every node in your > cluster at least once every 7 days will prevent this, while providing enough > slack to allow for delays. If a Cassandra node hasn't been connected to the cluster for `gc_grace_seconds` (default: 10 days), it must not be added back or many deleted objects will become undeleted. ### Copy/Expunge Race Condition If one session starts copying a mail at the same time as another session expunges it, it's possible that the expunge finishes deleting the object from storage while copying finishes successfully as well. Now the copy points to an already deleted object. There are two ways to prevent this: * It's highly recommended to use the [[link,obox_configuration_lazy_expunge]] plugin. However, using short autoexpunge times in the [[link,obox_configuration_lazy_expunge]] folder may cause these problems. It's recommended to use at least 1 day autoexpunge time (although a few hours should usually be sufficient). * If [[link,obox_configuration_lazy_expunge]] plugin is not used, the [[setting,fs_dictmap_lock_path]] setting must be used. ## How to fix it Typically these problems are fixed either manually running a fixup script, or writing automatic fixup scripts. The automation either looks at the log files or [[event,fs_dictmap_object_lost]] events, and runs commands to fix the found problems. ::: warning The fixup scripts must not be run if the object storage system is not properly connected/consistent. In some situations if the object storage has internal problems connecting to all of its nodes, it may start returning "404 Object not found" errors for objects that actually still exist, but just aren't accessible at the time. If the fixup script is run at a time this happens, **it may wrongly start deleting emails that still exist!** ::: These errors may also temporarily pop up if Cassandra has had connectivity problems and its replication is lagging behind. These problems will become fixed automatically while replication catches up with the pending deletes. However, there's no real harm to run a fixup script in this state, since it just causes the object to be deleted earlier by the fixup script rather than Cassandra replication. The "Object exists in dict, but not in storage" errors can be found by parsing the log files. Alternatively it's possible to export the [[event,fs_dictmap_object_lost]] event to a HTTP endpoint: ```doveconf[dovecot.conf] metric fs_dictmap_object_lost { filter = event=fs_dictmap_object_lost exporter = json } event_exporter json { format = json format_args = time-rfc3339 transport = http-post transport_args = https://example.com/api/endpoint/object-lost transport_timeout = 1 sec } ``` The ideal automatic solution would be tracking these errors separately for each object, and once the same error has repeated multiple times for the same object for over 1 hour it would be automatically fixed. A simpler solution would simply repair all objects seen over 1 hour ago. In both cases, the script should check the overall object storage state and not repair anything if it doesn't appear to be healthy. The overall idea for the fixup scripts is to: - See if the object still exists in Cassandra - If yes, see if the object ID exists in the object storage - If not, delete the object also from Cassandra This can be done either with direct object storage/Cassandra accesses, using doveadm dict/fs commands, or accessing the objects via regular doveadm mailbox access commands with the [[setting,fs_dictmap_delete_dangling_links]] option enabled. Only the [[setting,fs_dictmap_delete_dangling_links]] method is described below. ### Fixup script: Email objects Lost email objects can be found in two situations: - Mail object that already exists in mailbox indexes is attempted to be accessed via GET/HEAD. This can show up different ways in logs, for example: > Error: > read(userid/mailboxes/48bf220df60f526073fb1b0042497420/ea931f3822b45860408b068342497420) > failed: Object exists in dict, but not in storage: > b1281fa5311bc3744d578ee8b4847e835b010020 (uid=1496, box=INBOX, read > reason=access) - Mail object is attempted to be added to the mailbox index. This requires looking up its GUID, which requires HEADing the object. This shows up in logs as > Warning: Rescanned index in ..., **n** assumed temporarily lost where **n** specifies how many such mails were inaccessible. These errors don't prevent accessing the mailbox, but they cause inefficient behavior in Dovecot. The script below enables the [[setting,fs_dictmap_delete_dangling_links]] setting for doveadm commands, which fetches all the mails' headers in a user's INBOX. Note that it's necessary to trigger a HTTP HEAD or HTTP GET calls to the object storage so Dovecot sees the missing object and is then able to delete it. This fixes the mails that are already in the index, but not necessarily the "**n** assumed temporarily lost" mails. Those need to be fixed by having the [[setting,fs_dictmap_delete_dangling_links]] enabled while the index is being rescanned. This is easiest done with force-resync. The problematic emails may of course be also in other folders than INBOX. ```sh # Fix the "n assumed temporarily lost" (not needed if there aren't those): doveadm -o fs_dictmap_delete_dangling_links=yes force-resync -u user@domain INBOX > /dev/null # Fix the "object exists in dict, but not in storage" errors: doveadm -o fs_dictmap_delete_dangling_links=yes fetch -u user@domain hdr mailbox INBOX > /dev/null ``` The above command opens all the email objects in the INBOX. This is of course rather inefficient, and may take a long time if there are a lot of mails. You can also further limit the access only to the emails that are visible in the error messages. For example if the error message says the problem is with `uid=1496` then you can use: ```sh doveadm -o fs_dictmap_delete_dangling_links=yes fetch -u user@domain hdr mailbox INBOX UID 1496 > /dev/null ``` The problem with this method is that there may be other lost emails in the same folder that just weren't logged about yet, so you may need to keep monitoring and fixing the same user/folder multiple times with different email UIDs. ### Fixup script: Index bundle objects Example log line: > Error: Failed to load index files for mailbox 'INBOX': Failed to read index > files from storage: Failed to download bundle > testuser/mailboxes/c92f64f79f0d1ed01e6d5b314f04886c/idx/bundle.5e6205ad.42fb6.f05e5a10ad05625e0dbf0000b70eb21c.host: > Failed to read bundle > testuser/mailboxes/c92f64f79f0d1ed01e6d5b314f04886c/idx/bundle.5e6205ad.42fb6.f05e5a10ad05625e0dbf0000b70eb21c.host: > read(testuser/mailboxes/c92f64f79f0d1ed01e6d5b314f04886c/idx/bundle.5e6205ad.42fb6.f05e5a10ad05625e0dbf0000b70eb21c.host > (object ID: 34c101f80cce917854ae07cfe629f683380f0020)) failed: Object exists > in dict, but not in storage: 34c101f80cce917854ae07cfe629f683380f0020 The fixup script enables the [[setting,fs_dictmap_delete_dangling_links]] setting and then attempts to open the mailbox. Opening the mailbox is enough there's no need to access any emails. For extra safety, the index bundle list cache should be disabled with [[obox,metacache_bundle_list_cache,no]]. ```sh doveadm -o fs_dictmap_delete_dangling_links=yes -o metacache_bundle_list_cache=no fetch -u user@domain uid mailbox INBOX 1 > /dev/null ``` The fixup script below fixes INBOX's indexes first and then other folders: ```perl #!/usr/bin/perl $uid=$ARGV[0]; `doveadm -o fs_dictmap_delete_dangling_links=yes -o metacache_bundle_list_cache=yes fetch -u $uid uid mailbox "INBOX" 1`; @mailboxes=`doveadm -o metacache_bundle_list_cache=yes mailbox list -u $uid`; foreach $mailbox (@mailboxes) { chomp($mailbox); `doveadm -o fs_dictmap_delete_dangling_links=yes -o metacache_bundle_list_cache=yes fetch -u $uid uid mailbox "$mailbox" 1`; } ``` ### Fixup script: FTS objects Example log line: > Error: fts-dovecot: > fts.D_f8469003906358608b463f0042497420.00000024-00000458.0001: Couldn't read > max UID: (-2) > read(fts.D_f8469003906358608b463f0042497420.00000024-00000458.0001) failed: > Object exists in dict, but not in storage: > 98816abe000da349dadef26859c6ae83fa030010 The fixup script enables the [[setting,fs_dictmap_delete_dangling_links]] setting and then attempts to access all the FTS objects. The best way is to perform a FTS search that finds as many mails as possible. This hopefully triggers reading the problematic object, although it's not guaranteed. For example "subject" should be found just about everywhere: ```sh doveadm -o fs_dictmap_delete_dangling_links=yes search -u user@domain mailbox INBOX text "subject" > /dev/null ``` ### Fixup script: Deleting specific objects The above scripts may not work in all situations, and they're more inefficient than is really necessary. An alternative way is to parse the log messages and explicitly delete the objects. Before deletion the script should verify whether the object still exists or not. These can be done rather easily with [[man,doveadm-mail-fs]] commands. For example use the [[doveadm,mail fs stat]] command to see if the object exists: ```sh doveadm mail fs stat -u user@domain obox userid/mailboxes/2abee7074b597058a52b0000ce9fcb97/b851bd241c5b705818400000ce9fcb97 doveadm mail fs stat -u user@domain metacache userid/mailboxes/2abee7074b597058a52b0000ce9fcb97/idx/bundle.12345 doveadm mail fs stat -u user@domain fts/dovecot fts.D_f8469003906358608b463f0042497420.00000024-00000458.0001 ``` Verify from the stderr output whether the error is still "Object exists in dict, but not in storage". If yes, use the [[doveadm,mail fs delete]] command to delete the same path. ### Generic fixup script The obox package contains a script `fix-dangling-links.pl` that attempts to fix the "Object exists in dict, but not in storage" errors it finds in the given list of log files. #### Options `--dry-run` : This will make the script print out the commands that are necessary to fix the dangling links. By default the script automatically calls these commands directly. ::: info For the unlikely case that you have a log file called `--dry-run`: The script stops parsing for command line options once it encounters `-` or `--`. This means to pass it this file call it as such: ```sh perl ./fix-dangling-links.pl -- --dry-run ``` ::: #### Input The script expects a list of log files given via the command line. #### Operation The script itself will not produce any output - except for when the `--dry-run` option is used. By default it will call [[doveadm,mail fs stat]] with the `-o fs_dictmap_delete_dangling_links` option on different targets for which the "Object exists in dict, but not in storage" error was found in the log file. Currently it fixes errors for objects from: - `fts`, - `email objects`, - `mailbox bundles`, and - `user bundles`. ## Debugging When trying to debug why this still happens, it's important to find out: - When was the object created? - One rather reliable method for emails is to add `%{storage_id}` to [[setting,deliver_log_format]] setting, which expands to the appropriate storage's object ID. Although this applies only to new mail deliveries, not to IMAP APPENDs. - When was the object deleted? - For emails, mail_log plugin is helpful here. - Was the object actually deleted from Cassandra? - Best if using Cassandra's debug_queries=y so you can see clearly from the logs whether DELETE is issued for the row. Also verify that the timestamp in the DELETE query is newer than what exists now in the unwanted row. Of course, this setting causes a lot of logging in production. - It might be possible to determine from the logs in other ways whether the object should have been accessed. If the user is moved from backend to another, that triggers listing of all mail objects in Cassandra. This results in the unwanted row being added back to Dovecot index as a new mail, which clients typically try to download. If after the message expunging this has happened and user has successfully accessed all mails, then it means the Cassandra DELETE succeeded but the row just somehow came back. - Were there any Dovecot restarts or crashes between the deletion and when the error started happening? - Was the user moved from one backend to another between the deletion and when the error started happening? - As explained above, the error often becomes visible when user is moved to another backend, even though the problem happened already much earlier. - Were there any Cassandra node restarts or crashes between the deletion and when the error started happening? Or did any new Cassandra nodes join the cluster in that time? - If node was away for longer than gc_grace_seconds (default 10 days) and came back, this causes rows to become undeleted. - Has Cassandra's repairs been running properly? It's possible to find out the "save time" of the object based on its filename. Use the [[man,fname-parse]] script that comes with the obox package to find out the timestamp: ```sh ./fname-parse.pl userid/mailboxes/50a4dd1e5443a750244a0000527f2970/aaae550815ac2e5873660000e7abd5f6 userid/mailboxes/50a4dd1e5443a750244a0000527f2970/aaae550815ac2e5873660000e7abd5f6 mail 2016-11-18 09:21:57 ``` This is unfortunately not 100% reliable for mail objects, because when copying/moving mails the timestamp points to the copy/move time. The copy/move usually succeeds even if the email object was already lost in the object storage. So such new timestamps in other folders than INBOX/Sent/Drafts are possibly not