Re: Auth-worker, unknown scheme ARGON2ID

[Aki Tuomi]

> On 22/02/2023 09:10 EET James Brown  wrote:
> 
> 
> On 22 Feb 2023, at 5:53 pm, Aki Tuomi  wrote:
> 
> > 
> > 
> > > > > 
> > > > > % locate libsodium
> > > > > /opt/homebrew/Cellar/libsodium
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew/libsodium.rb
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/AUTHORS
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/ChangeLog
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/INSTALL_RECEIPT.json
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/LICENSE
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/README.markdown
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/core.h
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/crypto_aead_aes256gcm.h
> > > > > ...
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/utils.h
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/version.h
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium.h
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.23.dylib
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.a
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.dylib
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig
> > > > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
> > > > > /opt/homebrew/lib/libsodium.23.dylib
> > > > > /opt/homebrew/lib/libsodium.a
> > > > > /opt/homebrew/lib/libsodium.dylib
> > > > > /opt/homebrew/lib/pkgconfig/libsodium.pc
> > > > > /opt/homebrew/opt/libsodium
> > > > > /opt/homebrew/var/homebrew/linked/libsodium
> > > > > 
> > > > > What do I need to use to stop the:Can't build with libsodium: not 
> > > > > found
> > > > > 
> > > > > Sorry these are such stupid questions.
> > > > > 
> > > > > James.
> > 
> > Dovecot uses pkg-config to find out about libsodium, and it seems you're 
> > missing libsodium.pc in whatever place mac uses to hide them.
> > 
> > Maybe the .pc file is in the homebrew directory somewhere and needs to be 
> > copied, or you can make it yourself. Make sure to change the version and 
> > paths.
> > 
> > prefix=/usr
> > exec_prefix=${prefix}
> > libdir=${prefix}/lib/x86_64-linux-gnu
> > includedir=${prefix}/include
> > 
> > Name: libsodium
> > Version: 1.0.18
> > Description: A modern and easy-to-use crypto library
> > 
> > Libs: -L${libdir} -lsodium
> > Libs.private: -pthread 
> > Cflags: -I${includedir}
> > 
> > Aki
> 
> Getting somewhere - thanks Aki.
> 
> 
> % locate libsodium.pc
> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
> /opt/homebrew/lib/pkgconfig/libsodium.pc
> /usr/local/lib/pkgconfig/libsodium.pc
> 
> Looking at /opt/homebrew/lib/pkgconfig/libsodium.pc it is:
> 
> prefix=/opt/homebrew/Cellar/libsodium/1.0.18_1
> exec_prefix=${prefix}
> libdir=${exec_prefix}/lib
> includedir=${prefix}/include
> 
> Name: libsodium
> Version: 1.0.18
> Description: A modern and easy-to-use crypto library
> 
> Libs: -L${libdir} -lsodium
> Libs.private: -pthread
> Cflags: -I${includedir}
> 
> The version of libsodium I downloaded and installed from source is:
> 
> prefix=/usr/local
> exec_prefix=${prefix}
> libdir=${exec_prefix}/lib
> includedir=${prefix}/include
> 
> Name: libsodium
> Version: 1.0.18
> Description: A modern and easy-to-use crypto library
> 
> Libs: -L${libdir} -lsodium
> Libs.private: -lpthread -pthread
> Cflags: -I${includedir}
> 
> Do I need to edit one of these files, or somehow tell .configure to look at 
> /opt/homebrew/lib/ ?
> 
> James.
>

You can use 

env PKG_CONFIG_PATH=/opt/homebrew/lib/ ./configure ...

Aki

Re: Auth-worker, unknown scheme ARGON2ID

[James Brown]

On 22 Feb 2023, at 5:53 pm, Aki Tuomi  wrote:
> 
 
 % locate libsodium
 /opt/homebrew/Cellar/libsodium
 /opt/homebrew/Cellar/libsodium/1.0.18_1
 /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew
 /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew/libsodium.rb
 /opt/homebrew/Cellar/libsodium/1.0.18_1/AUTHORS
 /opt/homebrew/Cellar/libsodium/1.0.18_1/ChangeLog
 /opt/homebrew/Cellar/libsodium/1.0.18_1/INSTALL_RECEIPT.json
 /opt/homebrew/Cellar/libsodium/1.0.18_1/LICENSE
 /opt/homebrew/Cellar/libsodium/1.0.18_1/README.markdown
 /opt/homebrew/Cellar/libsodium/1.0.18_1/include
 /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium
 /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/core.h
 /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/crypto_aead_aes256gcm.h
 ...
 /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/utils.h
 /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/version.h
 /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium.h
 /opt/homebrew/Cellar/libsodium/1.0.18_1/lib
 /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.23.dylib
 /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.a
 /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.dylib
 /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig
 /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
 /opt/homebrew/lib/libsodium.23.dylib
 /opt/homebrew/lib/libsodium.a
 /opt/homebrew/lib/libsodium.dylib
 /opt/homebrew/lib/pkgconfig/libsodium.pc
 /opt/homebrew/opt/libsodium
 /opt/homebrew/var/homebrew/linked/libsodium
 
 What do I need to use to stop the:Can't build with libsodium: not found
 
 Sorry these are such stupid questions.
 
