The more cynical amongst us may think that Dovecot are trying to shift more people onto paid support as the changes introduced in 2.4 break just about everything.\u00a0 It isn’t particularly bad if you are installing a fresh, but upgrading can be a bit of a pain (particularly if you are using postifxadmin and perhaps still using MD5 for passwords like we were).<\/p>\n
To get everything working as it was with 2.3 as instructed on this site you will need to make a small change to postfixadmin and more than likely renew all the passwords.\u00a0 Allegedly you can tell it to use MD5 but then you have to prefix all the entries anyway (or use a sneaky SQL trick) so you might as well just upgrade to SHA512 and be done with it.<\/p>\n
This guide was written after upgrading Debian to Trixie (which broke just about everything; but nothing quite as spectacularly as the email server).<\/p>\n
This guide can be used for either Install or upgrade, albeit I nave not done a clean install with it yet.\u00a0 The guide is assuming that you have Debian Trixie installed,<\/p>\n
Postfixadmin<\/strong><\/p>\n Upgrading postifxadmin itself is fairly painless but you do need to do the following: Find the line that says<\/p>\n <\/p>\n and change it to<\/p>\n <\/p>\n This will ensure that when you change all the passwords that they use SHA512 instead of MD5.<\/p>\n One small snag with doing this is that it creates a paradox as now when you try to log in to the interface you will no longer be able to do so because your password is not encrypted as expected so the next thing you need to do is generate a password.<\/p>\n To do this you can use a utility that bundles with dovecot called doveadm.\u00a0 Type<\/p>\n and you will be prompted for a password.\u00a0 Follow the instructions, entering the password that you wish to use to log on to postfixadmin and you will then be presented with a sting that looks something like<\/p>\n The postfixadmin portal has a table called admin which lists the administrative users and their passwords so now you will need to access that table from the postgresql command line and change the password.<\/p>\n For simplicity I am going to use this example to demonstrate accessing the postgresql command line, but your own login method may be different.\u00a0 Remember however that you are going to need to login as a user that has write privileges on the database (the postfixro<\/strong> user does not).<\/p>\n If you don’t know the user name you wish to change then you can<\/p>\n And you will see a list.<\/p>\n To update the password you simply<\/p>\n Now if you go back to the postfixadmin interface you should be able to log in again.<\/p>\n IMPORTANT<\/span><\/strong>:\u00a0 You will now have to reset the passwords for all the users.\u00a0 You cannot get the users to change their own passwords at this point because the old passwords are stored using a now incompatibly cipher.\u00a0 The user will be able to change their own password after you have changed it once, but this is the only way I have found to update the password scheme.<\/p>\n Now you have made postfixadmin compatible with dovecot you can move on to configuring dovecot itself.<\/p>\n Dovecot<\/strong><\/p>\n If you don’t have dovecot installed then you need to do this first:<\/p>\n Installation<\/strong><\/p>\n The first thing that we need to do is install a number of dovecot packages<\/p>\n dovecot-pgsql<\/strong><\/p>\n dovecot-imapd<\/strong><\/p>\n dovecot-lmtpd<\/strong><\/p>\n dovecot-managesieved<\/strong><\/p>\n <\/p>\n We are not going to bother with pop3 because I cannot thing of a single application where we would use it. Once everything is installed we can move on to the configuration<\/p>\n Configuration dovecot.conf<\/strong><\/p>\n In \/etc\/dovecot\/dovecot.conf first make sure you have the dovecot_config_version and dovecot_storage_version directives as the first entries in this file.\u00a0 (I also like to enable debugging while getting it working and then comment it out when done).<\/p>\n If this is a new install of you have used the default config files from 2.4 then these lines will be in however if you are upgrading and using your old config files then they won’t.