Merge branch 'master' into update-base-image

.github/workflows/generic_build.yml

@@ -64,7 +64,7 @@ jobs:
       # When full, the least accessed cache upload is evicted to free up storage.
       # https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows
       - name: 'Handle Docker build layer cache'
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: /tmp/.buildx-cache
           key: cache-buildx-${{ steps.derive-image-cache-key.outputs.digest }}

.github/workflows/generic_publish.yml

@@ -46,7 +46,7 @@ jobs:
       # NOTE: Until adopting `type=gha` scoped cache exporter (in `docker/build-push-action`),
       # only AMD64 image is expected to be cached, ARM images will build from scratch.
       - name: 'Retrieve image build from build cache'
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: /tmp/.buildx-cache
           key: cache-buildx-${{ inputs.cache-key }}

.github/workflows/generic_test.yml

@@ -29,7 +29,7 @@ jobs:
       # This should always be a cache-hit, thus `restore-keys` fallback is not used.
       # No new cache uploads should ever happen for this job.
       - name: 'Retrieve image built from build cache'
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: /tmp/.buildx-cache
           key: cache-buildx-${{ inputs.cache-key }}

.github/workflows/generic_vulnerability-scan.yml

@@ -28,7 +28,7 @@ jobs:
       # This should always be a cache-hit, thus `restore-keys` fallback is not used.
       # No new cache uploads should ever happen for this job.
       - name: 'Retrieve image built from build cache'
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: /tmp/.buildx-cache
           key: cache-buildx-${{ inputs.cache-key }}
@@ -55,7 +55,7 @@ jobs:
           provenance: false
 
       - name: 'Run the Anchore Grype scan action'
-        uses: anchore/scan-action@v3.5.0
+        uses: anchore/scan-action@v3.6.0
         id: scan
         with:
           image: mailserver-testing:ci

CHANGELOG.md

@@ -33,6 +33,13 @@ The most noteworthy change of this release is the update of the container's base
     - `smtpd_relay_restrictions` (relay policy) is now evaluated after `smtpd_recipient_restrictions` (spam policy). Previously it was evaluated before `smtpd_recipient_restrictions`. Mail to be relayed via DMS must now pass through the spam policy first.
     - The TLS fingerprint policy has changed the default from MD5 to SHA256 (_DMS does not modify this Postfix parameter, but may affect any user customizations that do_).
 
+### Fixes
+
+- **Dovecot:**
+  - Restrict the auth mechanisms for PassDB configs we manage (oauth2, passwd-file, ldap) ([#3812](https://github.com/docker-mailserver/docker-mailserver/pull/3812))
+    - Prevents misleading auth failures from attempting to authenticate against a PassDB with incompatible auth mechanisms.
+    - When the new OAuth2 feature was enabled, it introduced false-positives with logged auth failures which triggered Fail2Ban to ban the IP.
+
 ## [v13.3.0](https://github.com/docker-mailserver/docker-mailserver/releases/tag/v13.3.0)
 