a correct indicator that new objects are being lost. ## Why it should not happen Assuming local-quorum is used and Cassandra full repairs are done often enough, this problem in theory shouldn't be happening: * When writing a new object, it's first written to object storage. Only if it succeeds, it's written to Cassandra. * When deleting an object, it's first deleted from Cassandra. Only if it succeeds, it's deleted from object storage. * Because local-quorum is used for reads and writes, assuming more than one Cassandra node is not down, reads should always see the latest writes. # Recovery of lost email/index objects If lazy_expunge plugin is used, it's usually easy to undelete accidentally deleted mails because of it, even if entire folders are deleted using [[link,summary_doveadm,doveadm]]. However, this doesn't help if [[setting,lazy_expunge_mailbox]] isn't used, or if an administrator accidentally deletes the wrong users using [[doveadm,obox user delete]] or in some other way directly from the object storage (e.g. with [[doveadm,mail fs delete]]). There is no direct function to recover the deleted objects in Dovecot and there should not be a need for it. However, admins are humans and things can happen by accident. Here's a process overview of what can be done in that catastrophic event to recover some of the mail data. 1. Contact your object storage provider, e.g. Scality. Object Storages normally only mark objects as deleted and the actual purge operations are usually cron based actions which happen some days after the actual deletion is marked for the objects. 1. Disable the purging operations from object storage according to object storage provider instructions. If the objects were deleted only from the object storage (and not from Cassandra), trying to access the mails will cause Dovecot to log errors about unexpectedly lost mails/indexes. Dovecot won't automatically remove these from Cassandra, so undeleting the objects from the object storage will finish the recovery. ## Dovecot based recovery From Dovecot point of view there should be snapshot made of Cassandra which includes the deleted object references. This snapshot should be recovered so that it can be accessed again (an alternative might be to read the `sstables` snapshots directly from disk). If this is not the case, there are two more possibilities for data recovery: - If [[setting,deliver_log_format]] setting includes `%{storage_id}`, that expands to the object IDs. If the logs are still available, the object IDs for LMTP deliveries can be found from them. This won't help with mails saved via IMAP though. - If HAProxy logs are available and have been configured to log X-Dovecot-Username, you can grep for that user's DELETEs. - With Scality it's possible to list all index objects in the object storage (you can define [[link,obox_sproxyd_object_id_format,a bitmask filter]] so it only returns e.g. folder index bundle objects). By HEADing these objects you can find out which users they belong to. This allows finding the index bundles for the users whose data needs to be recovered. The index bundles can be downloaded and unpacked with [[doveadm,metacache unpack]]. The unpacked indexes can be [[doveadm,dump]]ed to find the list of email object IDs. In any of the above cases the indexes most likely don't have the latest emails listed, so some of the newest mails will be lost. The only way to find them would be to list all objects in the object storage and try to find any mails whose object IDs aren't listed in any of the indexes. Those could be then HEADed to find out whether they should be recovered. ### Possibility A for recovery: 1. Need to undelete in the object storage all the mail objects and the index bundle objects. Easiest is to use CQL to SELECT all the object IDs and undo the deletion based on it. 1. On snapshot-Cassandra: `doveadm backup -u user mdbox:/tmp/user/mdbox` - This might delete index bundles in production. Probably won't, at least commonly, but if it does happen, the production will start logging errors about unexpectedly missing objects. Those objects can then be again undeleted from the object storage if it happens. 1. On production-Cassandra: `doveadm sync -u user mdbox:/tmp/user/mdbox` - This will re-upload all the missing mail objects. 