 James.
> 
> Dovecot uses pkg-config to find out about libsodium, and it seems you're 
> missing libsodium.pc in whatever place mac uses to hide them.
> 
> Maybe the .pc file is in the homebrew directory somewhere and needs to be 
> copied, or you can make it yourself. Make sure to change the version and 
> paths.
> 
> prefix=/usr
> exec_prefix=${prefix}
> libdir=${prefix}/lib/x86_64-linux-gnu
> includedir=${prefix}/include
> 
> Name: libsodium
> Version: 1.0.18
> Description: A modern and easy-to-use crypto library
> 
> Libs: -L${libdir} -lsodium
> Libs.private:  -pthread 
> Cflags: -I${includedir}
> 
> Aki

Getting somewhere - thanks Aki.

% locate libsodium.pc
/opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
/opt/homebrew/lib/pkgconfig/libsodium.pc
/usr/local/lib/pkgconfig/libsodium.pc

Looking at /opt/homebrew/lib/pkgconfig/libsodium.pc it is:

prefix=/opt/homebrew/Cellar/libsodium/1.0.18_1
exec_prefix=${prefix}
libdir=${exec_prefix}/lib
includedir=${prefix}/include

Name: libsodium
Version: 1.0.18
Description: A modern and easy-to-use crypto library

Libs: -L${libdir} -lsodium
Libs.private:  -pthread
Cflags: -I${includedir}

The version of libsodium I downloaded and installed from source is:

prefix=/usr/local
exec_prefix=${prefix}
libdir=${exec_prefix}/lib
includedir=${prefix}/include

Name: libsodium
Version: 1.0.18
Description: A modern and easy-to-use crypto library

Libs: -L${libdir} -lsodium
Libs.private: -lpthread -pthread
Cflags: -I${includedir}

Do I need to edit one of these files, or somehow tell .configure to look at 
/opt/homebrew/lib/ ?

James.

Re: Auth-worker, unknown scheme ARGON2ID

[Aki Tuomi]

> On 22/02/2023 08:41 EET James Brown  wrote:
> 
> 
> > On 22 Feb 2023, at 5:33 pm, Aki Tuomi  wrote:
> > > 
> > > Thanks Aki, that was helpful. When I add that I get:
> > > 
> > > checking for LIBSODIUM... no
> > > configure: error: Can't build with libsodium: not found
> > > 
> > > So I have to tell it where libsodium is.
> > > 
> > > Tried:
> > > 
> > > CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
> > > LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib 
> > > LIBSODIUM_LIBS=-L/opt/homebrew/Cellar/libsodium ./configure 
> > > --with-ssl=openssl --with-mysql —with-sodium
> > > 
> > > But that gives:
> > > 
> > > configure: WARNING: Libtool does not cope well with whitespace in `pwd`
> > > checking build system type... Invalid configuration `—-with-sodium': 
> > > machine `—-with' not recognized
> > > 
> > > Location of libsodium:
> > > 
> > > % locate libsodium
> > > /opt/homebrew/Cellar/libsodium
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew/libsodium.rb
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/AUTHORS
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/ChangeLog
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/INSTALL_RECEIPT.json
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/LICENSE
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/README.markdown
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/core.h
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/crypto_aead_aes256gcm.h
> > > ...
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/utils.h
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/version.h
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium.h
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.23.dylib
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.a
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.dylib
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig
> > > /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
> > > /opt/homebrew/lib/libsodium.23.dylib
> > > /opt/homebrew/lib/libsodium.a
> > > /opt/homebrew/lib/libsodium.dylib
> > > /opt/homebrew/lib/pkgconfig/libsodium.pc
> > > /opt/homebrew/opt/libsodium
> > > /opt/homebrew/var/homebrew/linked/libsodium
> > > 
> > > What do I need to use to stop the:Can't build with libsodium: not found
> > > 
> > > Sorry these are such stupid questions.
> > > 
> > > James.
> > 
> > You accidentically used a UTF-8 special dash instead of two normal dashes.
> > 
> > Aki
> > 
> 
> 
> Yes, I think I picked that up. I think I might have typed it into the email 
> and it changed it (I’ve run the configure command so many times.)
> 
> CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
> LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib 
> LIBSODIUM_LIBS=-L/opt/homebrew/Cellar/libsodium ./configure 
> --with-ssl=openssl --with-mysql--with-sodium
> 
> Fails with:
> 
> checking for mysql_ssl_set in -lmysqlclient... yes
> checking for LIBSODIUM... no
> configure: error: Can't build with libsodium: not found
> 
> This is so frustrating, but I’ll be jumping for joy if we can get it to work.
> 
> James.