 ### Features

CONTRIBUTORS.md

@@ -814,14 +814,21 @@ Thanks goes to these wonderful people ✨
             <sub><b>fl42</b></sub>
         </a>
     </td>
+    <td align="center">
+        <a href="https://github.com/nilshoell">
+            <img src="https://avatars.githubusercontent.com/u/33981934?v=4" width="100;" alt="nilshoell"/>
+            <br />
+            <sub><b>nilshoell</b></sub>
+        </a>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/stigok">
             <img src="https://avatars.githubusercontent.com/u/952936?v=4" width="100;" alt="stigok"/>
             <br />
             <sub><b>stigok</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/5ven">
             <img src="https://avatars.githubusercontent.com/u/17012?v=4" width="100;" alt="5ven"/>
@@ -856,15 +863,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>thomasschmit</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/Thiritin">
             <img src="https://avatars.githubusercontent.com/u/6755282?v=4" width="100;" alt="Thiritin"/>
             <br />
             <sub><b>Thiritin</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/tweibert">
             <img src="https://avatars.githubusercontent.com/u/2368685?v=4" width="100;" alt="tweibert"/>
@@ -899,15 +906,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>k3it</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/Drakulix">
             <img src="https://avatars.githubusercontent.com/u/4404502?v=4" width="100;" alt="Drakulix"/>
             <br />
             <sub><b>Drakulix</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/vilisas">
             <img src="https://avatars.githubusercontent.com/u/34487517?v=4" width="100;" alt="vilisas"/>
@@ -942,13 +949,6 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>allddd</b></sub>
         </a>
-    </td>
-    <td align="center">
-        <a href="https://github.com/nilshoell">
-            <img src="https://avatars.githubusercontent.com/u/33981934?v=4" width="100;" alt="nilshoell"/>
-            <br />
-            <sub><b>nilshoell</b></sub>
-        </a>
     </td></tr>
 <tr>
     <td align="center">
@@ -1022,21 +1022,28 @@ Thanks goes to these wonderful people ✨
             <sub><b>romansey</b></sub>
         </a>
     </td>
+    <td align="center">
+        <a href="https://github.com/norrs">
+            <img src="https://avatars.githubusercontent.com/u/272215?v=4" width="100;" alt="norrs"/>
+            <br />
+            <sub><b>norrs</b></sub>
+        </a>
+    </td>
     <td align="center">
         <a href="https://github.com/MightySCollins">
             <img src="https://avatars.githubusercontent.com/u/8594759?v=4" width="100;" alt="MightySCollins"/>
             <br />
             <sub><b>MightySCollins</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/501st-alpha1">
             <img src="https://avatars.githubusercontent.com/u/676533?v=4" width="100;" alt="501st-alpha1"/>
             <br />
             <sub><b>501st-alpha1</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/klamann">
             <img src="https://avatars.githubusercontent.com/u/1008877?v=4" width="100;" alt="klamann"/>
@@ -1071,15 +1078,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>sjmudd</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/simonsystem">
             <img src="https://avatars.githubusercontent.com/u/5014686?v=4" width="100;" alt="simonsystem"/>
             <br />
             <sub><b>simonsystem</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/stephan-devop">
             <img src="https://avatars.githubusercontent.com/u/59093905?v=4" width="100;" alt="stephan-devop"/>
@@ -1114,15 +1121,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>okamidash</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/olaf-mandel">
             <img src="https://avatars.githubusercontent.com/u/918687?v=4" width="100;" alt="olaf-mandel"/>
             <br />
             <sub><b>olaf-mandel</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/ontheair81">
             <img src="https://avatars.githubusercontent.com/u/6220584?v=4" width="100;" alt="ontheair81"/>
@@ -1157,15 +1164,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>rmlhuk</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/rriski">
             <img src="https://avatars.githubusercontent.com/u/25483483?v=4" width="100;" alt="rriski"/>
             <br />
             <sub><b>rriski</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/schnippl0r">
             <img src="https://avatars.githubusercontent.com/u/58435847?v=4" width="100;" alt="schnippl0r"/>
@@ -1200,15 +1207,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>strarsis</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/tamueller">
             <img src="https://avatars.githubusercontent.com/u/1902960?v=4" width="100;" alt="tamueller"/>
             <br />
             <sub><b>tamueller</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/vivacarvajalito">
             <img src="https://avatars.githubusercontent.com/u/1446654?v=4" width="100;" alt="vivacarvajalito"/>
@@ -1243,15 +1250,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>arcaine2</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/awb99">
             <img src="https://avatars.githubusercontent.com/u/10854682?v=4" width="100;" alt="awb99"/>
             <br />
             <sub><b>awb99</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/brainkiller">