<\/p>\n Other than that make sure<\/p>\n <\/p>\n and<\/p>\n <\/p>\n Configuration dovecot-sql.conf.ext<\/strong><\/p>\n dovecot-sql.conf.ext is no longer used so if you have got it then just delete; all the sql configuration is now done in .\/conf.d\/auth-sql.conf.ext<\/p>\n The rest of the configuration files are in the folder \/etc\/dovecot\/conf.d<\/strong>. Navigate to that folder now and edit the following files<\/p>\n Configuration auth-sql.conf.ext<\/strong><\/p>\n This is what replaces dovecot-sql.conf.ext and it is a full on reinvention of the wheel with a few things thrown in to catch you out such as %{user}<\/strong> replacing %u<\/strong> and the driver<\/strong> directive now being called sql_driver<\/strong> instead.\u00a0 The connection string is also gone, replaced by nested brackets.<\/p>\n If you are interested in what exactly it does then the 2.3 guide explains it, but if you just want to make it work then just paste the following in it (don’t forget to change your password)<\/p>\n As you can see the syntax is a little different, also this is where we tell dovecot that we wish to use SHA512 instead of MD5.<\/p>\n Configuration 10-mail.conf<\/strong><\/p>\n Here dovecot gives us another new wheel as we no longer have a “mail_location” directive.\u00a0 This is broken into 4 new lines<\/p>\n One thing that may be confusing is the mail_path directive.\u00a0 Don’t think it is pointing to the user’s home directory as it isn’t, it is pointing to the mail_home directory but I had to put it in as it would not work without it.<\/p>\n <\/p>\n The rest of the configuration of 10-mail.conf is the same as 2.3<\/p>\n The following directives all relate to the userid and groupid that will have access to the mailstore directory. If you remember, when we configured postfix we also created the \/home\/mailstore<\/strong> directory and a user and group both called mailer that were granted ownership of the directory. We then ran the id command<\/strong> to obtain the uid<\/strong> and gid<\/strong> of the mailer user which was 1001<\/strong> for both the user and the group. Now we need to tell dovecot what uid and gid will be required to access this directory.<\/p>\n The only other thing we need to do is tell dovecot that we want to enable the quota plugin<\/p>\n Configuration 15-mailboxes.conf<\/strong><\/p>\n I did not alter this configuration file from 2.3 to 2.4 so am assuming it is the same as everything seems to work as it did.<\/p>\n This is optional, but if you want to autocreate folders for junk, trash and sent, or even some other folder the first time that a user logs on then this is where you do it. There is good documentation within the file but in brief, if you want to enable the auto creation of a particular folder then add<\/p>\n within its stanza.<\/p>\n If you want to create a folder inside another then you need to use a period \u201c.\u201d as a separator. The period \u201c.\u201d after INBOX will cause dovecot to create the Junk folder inside INBOX.<\/p>\n Configuration 20-lmtp.conf<\/strong><\/p>\n Within the protocol lmtp stanza you need to add the following<\/p>\n Again this is not particuarly different to the 2.3 version however it is different enough to stop it working.<\/p>\n Configuration 20-imap.conf<\/strong><\/p>\n Here once again we have another reinvented wheel as we replace “mail_plugins = $mail_plugins imap_quota” with<\/p>\n Configuration 10-master.conf<\/strong><\/p>\n Most of the configuration of 10-master.conf is the same with the exception of the service auth-worker directive that now requires an explicit user change the unix_listner auth-userdb directives within the \u201cservice auth\u201d stanza to<\/p>\n and add the following, also within the service auth stanza<\/p>\n In the service auth-worker stanza add<\/p>\n <\/p>\n Configuration 10-auth.conf<\/strong><\/p>\n There are a few changes here, the first being “disable_plaintext_auth<\/strong>” is no longer used however you can just comment out or remove this line as dovecot now defaults to automatically disabling plain text authentication (which can only be a good thing).\u00a0 If for some reason you want to enable it then you need to set auth_allow_cleartext instead, but this is NOT recommended.<\/p>\n Other than that you need to ensure you have all the includes commented out except for “auth-sql.conf.ext<\/strong>“.