Dovecot uses pkg-config to find out about libsodium, and it seems you're 
missing libsodium.pc in whatever place mac uses to hide them.

Maybe the .pc file is in the homebrew directory somewhere and needs to be 
copied, or you can make it yourself. Make sure to change the version and paths.

prefix=/usr
exec_prefix=${prefix}
libdir=${prefix}/lib/x86_64-linux-gnu
includedir=${prefix}/include

Name: libsodium
Version: 1.0.18
Description: A modern and easy-to-use crypto library

Libs: -L${libdir} -lsodium
Libs.private:  -pthread 
Cflags: -I${includedir}

Aki

Re: Auth-worker, unknown scheme ARGON2ID

[James Brown]

> On 22 Feb 2023, at 5:33 pm, Aki Tuomi  wrote:
>> 
>> Thanks Aki, that was helpful. When I add that I get:
>> 
>> checking for LIBSODIUM... no
>> configure: error: Can't build with libsodium: not found
>> 
>> So I have to tell it where libsodium is.
>> 
>> Tried:
>> 
>> CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
>> LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib 
>> LIBSODIUM_LIBS=-L/opt/homebrew/Cellar/libsodium ./configure 
>> --with-ssl=openssl --with-mysql —with-sodium
>> 
>> But that gives:
>> 
>> configure: WARNING: Libtool does not cope well with whitespace in `pwd`
>> checking build system type... Invalid configuration `—-with-sodium': machine 
>> `—-with' not recognized
>> 
>> Location of libsodium:
>> 
>> % locate libsodium
>> /opt/homebrew/Cellar/libsodium
>> /opt/homebrew/Cellar/libsodium/1.0.18_1
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew/libsodium.rb
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/AUTHORS
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/ChangeLog
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/INSTALL_RECEIPT.json
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/LICENSE
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/README.markdown
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/include
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/core.h
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/crypto_aead_aes256gcm.h
>> ...
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/utils.h
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/version.h
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium.h
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.23.dylib
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.a
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.dylib
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig
>> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
>> /opt/homebrew/lib/libsodium.23.dylib
>> /opt/homebrew/lib/libsodium.a
>> /opt/homebrew/lib/libsodium.dylib
>> /opt/homebrew/lib/pkgconfig/libsodium.pc
>> /opt/homebrew/opt/libsodium
>> /opt/homebrew/var/homebrew/linked/libsodium
>> 
>> What do I need to use to stop the:Can't build with libsodium: not found
>> 
>> Sorry these are such stupid questions.
>> 
>> James.
> 
> You accidentically used a UTF-8 special dash instead of two normal dashes.
> 
> Aki
> 

Yes, I think I picked that up. I think I might have typed it into the email and 
it changed it (I’ve run the configure command so many times.)

CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib 
LIBSODIUM_LIBS=-L/opt/homebrew/Cellar/libsodium ./configure --with-ssl=openssl 
--with-mysql --with-sodium

Fails with:

checking for mysql_ssl_set in -lmysqlclient... yes
checking for LIBSODIUM... no
configure: error: Can't build with libsodium: not found

This is so frustrating, but I’ll be jumping for joy if we can get it to work.

James.

Re: Auth-worker, unknown scheme ARGON2ID

[Aki Tuomi]