             <img src="https://avatars.githubusercontent.com/u/1619562?v=4" width="100;" alt="brainkiller"/>
@@ -1286,15 +1293,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>eleith</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/ghnp5">
             <img src="https://avatars.githubusercontent.com/u/57591332?v=4" width="100;" alt="ghnp5"/>
             <br />
             <sub><b>ghnp5</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/helmutundarnold">
             <img src="https://avatars.githubusercontent.com/u/12536684?v=4" width="100;" alt="helmutundarnold"/>
@@ -1329,15 +1336,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>ixeft</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/jjtt">
             <img src="https://avatars.githubusercontent.com/u/3908945?v=4" width="100;" alt="jjtt"/>
             <br />
             <sub><b>jjtt</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/paralax">
             <img src="https://avatars.githubusercontent.com/u/5619153?v=4" width="100;" alt="paralax"/>
@@ -1372,15 +1379,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>marios88</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/matrixes">
             <img src="https://avatars.githubusercontent.com/u/46491408?v=4" width="100;" alt="matrixes"/>
             <br />
             <sub><b>matrixes</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/mchamplain">
             <img src="https://avatars.githubusercontent.com/u/759989?v=4" width="100;" alt="mchamplain"/>
@@ -1388,13 +1395,6 @@ Thanks goes to these wonderful people ✨
             <sub><b>mchamplain</b></sub>
         </a>
     </td>
-    <td align="center">
-        <a href="https://github.com/0xflotus">
-            <img src="https://avatars.githubusercontent.com/u/26602940?v=4" width="100;" alt="0xflotus"/>
-            <br />
-            <sub><b>0xflotus</b></sub>
-        </a>
-    </td>
     <td align="center">
         <a href="https://github.com/auchri">
             <img src="https://avatars.githubusercontent.com/u/5092164?v=4" width="100;" alt="auchri"/>
@@ -1452,21 +1452,28 @@ Thanks goes to these wonderful people ✨
             <sub><b>danielvandenberg95</b></sub>
         </a>
     </td>
+    <td align="center">
+        <a href="https://github.com/denisix">
+            <img src="https://avatars.githubusercontent.com/u/28725839?v=4" width="100;" alt="denisix"/>
+            <br />
+            <sub><b>denisix</b></sub>
+        </a>
+    </td>
     <td align="center">
         <a href="https://github.com/mlatorre31">
             <img src="https://avatars.githubusercontent.com/u/5250322?v=4" width="100;" alt="mlatorre31"/>
             <br />
             <sub><b>mlatorre31</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/mazzz1y">
             <img src="https://avatars.githubusercontent.com/u/17034108?v=4" width="100;" alt="mazzz1y"/>
             <br />
             <sub><b>mazzz1y</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/aydodo">
             <img src="https://avatars.githubusercontent.com/u/5312040?v=4" width="100;" alt="aydodo"/>
@@ -1501,15 +1508,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>ekkis</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/ErikEngerd">
             <img src="https://avatars.githubusercontent.com/u/8929027?v=4" width="100;" alt="ErikEngerd"/>
             <br />
             <sub><b>ErikEngerd</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/huncode">
             <img src="https://avatars.githubusercontent.com/u/1650008?v=4" width="100;" alt="huncode"/>
@@ -1532,12 +1539,20 @@ Thanks goes to these wonderful people ✨
         </a>
     </td>
     <td align="center">
-        <a href="https://github.com/froks">
+        <a href="https://github.com/thechubbypanda">
-            <img src="https://avatars.githubusercontent.com/u/734686?v=4" width="100;" alt="froks"/>
+            <img src="https://avatars.githubusercontent.com/u/33595996?v=4" width="100;" alt="thechubbypanda"/>
             <br />
-            <sub><b>froks</b></sub>
+            <sub><b>thechubbypanda</b></sub>
         </a>
     </td>
+    <td align="center">
+        <a href="https://github.com/0xflotus">
+            <img src="https://avatars.githubusercontent.com/u/26602940?v=4" width="100;" alt="0xflotus"/>
+            <br />
+            <sub><b>0xflotus</b></sub>
+        </a>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/ifokeev">
             <img src="https://avatars.githubusercontent.com/u/2017148?v=4" width="100;" alt="ifokeev"/>
@@ -1551,8 +1566,7 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>20th</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/2b">
             <img src="https://avatars.githubusercontent.com/u/829041?v=4" width="100;" alt="2b"/>
@@ -1580,7 +1594,8 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>vifino</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/kachkaev">
             <img src="https://avatars.githubusercontent.com/u/608862?v=4" width="100;" alt="kachkaev"/>
@@ -1594,8 +1609,7 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>alexanderneu</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/ch3sh1r">
             <img src="https://avatars.githubusercontent.com/u/441777?v=4" width="100;" alt="ch3sh1r"/>
@@ -1623,7 +1637,8 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>green-anger</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/iRhonin">