1. Delete again the old undeleted mail objects, since they were recreated already. ### Possibility B for recovery: 1. Need to undelete in the object storage all the mail objects and the index bundle objects. Easiest is to use CQL to SELECT all the object IDs and undo the deletion based on it. 1. Copy all the undeleted mail objects and index objects from snapshot-Cassandra to production-Cassandra. There's generally no need to check if rows already exist. diff-bundles are a bit more troublesome: for them the "h" (host) field could be changed to append e.g. "-backup". 1. Access all the folders to make sure that dsync-merge works OK. # "Success is uncertain, not deleting object ID" cleanup These errors happen on Cassandra write timeouts. If Dovecot can't be sure that the write succeeded, it will log this error and keep the object in the object storage. Eventually these should be deleted though when Cassandra is having less problems. For this find the [[man,uncertain-delete]] script in the obox package. ::: info The error and the description on this page should generally not happen on a default setup. Only if the [[setting,fs_dictmap_cleanup_uncertain]] setting is explicitly disabled should this page be relevant. ::: ::: tip Monitor the [[event,fs_dictmap_dict_write_uncertain]] event and especially whether the `cleanup` field contains `failed`. And inspect the logs for messages like `file write state is uncertain for object ID`. ::: A detailed explanation: When Cassandra can't achieve the requested consistency (each-quorum in this case) during the write time, it returns a failure. However, the write may still have partially succeeded and Cassandra may eventually repair/replicate it enough times so that the write did actually succeed. In these cases Dovecot can't be sure whether the write will eventually succeed or not, and it logs the "success is uncertain, not deleting object ID" error. If the failure was about an email object, it means that Dovecot replies to the IMAP/LMTP client that the mail couldn't be saved, so typically the client will re-deliver the mail again at a later time. There are two possible outcomes after this: - Cassandra write will eventually become visible, and Dovecot will see the write. Whenever Dovecot next lists the email objects, it sees that there's a new email and adds it to the Dovecot indexes. Since the client most likely had already re-delivered the mail this new mail shows up as a duplicate. Or if the user had already expunged the mail, it seems as if the expunged mail becomes un-expunged. - Cassandra write will never finish. The storage object never becomes deleted (automatically), so it just wastes disk space. There are no user-visible issues with this. After an uncertain write, Dovecot immediately attempts to delete the uncertain data. The deletion of course may again fail with uncertainty, but unless it completely failed it is still eventually going to work. The purpose of the [[man,uncertain-delete]] script is to find out these leaked storage objects and delete them to avoid wasting disk space - there is no user visible impact. So the script should be run a long time (e.g. 1 day) after the "success is uncertain, not deleting object ID" errors to give Cassandra some time to finish its repairs/replication and find out whether the write actually succeeded or not. If the [[man,uncertain-delete]] is run too early, Cassandra could repair the write and it would point to a storage object that no longer exists, resulting in [[link,obox_troubleshooting_object_exists_in_dict_but_not_in_storage]] errors. It's not safe to run a script that just deletes uncertain writes a long time after they happen. Otherwise mails could get lost: - Mail is delivered to user, which fails and logs "uncertain write" ("mail A"). - A few minutes later the mail is re-delivered and it succeeds ("mail B"). - Cassandra repairs the uncertain write and makes the "mail A" visible. - Dovecot re-syncs the INBOX by listing mails in Cassandra (this happens e.g. if user moves from one backend to another, or if the INBOX has been cleaned from metacache). - The re-sync sees the "mail A" and adds it to index. Now both mails A and B are visible to user. - User wonders why there are two mails in INBOX and happens to delete "mail B". - Script that deletes uncertain writes is run, which deletes "mail A". - Both A and B are now deleted. - (If user had deleted mail A instead of mail B there wouldn't have been a problem, but users will likely randomly decide to delete either one.) # Current Dovecot Pro Support Commitments ## Dovecot Pro 3.x ## Maintenance | Product-, Release- and Component Name | Maintenance