> On 22/02/2023 07:48 EET James Brown  wrote:
> 
> 
> > On 22 Feb 2023, at 4:14 pm, Aki Tuomi  wrote:
> > 
> > 
> > > I’ve spent ages on this and am getting really desperate! :-(
> > > 
> > > CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
> > > LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl 
> > > --with-mysql
> > > ...
> > > Install prefix . : /usr/local
> > > File offsets ... : 64bit
> > > I/O polling  : kqueue
> > > I/O notifys  : kqueue
> > > SSL  : yes (OpenSSL)
> > > GSSAPI . : no
> > > passdbs  : static passwd passwd-file pam checkpassword sql
> > > : -shadow -bsdauth -ldap
> > > userdbs  : static prefetch passwd passwd-file checkpassword sql
> > > 
> > > sudo doveadm pw -l
> > > SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA 
> > > DES-CRYPT CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR 
> > > CLEARTEXT SSHA256 MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 
> > > LDAP-MD5
> > > 
> > > How do I get ARGON2I, ARGON2ID in that list?
> > > 
> > > Has anybody got Dovecot to work on recent macOS with these password 
> > > schemes? Any hints?
> > > 
> > > Thanks, James.
> > 
> > You need to use --with-sodium when building.
> > 
> > Aki
> 
> Thanks Aki, that was helpful. When I add that I get:
> 
> checking for LIBSODIUM... no
> configure: error: Can't build with libsodium: not found
> 
> So I have to tell it where libsodium is.
> 
> Tried:
> 
> CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
> LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib 
> LIBSODIUM_LIBS=-L/opt/homebrew/Cellar/libsodium ./configure 
> --with-ssl=openssl --with-mysql —with-sodium
> 
> 
> But that gives:
> 
> configure: WARNING: Libtool does not cope well with whitespace in `pwd`
> checking build system type... Invalid configuration `—-with-sodium': machine 
> `—-with' not recognized
> 
> Location of libsodium:
> 
> % locate libsodium
> /opt/homebrew/Cellar/libsodium
> /opt/homebrew/Cellar/libsodium/1.0.18_1
> /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew
> /opt/homebrew/Cellar/libsodium/1.0.18_1/.brew/libsodium.rb
> /opt/homebrew/Cellar/libsodium/1.0.18_1/AUTHORS
> /opt/homebrew/Cellar/libsodium/1.0.18_1/ChangeLog
> /opt/homebrew/Cellar/libsodium/1.0.18_1/INSTALL_RECEIPT.json
> /opt/homebrew/Cellar/libsodium/1.0.18_1/LICENSE
> /opt/homebrew/Cellar/libsodium/1.0.18_1/README.markdown
> /opt/homebrew/Cellar/libsodium/1.0.18_1/include
> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium
> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/core.h
> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/crypto_aead_aes256gcm.h
> ...
> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/utils.h
> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/version.h
> /opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium.h
> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib
> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.23.dylib
> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.a
> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.dylib
> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig
> /opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
> /opt/homebrew/lib/libsodium.23.dylib
> /opt/homebrew/lib/libsodium.a
> /opt/homebrew/lib/libsodium.dylib
> /opt/homebrew/lib/pkgconfig/libsodium.pc
> /opt/homebrew/opt/libsodium
> /opt/homebrew/var/homebrew/linked/libsodium
> 
> What do I need to use to stop the:Can't build with libsodium: not found
> 
> Sorry these are such stupid questions.
> 
> James.

You accidentically used a UTF-8 special dash instead of two normal dashes.

Aki

Re: Auth-worker, unknown scheme ARGON2ID

[James Brown]

> On 22 Feb 2023, at 4:14 pm, Aki Tuomi  wrote:
> 
>> I’ve spent ages on this and am getting really desperate! :-(
>> 
>> CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
>> LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl 
>> --with-mysql
>> ...
>> Install prefix . : /usr/local
>> File offsets ... : 64bit
>> I/O polling  : kqueue
>> I/O notifys  : kqueue
>> SSL  : yes (OpenSSL)
>> GSSAPI . : no
>> passdbs  : static passwd passwd-file pam checkpassword sql
>> : -shadow -bsdauth -ldap
>> userdbs  : static prefetch passwd passwd-file checkpassword sql
>> 
>> sudo doveadm pw -l
>> SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT 
>> CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 
>> MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5
>> 
>> How do I get ARGON2I, ARGON2ID in that list?
>> 
>> Has anybody got Dovecot to work on recent macOS with these password schemes? 
>> Any hints?
>> 
>> Thanks, James.
> 
> You need to use --with-sodium when building.
> 
> Aki

Thanks Aki, that was helpful. When I add that I get:

checking for LIBSODIUM... no
configure: error: Can't build with libsodium: not found

So I have to tell it where libsodium is.

Tried:

CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib 
LIBSODIUM_LIBS=-L/opt/homebrew/Cellar/libsodium ./configure --with-ssl=openssl 
--with-mysql —with-sodium

But that gives:

configure: WARNING: Libtool does not cope well with whitespace in `pwd`
checking build system type... Invalid configuration `—-with-sodium': machine 
`—-with' not recognized

Location of libsodium:

 % locate libsodium
/opt/homebrew/Cellar/libsodium
/opt/homebrew/Cellar/libsodium/1.0.18_1
/opt/homebrew/Cellar/libsodium/1.0.18_1/.brew
/opt/homebrew/Cellar/libsodium/1.0.18_1/.brew/libsodium.rb
/opt/homebrew/Cellar/libsodium/1.0.18_1/AUTHORS
/opt/homebrew/Cellar/libsodium/1.0.18_1/ChangeLog
/opt/homebrew/Cellar/libsodium/1.0.18_1/INSTALL_RECEIPT.json
/opt/homebrew/Cellar/libsodium/1.0.18_1/LICENSE
/opt/homebrew/Cellar/libsodium/1.0.18_1/README.markdown
/opt/homebrew/Cellar/libsodium/1.0.18_1/include
/opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium
/opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/core.h
/opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/crypto_aead_aes256gcm.h
...
/opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/utils.h
/opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium/version.h
/opt/homebrew/Cellar/libsodium/1.0.18_1/include/sodium.h
/opt/homebrew/Cellar/libsodium/1.0.18_1/lib
/opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.23.dylib
/opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.a
/opt/homebrew/Cellar/libsodium/1.0.18_1/lib/libsodium.dylib
/opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig
/opt/homebrew/Cellar/libsodium/1.0.18_1/lib/pkgconfig/libsodium.pc
/opt/homebrew/lib/libsodium.23.dylib
/opt/homebrew/lib/libsodium.a
/opt/homebrew/lib/libsodium.dylib
/opt/homebrew/lib/pkgconfig/libsodium.pc
/opt/homebrew/opt/libsodium
/opt/homebrew/var/homebrew/linked/libsodium

What do I need to use to stop the: Can't build with libsodium: not found

Sorry these are such stupid questions. 

