The issue comes when using STARTTLS authentication to IMAP.
With removing tls:// will work fine but without encryption:
$config["imap_host"] = "127.0.0.1:143";
I have reviewed the dovecot tls configuration but did not find anything.
From smtp it works perfectly by using:
$config["smtp_host"] = "tls://127.0.0.1:587";
The problem is when roundcube needs to authenticate to dovecot imap using TLS.
Here are some logs:
Jul 9 14:15:40 mail dovecot: imap-login: Disconnected (client didn't finish SASL auth, waited 60 secs): user=<>, method=LOGIN, rip=127.0.0.1, lip=127.0.0.1, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits),
Here is the dovecot config:
root@mail:/etc/dovecot# doveconf -n
# 2.3.7.2 (3c910f64b): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.5.7.2 ()
# OS: Linux 5.4.0-153-generic x86_64 Ubuntu 20.04.6 LTS
auth_master_user_separator = *
auth_mechanisms = PLAIN LOGIN
deliver_log_format = from=%{from}, envelope_sender=%{from_envelope}, subject=%{subject}, msgid=%m, size=%{size}, delivery_time=%{delivery_time}ms, %$
dict {
acl = mysql:/etc/dovecot/dovecot-share-folder.conf
lastlogin = mysql:/etc/dovecot/dovecot-last-login.conf
quotadict = mysql:/etc/dovecot/dovecot-used-quota.conf
}
first_valid_uid = 2000
last_valid_uid = 2000
listen = * [::]
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l mpid=%e %c %k session=<%{session}>
mail_gid = 2000
mail_location = maildir:%Lh/Maildir/:INDEX=%Lh/Maildir/
mail_plugins = quota mailbox_alias acl mail_log notify
mail_uid = 2000
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext
namespace {
inbox = yes
location =
mailbox Archive {
auto = no
special_use = \Archive
}
mailbox Archives {
auto = no
special_use = \Archive
}
mailbox "Deleted Messages" {
auto = no
special_use = \Trash
}
mailbox Drafts {
auto = subscribe
special_use = \Drafts
}
mailbox Junk {
auto = subscribe
special_use = \Junk
}
mailbox "Junk E-mail" {
auto = no
special_use = \Junk
}
mailbox Sent {
auto = subscribe
special_use = \Sent
}
mailbox "Sent Items" {
auto = no
special_use = \Sent
}
mailbox "Sent Messages" {
auto = no
special_use = \Sent
}
mailbox Spam {
auto = no
special_use = \Junk
}
mailbox Trash {
auto = subscribe
special_use = \Trash
}
prefix =
separator = /
type = private
}
namespace {
list = children
location = maildir:%%Lh/Maildir/:INDEX=%%Lh/Maildir/Shared/%%Ld/%%Ln
prefix = Shared/%%u/
separator = /
subscriptions = yes
type = shared
}
passdb {
args = /etc/dovecot/dovecot-mysql.conf
driver = sql
}
passdb {
args = /etc/dovecot/dovecot-master-users
driver = passwd-file
master = yes
}
plugin {
acl = vfile
acl_shared_dict = proxy::acl
last_login_dict = proxy::lastlogin
last_login_key = # hidden, use -P to show it
mail_log_events = delete undelete expunge copy mailbox_create mailbox_delete mailbox_rename
mail_log_fields = uid box msgid size from subject flags
mailbox_alias_new = Sent Messages
mailbox_alias_new2 = Sent Items
mailbox_alias_old = Sent
mailbox_alias_old2 = Sent
quota = dict:user::proxy::quotadict
quota_grace = 10%%
quota_status_nouser = DUNNO
quota_status_overquota = 552 5.2.2 Mailbox is full
quota_status_success = DUNNO
quota_warning = storage=100%% quota-warning 100 %u
quota_warning2 = storage=95%% quota-warning 95 %u
quota_warning3 = storage=90%% quota-warning 90 %u
quota_warning4 = storage=85%% quota-warning 85 %u
sieve = ~/sieve/dovecot.sieve
sieve_before = /var/vmail/sieve/dovecot.sieve
sieve_dir = ~/sieve
sieve_global_dir = /var/vmail/sieve
sieve_max_redirects = 30
sieve_vacation_send_from_recipient = yes
}
protocols = pop3 imap sieve lmtp
service auth {
unix_listener /var/spool/postfix/private/dovecot-auth {
group = postfix
mode = 0666
user = postfix
}
unix_listener auth-master {
group = vmail
mode = 0666
user = vmail
}
unix_listener auth-userdb {
group = vmail
mode = 0660
user = vmail
}
}
service dict {
unix_listener dict {
group = vmail
mode = 0660
user = vmail
}
}
service imap-login {
process_limit = 500
service_count = 1
}
service lmtp {
executable = lmtp -L
inet_listener lmtp {
address = 127.0.0.1
port = 24
}
process_min_avail = 5
unix_listener /var/spool/postfix/private/dovecot-lmtp {
group = postfix
mode = 0600
user = postfix
}
user = vmail
}
service managesieve-login {
inet_listener sieve {
address = 127.0.0.1
port = 4190
}
}
service pop3-login {
service_count = 1
}
service quota-status {
client_limit = 1
executable = quota-status -p postfix
inet_listener {
address = 127.0.0.1
port = 12340
}
}
service quota-warning {
executable = script /usr/local/bin/dovecot-quota-warning.sh
unix_listener quota-warning {
group = vmail
mode = 0660
user = vmail
}
}
service stats {
fifo_listener stats-mail {
mode = 0644
user = vmail
}
inet_listener {
address = 127.0.0.1
port = 24242
}
unix_listener stats-writer {
group = vmail
mode = 0660
user = vmail
}
}
ssl = required
ssl_cert = </etc/letsencrypt/live/mail.irontel.es/fullchain.pem
ssl_cipher_list = EECDH+CHACHA20:EECDH+AESGCM:EDH+AESGCM:AES256+EECDH
ssl_dh = # hidden, use -P to show it
ssl_key = # hidden, use -P to show it
ssl_min_protocol = TLSv1.2
ssl_prefer_server_ciphers = yes
syslog_facility = local5
userdb {
args = /etc/dovecot/dovecot-mysql.conf
driver = sql
}
protocol lda {
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
mail_plugins = quota mailbox_alias acl mail_log notify sieve
}
protocol lmtp {
lmtp_save_to_detail_mailbox = yes
mail_plugins = quota mailbox_alias acl mail_log notify sieve
recipient_delimiter = +
}
protocol imap {
imap_client_workarounds = tb-extra-mailbox-sep
mail_max_userip_connections = 30
mail_plugins = quota mailbox_alias acl mail_log notify imap_quota imap_acl last_login
}
protocol pop3 {
mail_max_userip_connections = 30
mail_plugins = quota mailbox_alias acl mail_log notify last_login
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
pop3_uidl_format = %08Xu%08Xv
}
root@mail:/etc/dovecot#
I hope this details help to identify the issue
henrikw wrote:I had the same issue and solved it by reverting the IMAP & SMTP changes, suggested while upgrading roundcube:
...
// IMAP
$config['default_host'] = '127.0.0.1';
$config['default_port'] = 143;
//$config["imap_host"] = "tls://127.0.0.1:143";
...
// SMTP
$config['smtp_server'] = 'tls://127.0.0.1';
$config['smtp_port'] = 587;
//$config["smtp_host"] = "tls://127.0.0.1:587";
...
Main problem was, that with the new settings, roundcube was failing to authenticate sometimes, when having an open session and therefore leading fail2ban to ban the IP (yours).