             <img src="https://avatars.githubusercontent.com/u/13151232?v=4" width="100;" alt="iRhonin"/>
@@ -1637,8 +1652,7 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>MrFreezeex</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/arunvc">
             <img src="https://avatars.githubusercontent.com/u/9069988?v=4" width="100;" alt="arunvc"/>
@@ -1666,7 +1680,8 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>spock</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/erdos4d">
             <img src="https://avatars.githubusercontent.com/u/72926946?v=4" width="100;" alt="erdos4d"/>
@@ -1680,14 +1695,6 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>crash7</b></sub>
         </a>
-    </td></tr>
-<tr>
-    <td align="center">
-        <a href="https://github.com/fkefer">
-            <img src="https://avatars.githubusercontent.com/u/1140674?v=4" width="100;" alt="fkefer"/>
-            <br />
-            <sub><b>fkefer</b></sub>
-        </a>
     </td>
     <td align="center">
         <a href="https://github.com/KCrawley">
@@ -1716,15 +1723,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>LeoWinterDE</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/linhandev">
             <img src="https://avatars.githubusercontent.com/u/29757093?v=4" width="100;" alt="linhandev"/>
             <br />
             <sub><b>linhandev</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/luke-">
             <img src="https://avatars.githubusercontent.com/u/4736168?v=4" width="100;" alt="luke-"/>
@@ -1759,15 +1766,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>maxemann96</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/dragetd">
             <img src="https://avatars.githubusercontent.com/u/3639577?v=4" width="100;" alt="dragetd"/>
             <br />
             <sub><b>dragetd</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/michaeljensen">
             <img src="https://avatars.githubusercontent.com/u/3026633?v=4" width="100;" alt="michaeljensen"/>
@@ -1802,15 +1809,15 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>MohammedNoureldin</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/mpldr">
             <img src="https://avatars.githubusercontent.com/u/33086936?v=4" width="100;" alt="mpldr"/>
             <br />
             <sub><b>mpldr</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/naveensrinivasan">
             <img src="https://avatars.githubusercontent.com/u/172697?v=4" width="100;" alt="naveensrinivasan"/>
@@ -1832,6 +1839,21 @@ Thanks goes to these wonderful people ✨
             <sub><b>radicand</b></sub>
         </a>
     </td>
+    <td align="center">
+        <a href="https://github.com/froks">
+            <img src="https://avatars.githubusercontent.com/u/734686?v=4" width="100;" alt="froks"/>
+            <br />
+            <sub><b>froks</b></sub>
+        </a>
+    </td>
+    <td align="center">
+        <a href="https://github.com/fkefer">
+            <img src="https://avatars.githubusercontent.com/u/1140674?v=4" width="100;" alt="fkefer"/>
+            <br />
+            <sub><b>fkefer</b></sub>
+        </a>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/frugan-dev">
             <img src="https://avatars.githubusercontent.com/u/7957714?v=4" width="100;" alt="frugan-dev"/>
@@ -1852,8 +1874,7 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>glandais</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/GiovanH">
             <img src="https://avatars.githubusercontent.com/u/6759280?v=4" width="100;" alt="GiovanH"/>
@@ -1874,7 +1895,8 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>HeySora</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/sirgantrithon">
             <img src="https://avatars.githubusercontent.com/u/3400609?v=4" width="100;" alt="sirgantrithon"/>
@@ -1895,8 +1917,7 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>jcalfee</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/mivek">
             <img src="https://avatars.githubusercontent.com/u/9912558?v=4" width="100;" alt="mivek"/>
@@ -1917,7 +1938,8 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>Jeidnx</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/JiLleON">
             <img src="https://avatars.githubusercontent.com/u/28780165?v=4" width="100;" alt="JiLleON"/>
@@ -1938,8 +1960,7 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>jmccl</b></sub>
         </a>
-    </td></tr>
+    </td>
-<tr>
     <td align="center">
         <a href="https://github.com/jurekbarth">
             <img src="https://avatars.githubusercontent.com/u/4249843?v=4" width="100;" alt="jurekbarth"/>
@@ -1960,20 +1981,14 @@ Thanks goes to these wonderful people ✨
             <br />
             <sub><b>Kaan88</b></sub>
         </a>
-    </td>
+    </td></tr>
+<tr>
     <td align="center">
         <a href="https://github.com/akkumar">
             <img src="https://avatars.githubusercontent.com/u/38454?v=4" width="100;" alt="akkumar"/>
             <br />
             <sub><b>akkumar</b></sub>
         </a>
-    </td>
-    <td align="center">
-        <a href="https://github.com/thechubbypanda">
-            <img src="https://avatars.githubusercontent.com/u/33595996?v=4" width="100;" alt="thechubbypanda"/>
-            <br />
-            <sub><b>thechubbypanda</b></sub>
-        </a>
     </td></tr>
 </table>
 <!-- readme: collaborators,contributors -end -->