James.

Re: Redundant Database, Pgsql ?

[Marcus Jodorf]

On 2/21/23 18:04, Lars Schotte wrote:


Yes, that looks nice, I am going to try that too.

Because every other option is based on some other software,
like relayd or nginx, it is all possible, but adds complexity.

The best would be to have it inside connection string.


/etc/dovecot/dovecot-sql.conf.ext:

...
connect= host=host1 host=host2 dbname= user= password=


I'm using that since pretty much 2006 - if I'm not mistaken - on my 
little servers. Simply works.


If one server is not reachable you just get an error log entry in 
mail.err that connect failed to the database that is down.

But that is all - dovecot keeps working as normal.

BTW: Same with postfix. Simply list an additional fallback and it just 
works.


Best,

Marcus

Re: Auth-worker, unknown scheme ARGON2ID

[Aki Tuomi]

> On 22/02/2023 07:00 EET James Brown  wrote:
> 
> 
> On 21 Feb 2023, at 10:12 pm, James Brown  wrote:
> 
> > 
> > 
> > The new one has Dovecot compiled with same configure options, same 
> > configuration files, but fails to authenticate:
> > 
> > Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for 
> > imap, pop3 (core dumps disabled)
> > Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): 
> > auth-worker<1>: 
> > sql(jlbr...@bordo.com.au,::1,): Unknown 
> > scheme ARGON2ID
> > 
> > ./configure --with-ssl=openssl --with-mysql
> > 
> > Was what I used to compile.
> > 
> > Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura.
> > 
> > (Have also installed libsodium 1.0.18_1)
> > 
> > Any help would be most appreciated.
> > 
> > thanks,
> > 
> > James.
> 
> I’ve spent ages on this and am getting really desperate! :-(
> 
> CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
> LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl 
> --with-mysql
> 
> ...
> Install prefix . : /usr/local
> File offsets ... : 64bit
> I/O polling  : kqueue
> I/O notifys  : kqueue
> SSL  : yes (OpenSSL)
> GSSAPI . : no
> passdbs  : static passwd passwd-file pam checkpassword sql
> : -shadow -bsdauth -ldap
> userdbs  : static prefetch passwd passwd-file checkpassword sql
> 
> 
> sudo doveadm pw -l
> SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT 
> CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 
> MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5
> 
> How do I get ARGON2I, ARGON2ID in that list?
> 
> Has anybody got Dovecot to work on recent macOS with these password schemes? 
> Any hints?
> 
> Thanks, James.

You need to use --with-sodium when building.

Aki

Re: Auth-worker, unknown scheme ARGON2ID

[James Brown]

On 21 Feb 2023, at 10:12 pm, James Brown  wrote:
> 
> The new one has Dovecot compiled with same configure options, same 
> configuration files, but fails to authenticate:
> 
> Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for 
> imap, pop3 (core dumps disabled)
> Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): 
> auth-worker<1>: 
> sql(jlbr...@bordo.com.au,::1,): Unknown 
> scheme ARGON2ID
> 
> ./configure --with-ssl=openssl --with-mysql
> 
> Was what I used to compile.
> 
> Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura.
> 
> (Have also installed libsodium 1.0.18_1)
> 
> Any help would be most appreciated.
> 
> thanks,
> 
> James.


I’ve spent ages on this and am getting really desperate! :-(

CPPFLAGS=-I/opt/homebrew/Cellar/openssl@3/3.0.8/include 
LDFLAGS=-L/opt/homebrew/opt/openssl@3/lib ./configure --with-ssl=openssl 
--with-mysql

...
Install prefix . : /usr/local
File offsets ... : 64bit
I/O polling  : kqueue
I/O notifys  : kqueue
SSL  : yes (OpenSSL)
GSSAPI . : no
passdbs  : static passwd passwd-file pam checkpassword sql
 : -shadow -bsdauth -ldap
userdbs  : static prefetch passwd passwd-file checkpassword sql


sudo doveadm pw -l  
SHA1 SSHA512 SCRAM-SHA-256 BLF-CRYPT PLAIN HMAC-MD5 OTP SHA512 SHA DES-CRYPT 
CRYPT SSHA MD5-CRYPT PLAIN-MD4 PLAIN-MD5 SCRAM-SHA-1 CLEAR CLEARTEXT SSHA256 
MD5 PBKDF2 SHA256 CRAM-MD5 PLAIN-TRUNC SMD5 DIGEST-MD5 LDAP-MD5 

How do I get ARGON2I, ARGON2ID in that list?

