dsync failed after update to 13.3.1

[BozhanL]

Hello,
After update to 13.3.1, dsync failed with:

Jan 26 06:49:22 doveadm(e@example.com): Error: remote(server2.example.com:61526): doveadm(1.1.1.1,e@example.com): auth-master: passdb lookup(e@example.com): Auth PASS lookup failed
Jan 26 06:49:22 doveadm(e@example.com): Error: remote(server2.example.com:61526): doveadm(1.1.1.1,e@example.com): /run/dovecot/auth-userdb: passdb lookup failed (to see if user is proxied, because doveadm_port is set)

After commenting out this line, dsync work again.

docker-mailserver/target/dovecot/auth-passwdfile.inc

Line 12 in 0c7e49e

mechanisms = plain login

With auth_debug=yes, I found these lines.

Jan 26 04:55:37 server2 dovecot: auth: Debug: skipping passdb: mechanism filtered
Jan 26 04:55:37 server2 dovecot: auth: Error: All password databases were skipped

What should I do to fix it without commenting out the line?

[polarathene]

What should I do to fix it without commenting out the line?

You have customized the authentication mechanisms?

• AFAIK we only support plain login and the two oauth ones.
• dsync is going to be removed by Dovecot in a future release btw.

dsync is not an authentication mechanism so you must be using something else.

[BozhanL]

My test command is doveadm -D sync -u e@example.com -d -N -l 30 -U.
My 10-dsync.conf is

mail_plugins = $mail_plugins notify replication

service replicator {
    process_min_avail = 1

    unix_listener replicator-doveadm {
        mode = 0666
    }
}

plugin {
    mail_replica = tcps:server2.example.com:61526
}

service doveadm {
    inet_listener {
        port = 61526
        ssl = yes
    }
}
doveadm_port = 61526

# # The mail process statistics tracking needs access to the stats-writer socket
service stats {
    unix_listener stats-writer {
        mode = 0660
    }
}

service aggregator {
    vsz_limit = 32M
    fifo_listener replication-notify-fifo {
        user = dovecot
        mode = 0666
    }
    unix_listener replication-notify {
        user = dovecot
        mode = 0666
    }
}

doveadm_password = password

replication_max_conns = 5

[polarathene]

The valid auth mechanisms are listed on the link I provided.

If you need the passwd-file passdb, I need to know what mechanism you're using for dsync.

Alternatively you can workaround by commenting out the line, it's purpose is to prevent conflict with alternative passdb enabled (like the OAuth2 feature), as incompatible mechanisms get tried and log failures which triggers fail2ban.

[BozhanL]

Here is Minimum Reproducible Example email.tar.gz. To make it work, you need to fill hostname in compose.yaml, and mail_replica in mailserver/config/dovecot/10-dsync.conf

[BozhanL]

The test command is doveadm -D sync -u e@example.com -d -N -l 30 -U

[polarathene]

As this is for something we don't provide official support for I can't justify looking into this for you any time soon.

I've provided you with a docs link for Dovecot auth mechanisms, you can try adding those to find out which one is expected. Even if you do it's most likely going to require you to patch (eg: via user-patches.sh).

When I was doing this process for the config change itself in 13.3.1, I opened a shell into the DMS container and used nano to edit the config file, and run dovecot reload, then test again.

I know there is some interest in contributing a Dovecot replication feature, so if you find out the mechanism required it'd be helpful towards that.

[casperklein]

Before the OAuth feauture, it was mechanisms = ". Now it's mechanisms = plain login.

According to the docs, am empty value is equal to auth_mechanisms = plain login cram-md5.

So I think, dsync uses cram-md5. @IIIlllIIllIIIll Can you try this?

Edit: I thought the example at the bottom of the page was the default.

Still interesting, that when the default was "plain login" when auth_mechanisms = was used and now that we explicit set it to auth_mechanisms = plain login, this breaks dsync.