<\/p>\n Configuration 15-lda.conf<\/strong><\/p>\n I did not alter 15-lda.conf at so it simply has<\/p>\n <\/p>\n Configuration 90-plugin.conf<\/strong><\/p>\n Now we need to provide some information about sieve; this is quite a bit different to 2.3 as it now appears to be in 3 separate scopes.<\/p>\n We also need to create the \/var\/lib\/dovecot\/sieve<\/strong> directory and change the owner to mailer:mailer<\/p>\n Configuration 10-ssl.conf<\/strong><\/p>\n The final configuration file is the ssl configuration that tells dovecot where to look for the certificates. We need to tell dovecot that we want to use ssl so we need to change \u201cssl =\u201d to yes<\/p>\n Other than that we are telling the server what certificates to use.\u00a0 As we are using certbot ours are<\/p>\n Previously the ssl_cert and ssl_key directives had an unusual syntax, but now it is just the same as setting any other directive, if you are upgrading however remember to delete the “<”<\/p>\n Next you need to generate the The The Diffie-Hellman (DH) key exchange.\u00a0 The name of the directive has changed to ssl_server_dh_file Of course you need to generate this file if to does not yet exist<\/p>\n This could take some time.<\/p>\n Final actions\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/strong><\/p>\n The final step is to tell Postfix to use this socket for final delivery, in this case in a virtual user scenario. All you have to do is add<\/p>\n to the end of \/etc\/postfix\/main.cf<\/p>\n You should now be able to restart dovecot and provided that you have added a domain and user you should be able to connect to the server using a client.<\/p>\n Enable debugging and check the logs. At the top of \/etc\/dovecot\/dovecot.conf add<\/p>\n You will want to remove this when you are sure your configuration is ok<\/p>\n If for some reason the server is not working as it should, check the log file for errors<\/p>\n The postgresql logs may also help<\/p>\n as might journalctl -f<\/p>\n If you need authentication and password related debug message, turn on related settings and restart dovecot service.<\/p>\n If you see many error message (like\u00a0dovecot fails, spawning too quickly) in Dovecot error log while restarting Dovecot, there might be something wrong in Dovecot config file. Please try to start it on command line manually, it will report configuration error if any, fix them and start it again:<\/p>\n A useful tool for checking your configuration is<\/p>\n To test authentication<\/p>\n Doing this while monitoring the mail and SQL logs will usually give you a good idea of what is going wrong if dovecot is actually running.<\/p>\n Will check the certificate and give you a prompt where you can type your login username and password<\/p>\n which should return something like<\/p>\n type<\/p>\n to exit the interface.<\/p>\n At the time of writing the postfix configuration is completely unchanged.<\/p>\n <\/p>\n <\/p>\n Acknowledgement and credit is quite rightly given to:<\/p>\n https:\/\/www2.techtalkhawke.com\/news\/postfix-dovecot-postgresql-and-sogo-webmail-on-debian-13<\/p>\n and<\/p>\n https:\/\/monospace.games\/posts\/20250815-dovecot-24.html<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" The more cynical amongst us may think that Dovecot are trying to shift more people onto paid support as the changes introduced in 2.4 break just about everything.\u00a0 It isn’t particularly bad if you are installing a fresh, but upgrading can be a bit of a pain (particularly if you are using postifxadmin and perhaps […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-548","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts\/548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=548"}],"version-history":[{"count":8,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts\/548\/revisions"}],"predecessor-version":[{"id":555,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=\/wp\/v2\/posts\/548\/revisions\/555"}],"wp:attachment":[{"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.inplico.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}$CONF['encrypt'] = 'md5crypt';<\/pre>\n
$CONF['encrypt'] = 'dovecot:SHA512-CRYPT';\r\n<\/pre>\n
doveadm pw -s SHA512-CRYPT<\/pre>\n