Has anybody got Dovecot to work on recent macOS with these password schemes? 
Any hints?

Thanks, James.

Re: Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?

[Ben Burk]

I would definitely get mail-crypt working on your system before worrying 
about encrypting existing emails. Iirc dovecot should support both types 
of files (encrypted, and non-encrypted) concurrently. So BEFORE you try 
anything, make sure via logs, etc that mail is being written to the fs 
as an encrypted file and that dovecot is able to decrypt it (i.e. you 
are able to view that particular mail file from your email client).


My specific use case way back was to encrypt a maildir system using this 
plugin a year or so ago. I believe there are 2 ways to set mail-crypt 
up. Using global keys or folder-specific keys. What you will learn going 
through this process using folder-specific keys is that any time mail is 
moved (from an IMAP directory to another) the mail becomes effectively 
re-encrypted using the destination's folder keys. I imagine how this 
works under global keys is that the mail is encrypted once when it is 
moved, then never again unless keys change. So all you would need to do 
to encrypt existing mail using either method would be to create a temp 
imap folder, move mail from each IMAP folder one at a time into this 
temp folder, then back to the original IMAP folder.


I had a few questions at the time in implementing this, so I've linked 
here the dovecot mailing list thread so it might provide some context if 
needed:


https://dovecot.org/pipermail/dovecot/2021-July/122469.html


On 2/21/23 16:29, Jeremy wrote:

On Tuesday, February 21st, 2023 at 09:54, Aki Tuomi 
 wrote:



On 16/02/2023 07:18 EET mailinglist-subscriptions 
mailinglist-subscripti...@protonmail.com wrote:

Hi,

I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for 
managing virtual accounts.

I'd like to start using the mail-crypt plugin. However, I'm having a bit some 
difficulty understanding the documentation at

https://doc.dovecot.org/configuration_manual/mail_crypt_plugin

to reach my goal. I plan to ask questions about those issues by starting new 
threads in this mailing list. But before I even come to that, I'd like to 
investigate the following:

The above documentation only addresses a clean install and doesn't seem to 
mention encrypting already existent unencrypted mails, like my server has. Is 
it possible to encrypt those before I start using the mail-crypt plugin, such 
that it will be able to decrypt those messages as well?

If it is, I am assuming that how I would go about achieving that will be very 
dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). 
So I don't expect a full-fledged guide. However, if you could perhaps give a 
general overview of what would be needed to achieve this, I would very much 
appreciate that.

Thank you.


It will be easiest to do migration to new server, then the data will get 
encrypted while migrating. It is possible to write a script to do this, but 
will be much more hassle than migration.

You might even be able to do it for one user at a time, by doing migration from 
maildir to maildir and then moving the new maildir over the old one.

Aki

Thanks for the suggestion. However, migrating sounds like quite the hassle as 
well.

Now, I have next to no knowledge about the synchronization workings of IMAP, so 
perhaps this is totally infeasible, but could the following work?

- Preface
I am the only user of the mail server, with one virtual catch-all account for 
each domain I own. I access these accounts with Thunderbird.

- Solution
I make a backup of all mail in my Thunderbird accounts. Then I either delete 
all mails from within Thunderbird, or on the server. Then I configure the 
mail-crypt plugin. And then I import all backup mails and folders into my 
Thunderbird accounts again?

Could that work? Or would that mess up the synchronization history (message IDs 
and what not)? And most importantly, if it actually could work, would the 
messages be properly encrypted then?

Re: Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?

[Jeremy]

On Tuesday, February 21st, 2023 at 09:54, Aki Tuomi 
 wrote:


> > On 16/02/2023 07:18 EET mailinglist-subscriptions 
> > mailinglist-subscripti...@protonmail.com wrote:
> > 
> > Hi,
> > 
> > I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for 
> > managing virtual accounts.
> > 
> > I'd like to start using the mail-crypt plugin. However, I'm having a bit 
> > some difficulty understanding the documentation at
> > 
> > https://doc.dovecot.org/configuration_manual/mail_crypt_plugin
> > 
> > to reach my goal. I plan to ask questions about those issues by starting 
> > new threads in this mailing list. But before I even come to that, I'd like 
> > to investigate the following:
> > 
> > The above documentation only addresses a clean install and doesn't seem to 
> > mention encrypting already existent unencrypted mails, like my server has. 
> > Is it possible to encrypt those before I start using the mail-crypt plugin, 
> > such that it will be able to decrypt those messages as well?
> > 
> > If it is, I am assuming that how I would go about achieving that will be 
> > very dependent on the ultimate configuration I have in mind (pub/priv keys, 
> > etc.). So I don't expect a full-fledged guide. However, if you could 
> > perhaps give a general overview of what would be needed to achieve this, I 
> > would very much appreciate that.
> > 
> > Thank you.
> 
> 
> It will be easiest to do migration to new server, then the data will get 
> encrypted while migrating. It is possible to write a script to do this, but 
> will be much more hassle than migration.
> 
> You might even be able to do it for one user at a time, by doing migration 
> from maildir to maildir and then moving the new maildir over the old one.
> 
> Aki

Thanks for the suggestion. However, migrating sounds like quite the hassle as 
well.