Expires | | ------------------------------------- | ------------------- | | Dovecot Pro v2.3 Major Release branch | December 31, 2026 | # Dovecot Pro Support Commitment Dovecot Pro uses a form of [semantic software versioning](https://en.wikipedia.org/wiki/Software_versioning#Semantic_versioning) to define the support (SLA) commitments that attach to any specific release. ## Release Definitions ::: info The definitions provided here are for documentation purposes only. The legal definitions appear in the software license contract in the Support Definitions document. ::: ### New Generation *Example: Dovecot Pro 3.0* A new release that may contain major feature changes, new architecture or different technology. ### Major Release *Example: Dovecot Pro 3.1.0* A major update of Dovecot Pro that will normally include all the changes provided by Minor Releases for the current version. They are cumulative so a customer has to install the latest Major Release to benefit from all changes that are available for Dovecot Pro. Major Releases also provide functional enhancements. A Licensee is therefor encouraged to install all Major Releases as soon as feasible. The first release of a New Generation will be considered a Major Release for purposes of version support commitments (example: Dovecot Pro 3.0.0 is both a New Generation and a Major Release). ### Minor Release *Example: Dovecot Pro 3.1.5* A change of Dovecot Pro that is released on a regular basis, containing minor feature enhancements as well as solutions for known problems. Minor Releases go through quality assurance testing and APIs are not changed. ### Patch Release *Example: Dovecot Pro 3.1.5.1* A change to Dovecot Pro, to temporarily fix a Problem. “Patch Releases” are one-offs, special one-time builds not fully regression tested and/or recertified. The software change will be applied to the next formal Minor or Major Release of the Software. Patch Releases are cumulative in nature, thus every new Patch Release will contain all former software changes released earlier as Patch Releases for the relevant Minor or Major Release. #### Private Patch Release A Private Patch Release is a Patch Release that is built for a specific customer only. Private patches are provided directly to a customer and will not appear in the general, public repository. #### Public Patch Release A Public Patch Release is a Patch Release which is delivered to all customers. ## Release Support Commitments ### Major Releases A Major Release cycle will be supported for at least **12 Months** after First Customer Shipment (FCS) of the following Major Release. The exact date will be announced and communicated to customers by OX when it is decided. ### Minor Releases Within a Major Release cycle, support is always available for the most recent Minor Release. To provide sufficient time for the update, Open-Xchange will support the previous Minor Release for **3 months** in parallel after FCS of the most recent Minor Release. The 3 months will be calculated from the first day of the month after FCS of the most recent Minor Release. *Example: a Minor Release is shipped on 15 February; the previous Minor Release will be supported until 31 May (1 March is the first day of the month after the Minor Release was shipped; 3 months of support from that date ends on 31 May).* #### Patch Releases Support for Patch Releases is the **same as the support for the parent Minor Release.** *Example: Dovecot Pro 3.1.5.1 would have the same support commitment as 3.1.5.* ## Release Support Time Bar Example ![Support Time Bar](./committment_overview.png) # Kubernetes ::: warning Currently, [Kubernetes](https://kubernetes.io/) is only supported for distribution and deployment of [[link,cluster_controller]]. Additional Dovecot Pro components may become supported on Kubernetes in the future. The support policy for Kubernetes MAY change when/if that happens. ::: ## Support Policy (Cluster Controller) To ensure the stability, security, and compatibility of Dovecot Pro components, we adhere to a strict Kubernetes version support policy. Our software is designed and tested to operate seamlessly on the two most recent versions of Kubernetes prior to the latest Kubernetes stable release. A Kubernetes major release branch (i.e. 2.yy) must have at least three versions before it will be supported. ::: info The Kubernetes versions supported for a Pro Release is frozen at the time of the release. For example, if Kubernetes versions 