{SHA512-CRYPT}$6$1VrbYvsGOfLwN4Tl$iQzUmw8kEimkrwHIY4yk.JejQLOf.SJyyj\/..ZEF8Zx.eS4PWYiTr5QjFlUVMKdRiwyum5wiQlADdH\/hdkzsa0\r\n<\/pre>\npsql -U postgres -d postfix<\/pre>\n
SELECT username FROM admin;<\/pre>\n
UPDATE admin SET password = {SHA512-CRYPT}$6$1VrbYvsGOfLwN4Tl$iQzUmw8kEimkrwHIY4yk.JejQLOf.SJyyj\/..ZEF8Zx.eS4PWYiTr5QjFlUVMKdRiwyum5wiQlADdH\/hdkzsa0 WHERE username = me@mydomain.com\r\n<\/pre>\n#apt-get install dovecot-pgsql dovecot-imapd dovecot-lmtpd dovecot-managesieved<\/pre>\n
dovecot_config_version = 2.4.0\r\ndovecot_storage_version = 2.4.0\r\nmail_debug = yes\r\n<\/pre>\n
!include_try \/usr\/share\/dovecot\/protocols.d\/*.protocol<\/pre>\n
listen =*, ::<\/pre>\n
sql_driver = pgsql\r\n\r\npgsql localhost {\r\n parameters {\r\n user = postfixro\r\n password = mysecretpassword\r\n dbname = postfix\r\n }\r\n}\r\n\r\npassdb_default_password_scheme = SHA512-CRYPT\r\n\r\nuserdb sql {\r\n query = \\\r\n SELECT '\/mailstore\/'||maildir AS home, '*:bytes='||quota AS quota_rule \\\r\n FROM mailbox \\\r\n WHERE username = '%{user}' \\\r\n AND active = TRUE\r\n}\r\n\r\npassdb sql {\r\n query = \\\r\n SELECT '\/mailstore\/'||maildir AS userdb_home, username AS user, password, '*:bytes='||quota AS userdb_quota_rule \\\r\n FROM mailbox \\\r\n WHERE username = '%{user}' \\\r\n AND active = TRUE\r\n}\r\n<\/pre>\nmail_driver = maildir\r\nmail_path = ~\/\r\nmail_home = \/mailstore\/%{user | domain }\/%{user | username }\r\n<\/pre>\nmail_uid = 1001 \r\nmail_gid = 1001 \r\nfirst_valid_uid = 1001 \r\nlast_valid_uid = 1001 \r\nfirst_valid_gid = 1001 \r\nlast_valid_gid = 1001<\/pre>\n
mail_plugins = quota<\/pre>\n
auto=subscribe<\/pre>\n
mailbox INBOX.Junk { \r\n auto=subscribe \r\n special_use = \\Junk \r\n}<\/pre>\nlmtp_rcpt_check_quota = yes\r\n\r\nprotocol lmtp {\r\n mail_plugins {\r\n quota = yes\r\n\u00a0\u00a0\u00a0 sieve = yes\r\n\u00a0 }\r\n\u00a0 postmaster_address=postmaster@fqdn.suffix \r\n hostname=server.fqdn.suffix\r\n}\r\n<\/pre>\nprotocol imap {\r\n mail_plugins {\r\n imap_quota = yes\r\n imap_sieve = yes\r\n }\r\n}\r\n<\/pre>\nunix_listener auth-userdb { \r\n mode = 0600 \r\n user = mailer \r\n group = mailer \r\n}<\/pre>\nunix_listener \/var\/spool\/postfix\/private\/auth { \r\n mode = 0666 \r\n user = postfix \r\n group = postfix \r\n}<\/pre>\nservice auth-worker { \r\n user = mailer\r\n}<\/pre>\n#!include auth-deny.conf.ext\r\n#!include auth-master.conf.ext\r\n#!include auth-system.conf.ext\r\n!include auth-sql.conf.ext\r\n#!include auth-ldap.conf.ext\r\n#!include auth-passwdfile.conf.ext\r\n#!include auth-checkpassword.conf.ext\r\n#!include auth-vpopmail.conf.ext\r\n#!include auth-static.conf.ext\r\n<\/pre>\n
postmaster_address = postmaster@domain.net protocol \r\nlda { \r\n mail_plugins = $mail_plugins sieve \r\n}<\/pre>\nsieve_script personal {\r\n driver = file\r\n path = ~\/sieve\r\n active_path = ~\/.dovecot.sieve\r\n}\r\n\r\nsieve_script global_default {\r\n sieve_script_type = global\r\n path = \/var\/lib\/dovecot\/sieve\/default.sieve\r\n}\r\n\r\nsieve_script global_dir {\r\n sieve_script_type = global\r\n path = \/var\/lib\/dovecot\/sieve\/global\/\r\n}\r\n<\/pre>\nmkdir \/var\/lib\/dovecot\/sieve \r\nchown \u2013R mailer:mailer \/var\/lib\/dovecot\/sieve<\/pre>\n
ssl = yes<\/pre>\n
ssl_server_cert_file = \/etc\/letsencrypt\/live\/mydomain.com\/fullchain.pem\r\nssl_server_key_file = \/etc\/letsencrypt\/live\/mydomain.com\/privkey.pem\r\n<\/pre>\n
\n<\/span><\/p>\nssl_server_dh_file = \/etc\/dovecot\/dh.pem<\/pre>\n
openssl dhparam -out \/etc\/dovecot\/dh.pem 4096<\/pre>\n
virtual_transport = lmtp:unix:private\/dovecot-lmtp<\/pre>\n
mail_debug = yes<\/pre>\n
#tail \u2013f \/var\/log\/mail.log<\/pre>\n
tail -f \/var\/log\/postgresql\/postgresql-XX-main.log<\/pre>\n
auth_verbose = yes \r\nauth_debug = yes \r\nauth_debug_passwords = yes \r\nauth_verbose_passwords = yes<\/pre>\n
dovecot -c \/etc\/dovecot\/dovecot.conf<\/pre>\n
doveconf<\/pre>\n
doveadm auth test user@example.com TestPass123<\/pre>\n
openssl s_client -connect localhost:143 -starttls imap<\/pre>\n
a me@mydomain.com mysecretpassword<\/pre>\n
* CAPABILITY IMAP4rev1 SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS BINARY MOVE REPLACE SNIPPET=FUZZY PREVIEW=FUZZY PREVIEW SPECIAL-USE STATUS=SIZE SAVEDATE COMPRESS=DEFLATE INPROGRESS NOTIFY LITERAL+ QUOTA\r\na OK Logged in\r\n<\/pre>\n
b logout<\/pre>\n