Now, I have next to no knowledge about the synchronization workings of IMAP, so 
perhaps this is totally infeasible, but could the following work?

- Preface
I am the only user of the mail server, with one virtual catch-all account for 
each domain I own. I access these accounts with Thunderbird.

- Solution
I make a backup of all mail in my Thunderbird accounts. Then I either delete 
all mails from within Thunderbird, or on the server. Then I configure the 
mail-crypt plugin. And then I import all backup mails and folders into my 
Thunderbird accounts again?

Could that work? Or would that mess up the synchronization history (message IDs 
and what not)? And most importantly, if it actually could work, would the 
messages be properly encrypted then?

Re: Redundant Database, Pgsql ?

[Benny Pedersen]

Lars Schotte skrev den 2023-02-21 18:04:

Yes, that looks nice, I am going to try that too.


+1


Because every other option is based on some other software,
like relayd or nginx, it is all possible, but adds complexity.


+1


The best would be to have it inside connection string.


real fix or even possible is to add failback host=, eg host=localhost 
failbackfrom=dbi:/path-to-sqlite3 file, with is just cache from 
postgresql, then postgres can be down, if cache holds the wather


all this imho needs code changes, the cache must not be write cache, 
only read cache


that means it cant work for dict unless dict is sqlite aswell

Re: Redundant Database, Pgsql ?

[Lars Schotte]

Yes, that looks nice, I am going to try that too.

Because every other option is based on some other software,
like relayd or nginx, it is all possible, but adds complexity.

The best would be to have it inside connection string.

On Sun, 2023-02-19 at 17:34 +, David White wrote:
> Take a look at 
> https://www.citusdata.com/blog/2021/02/12/reconnecting-your-app-after-a-postgres-failover/
> . Perhaps that's what you're looking for, namely, the section on
> "Multi-Hosts Connection Strings, thanks to libpq"
-- 
 Lars Schotte
 Mudroňova 13
92101 Piešťany

Re: Redundant Database, Pgsql ?

[Brendan Kearney]

let me preface all of this by saying i dont have PostgreSQL running in 
any fashion, but have come across footprints that are standing in a 
Production environment.


are you running a single primary R/W node, with multiple secondary R/O 
nodes?  from what i have seen/heard, PG does not really have a well 
documented and currently support n-way multi-primary R/W load balancing 
mechanism.  that said, some effort did exist but may no longer be supported.


i have seen a HA footprint of PG setup with HAProxy, PostgreSQL, ETCd 
and Patroni.  HAProxy handles the Virtual IP (VIP) and can be setup as 
HA with VRRP running between the HAProxy nodes.  ETCd is setup with 3 
nodes, all monitoring the "active" status of the PostgreSQL nodes via 
Patroni.  Patroni runs on each PG node, watching the status of the PG 
instances for failures.  PG runs with one node in the "active" state, 
and replicates to the secondary nodes running in the "standby" state.


when the primary node encounters an issue, Patroni idenitifies that the 
node is no longer able to process, and ETCd records the updated status.  
HAProxy polls ETCd and is notified of the event, and marks the 
previously "active" member as down or in standby state.  by election 
process, the standby nodes promote a node to the active state, and the 
Patroni -> ETCd -> HAProxy chain picks up the new active node.


it requires a bit of supporting infrastructure to get it all working, 
but you wind up with a highly-available, fault tolerant PostgreSQL 
footprint with automatic failover.  the caveat is that you only have a 
single R/W instance at any one point.  this could be a performance 
bottleneck in high volume environments.


some links that may shed light on what and how:

https://wiki.postgresql.org/wiki/Replication,_Clustering,_and_Connection_Pooling
https://patroni.readthedocs.io/en/latest/
https://www.percona.com/blog/postgresql-ha-with-patroni-your-turn-to-test-failure-scenarios/
https://arctype.com/blog/postgres-patroni/

i do have a n-way multi-primary MariaDB footprint running with HAProxy, 
MariaDB and Galera running.  Each MariaDB instance is R/W and can take a 
write event, and then replicate the event to the other cluster members.  
the VIP on HAProxy for port 3306 has all three cluster members load 
balanced using least connections.  on the same VIP, but using a 
different port (3316, 3326, 3336) i have a backend for each of the 
individual cluster members, so i can isolate and troubleshoot each node 
separately.


in the PostgreSQL footprints i have come across, a similar setup using 
other ports has been used for access to the R/O nodes in the cluster.  
this can allow for queries, instead of writes, and reporting functionality.


best of luck,

brendan kearney

On 2/21/23 4:02 AM, Paul Kudla (SCOM.CA Internet Services Inc.) wrote:


yes that seems to be the approach

i setup a dns entry and pointed to 3 servers

it does work round robin (ie from main, secondary etc) but that is ok

at least it is working when i take the main server offline for 
maintenance !