1.29 & 1.28 are supported at the release of Dovecot Pro 3.0.x, those will be the only supported Kubernetes versions for the lifetime of that release. ::: The supported versions of Kubernetes for a Dovecot Pro release can be found in the [[link,release_notes,Dovecot Pro release notes]]. ### Support Example As of the latest update, our software supports the following versions of Kubernetes: - The latest stable release of Kubernetes minus one version (N-1) - The latest stable release of Kubernetes minus two versions (N-2) For example, if the latest stable release of Kubernetes is version **1.30**, our software will support: - Kubernetes version **1.29** - Kubernetes version **1.28** # Operating System Packages Dovecot Pro is only supported on Linux, and packages are only created for specific Distributions. The list of distributions supported for a specific release can be found in the Release Notes for that release. ## Supportable Distribution Rules ::: info Dovecot Pro does not directly support OS distributions. Instead, Dovecot Pro maintains a set of rules that describe when support for a specific OS can be added or dropped. OS Distribution support additions will be announced in the Release Notes of the version it becomes supported. OS Distribution support removals will be announced in at least one prior Release Notes before the support is dropped. ::: - Dovecot Pro will only be supported for distributions that have active support from the OS vendor. - Dovecot Pro will support the last 2 stable major releases for each supported OS distribution. - Dovecot Pro packages will be built against the latest OS distribution point release (at the time a version is released). We cannot provide packages built against previous OS releases due to build system limitations. - OS Support attaches to a version at the time it is packaged and released. Thus, once released, a Dovecot minor version is frozen when it comes to the OS versions supported on it. Patch Releases will be built using the OS distributions supported for the parent minor release. - OS distributions support for a Major or Minor release can be determined by looking at the Release Notes. - Support for a new OS will only be added in an Dovecot Pro New Generation/Major/Minor Release. OS Support will not be added in patch releases. - OS distribution support will be frozen once a Dovecot Pro Major Release branch enters Long Term Support (LTS) mode. # Dovecot Pro Professional Services For assistance with Dovecot Pro that is outside the scope of [[link,sla]], Open-Xchange can provide Professional Services assistance. Dovecot Pro experts are available to help with questions surrounding configuration, architecture, optimization, and more. ::: info Open-Xchange Professional Services support for Dovecot Pro is only available for customers with a Dovecot Pro software license. ::: Contact your Open-Xchange Account Manager for further information. # Security See [Dovecot Pro Security Advisories](https://documentation.open-xchange.com/dovecot/security/advisories/) for details about the Dovecot Pro security process, and a list of publicly issued advisories. # Dovecot Pro SLA Support Dovecot Pro Support is provided through the Open-Xchange Support process. Details of that process are available at https://www.open-xchange.com/resources/ox-support/general-information/. # Troubleshooting and Debugging This page contains information on how to troubleshoot and debug issues that may occur with Dovecot Pro. ::: info See [[link,sla]] for information on how to contact Open-Xchange Support. ::: ## Crashes ### dovecot-sysreport ::: tip This is the recommended way of providing debugging information as part of a Support ticket. ::: Use the **dovecot-sysreport** tool, which can be found in the Dovecot Pro packages: ```sh dovecot-sysreport --core ``` ## Session IDs ## Manual Debugging ### Process Tracing If a Dovecot process hangs or is just really slow, the best way to debug it is to see what it's really doing. ::: tip If opening a support ticket with Dovecot, providing strace output (if available) can greatly improve resolution time. Attach the output from the below command to the SLA ticket that is created. ::: ```sh # This should work on all Linux systems # (strace must be available on the system - see your OS documentation for # installation details) strace -tt -o log -p ``` ### Mail Debugging ### Rawlogs See [[link,rawlog]]. ### Authentication Debugging See [[link,authentication_debug]].