Happy Tuesday !!!
Thanks - paul

Paul Kudla


Scom.ca Internet Services 
004-1009 Byron Street South
Whitby, Ontario - Canada
L1N 4S3

Toronto 416.642.7266
Main 1.866.411.7266
Fax 1.888.892.7266
Email p...@scom.ca

On 2023-02-19 12:56 p.m., Benny Pedersen wrote:


Paul Kudla skrev den 2023-02-19 16:01:

May I please get some guidance on what to add to talk to another
postgresql server (i have 6 replicated servers so would probably want
a couple worst case issue)


change host=localhost to host=some-other-hostname-with-multiple-ips :)

then dovecot with timeout and test next server ip

there might be more to it, but i think this is how to do it

Auth-worker, unknown scheme ARGON2ID

[James Brown]

On my current mail server I was able to upgrade everyone’s password scheme to 
ARGON2ID with no issues, I just had to have:
service auth {
   vsz_limit = 0
}
This was an older version of macOS than the new server I’m trying to migrate to.

The new one has Dovecot compiled with same configure options, same 
configuration files, but fails to authenticate:

Feb 21 21:51:03 master: Info: Dovecot v2.3.20 (80a5ac675d) starting up for 
imap, pop3 (core dumps disabled)
Feb 21 21:51:33 auth-worker(11701): Error: conn unix:auth-worker (uid=214): 
auth-worker<1>: 
sql(jlbr...@bordo.com.au,::1,): Unknown scheme 
ARGON2ID

./configure --with-ssl=openssl --with-mysql

Was what I used to compile.

Using OpenSSL 3.0.8. New server is running macOS 13.2.1 Ventura.

(Have also installed libsodium 1.0.18_1)

Any help would be most appreciated.

thanks,

James.

Re: Redundant Database, Pgsql ?

[Paul Kudla (SCOM.CA Internet Services Inc.)]

yes that seems to be the approach

i setup a dns entry and pointed to 3 servers

it does work round robin (ie from main, secondary etc) but that is ok

at least it is working when i take the main server offline for maintenance !




Happy Tuesday !!!
Thanks - paul

Paul Kudla


Scom.ca Internet Services 
004-1009 Byron Street South
Whitby, Ontario - Canada
L1N 4S3

Toronto 416.642.7266
Main 1.866.411.7266
Fax 1.888.892.7266
Email p...@scom.ca

On 2023-02-19 12:56 p.m., Benny Pedersen wrote:


Paul Kudla skrev den 2023-02-19 16:01:

May I please get some guidance on what to add to talk to another
postgresql server (i have 6 replicated servers so would probably want
a couple worst case issue)


change host=localhost to host=some-other-hostname-with-multiple-ips :)

then dovecot with timeout and test next server ip

there might be more to it, but i think this is how to do it

Re: Can I encrypt already existant unencrypted mail before I start using the mail-crypt plugin?

[Aki Tuomi]

> On 16/02/2023 07:18 EET mailinglist-subscriptions 
>  wrote:
> 
>  
> Hi,
> 
> I am using dovecot 2.3.16, along with postfix and a PostgreSQL database for 
> managing virtual accounts.
> 
> I'd like to start using the mail-crypt plugin. However, I'm having a bit some 
> difficulty understanding the documentation at 
> 
> https://doc.dovecot.org/configuration_manual/mail_crypt_plugin 
> 
> to reach my goal. I plan to ask questions about those issues by starting new 
> threads in this mailing list. But before I even come to that, I'd like to 
> investigate the following:
> 
> The above documentation only addresses a clean install and doesn't seem to 
> mention encrypting already existent unencrypted mails, like my server has. Is 
> it possible to encrypt those before I start using the mail-crypt plugin, such 
> that it will be able to decrypt those messages as well?
> 
> If it is, I am assuming that how I would go about achieving that will be very 
> dependent on the ultimate configuration I have in mind (pub/priv keys, etc.). 
> So I don't expect a full-fledged guide. However, if you could perhaps give a 
> general overview of what would be needed to achieve this, I would very much 
> appreciate that.
> 
> Thank you.

It will be easiest to do migration to new server, then the data will get 
encrypted while migrating. It is possible to write a script to do this, but 
will be much more hassle than migration.

You might even be able to do it for one user at a time, by doing migration from 
maildir to maildir and then moving the new maildir over the old one.

Aki