mailserver.env

@@ -388,7 +388,7 @@ SPAMASSASSIN_SPAM_TO_INBOX=1
 # spam messages will be moved in the Junk folder (SPAMASSASSIN_SPAM_TO_INBOX=1 required)
 MOVE_SPAM_TO_JUNK=1
 
-# spam messages wil be marked as read
+# spam messages will be marked as read
 MARK_SPAM_AS_READ=0
 
 # add 'spam info' headers at, or above this level

target/dovecot/auth-ldap.conf.ext

@@ -0,0 +1,21 @@
+# NOTE: This is effectively the same default LDAP config shipped by Dovecot
+# The only difference is the addition of the passdb mechanisms field,
+# which restricts what auth mechanisms are supported / expected.
+# This prevents unnecessary auth failure logs triggering Fail2Ban when
+# additional passdb are enabled (OAuth2).
+
+passdb {
+  driver = ldap
+  mechanism = plain login
+
+  # Path for LDAP configuration file, see example-config/dovecot-ldap.conf.ext
+  args = /etc/dovecot/dovecot-ldap.conf.ext
+}
+
+userdb {
+  driver = ldap
+  args = /etc/dovecot/dovecot-ldap.conf.ext
+
+  # Default fields can be used to specify defaults that LDAP may override
+  #default_fields = home=/home/virtual/%u
+}

target/dovecot/auth-oauth2.conf.ext

@@ -1,5 +1,12 @@
+# Allow clients to use these additional mechanisms:
 auth_mechanisms = $auth_mechanisms oauthbearer xoauth2
 
+# Dovecot docs consider the oauth2 driver as a "success/failure" type PassDB:
+# https://doc.dovecot.org/configuration_manual/authentication/password_databases_passdb/#success-failure-database
+# Which implies it cannot be configured for the non-plaintext SASL mechanisms listed here:
+# https://doc.dovecot.org/configuration_manual/authentication/authentication_mechanisms/#dovecot-supports-the-following-non-plaintext-mechanisms
+# However that is not the case, these mechanisms are still valid to prevent trying other incompatible mechanisms (like `plain`).
+
 passdb {
     driver = oauth2
     mechanisms = xoauth2 oauthbearer

target/dovecot/auth-passwdfile.inc

@@ -9,6 +9,7 @@
 
 passdb {
   driver = passwd-file
+  mechanisms = plain login
   args = scheme=SHA512-CRYPT username_format=%u /etc/dovecot/userdb
 }
 

target/scripts/startup/setup-stack.sh

@@ -94,6 +94,10 @@ function _setup_apply_fixes_after_configuration() {
 
   _log 'debug' 'Removing files and directories from older versions'
   rm -rf /var/mail-state/spool-postfix/{dev,etc,lib,pid,usr,private/auth}
+
+  # /tmp/docker-mailserver/rspamd/dkim
+  _log 'debug' "Ensuring ${RSPAMD_DMS_DKIM_D} is owned by '_rspamd:_rspamd'"
+  chown -R _rspamd:_rspamd "${RSPAMD_DMS_DKIM_D}"
 }
 
 function _run_user_patches() {

test/config/oauth2/Caddyfile

@@ -38,6 +38,9 @@
   }
 }
 
+# NOTE: This portion of config is only relevant for understanding what happens seamlesssly,
+# DMS tests no longer use raw IMAP commands with netcat, thus none of this is relevant beyond reference for troubleshooting.
+#
 # /imap/xoauth2
 # Generate IMAP commands for authentication testing
 # Base64 encoded credentials can alternative be done via CLI with:

test/files/auth/imap-oauth2-oauthbearer.txt

@@ -1,4 +0,0 @@
-a0 NOOP See test/config/oauth2/Caddyfile to generate the below OAUTHBEARER string
-a1 AUTHENTICATE OAUTHBEARER bixhPXVzZXIxQGxvY2FsaG9zdC5sb2NhbGRvbWFpbiwBaG9zdD1sb2NhbGhvc3QBcG9ydD0xNDMBYXV0aD1CZWFyZXIgRE1TX1lXTmpaWE56WDNSdmEyVnUBAQ==
-a2 EXAMINE INBOX
-a3 LOGOUT

test/files/auth/imap-oauth2-xoauth2.txt

@@ -1,4 +0,0 @@
-a0 NOOP See test/config/oauth2/Caddyfile to generate the below XOAUTH2 string
-a1 AUTHENTICATE XOAUTH2 dXNlcj11c2VyMUBsb2NhbGhvc3QubG9jYWxkb21haW4BYXV0aD1CZWFyZXIgRE1TX1lXTmpaWE56WDNSdmEyVnUBAQ==
-a2 EXAMINE INBOX
-a3 LOGOUT

test/tests/serial/mail_with_oauth2.bats

@@ -58,21 +58,59 @@ function teardown_file() {
   docker network rm "${DMS_TEST_NETWORK}"
 }
 
-@test "should authenticate with XOAUTH2 over IMAP" {
+@test "should authenticate with XOAUTH2" {
-  _nc_wrapper 'auth/imap-oauth2-xoauth2.txt' '-w 1 0.0.0.0 143'
+  __should_login_successfully_with 'XOAUTH2'
-  __verify_successful_login 'XOAUTH2'
 }
 
-@test "should authenticate with OAUTHBEARER over IMAP" {
+@test "should authenticate with OAUTHBEARER" {
-  _nc_wrapper 'auth/imap-oauth2-oauthbearer.txt' '-w 1 0.0.0.0 143'
+  __should_login_successfully_with 'OAUTHBEARER'
-  __verify_successful_login 'OAUTHBEARER'
 }
 
-function __verify_successful_login() {
+function __should_login_successfully_with() {
   local AUTH_METHOD=${1}
+  # These values are the auth credentials checked against the Caddy `/userinfo` endpoint:
+  local USER_ACCOUNT='user1@localhost.localdomain'
+  local ACCESS_TOKEN='DMS_YWNjZXNzX3Rva2Vu'
 
+  __verify_auth_with_imap
+  __verify_auth_with_smtp
+}
+
+# Dovecot direct auth verification via IMAP:
+function __verify_auth_with_imap() {
+  # NOTE: Include the `--verbose` option if you're troubleshooting and want to see the protocol exchange messages
+  # NOTE: `--user username:password` is valid for testing `PLAIN` auth mechanism, but you should prefer swaks instead.
+  _run_in_container curl --silent \
+    --login-options "AUTH=${AUTH_METHOD}" --oauth2-bearer "${ACCESS_TOKEN}" --user "${USER_ACCOUNT}" \
+    --url 'imap://localhost:143' -X 'LOGOUT'
+
+  __dovecot_logs_should_verify_success
+}
+
+# Postfix delegates by default to Dovecot via SASL:
+# NOTE: This won't be compatible with LDAP if `ENABLE_SASLAUTHD=1` with `ldap` SASL mechanism:
+function __verify_auth_with_smtp() {
+  # NOTE: `--upload-file` with some mail content seems required for using curl to test OAuth2 authentication.
+  # TODO: Replace with swaks and early exit option when it supports XOAUTH2 + OAUTHBEARER:
+  _run_in_container curl --silent \
+    --login-options "AUTH=${AUTH_METHOD}" --oauth2-bearer "${ACCESS_TOKEN}" --user "${USER_ACCOUNT}" \
+    --url 'smtp://localhost:587' --mail-from "${USER_ACCOUNT}" --mail-rcpt "${USER_ACCOUNT}" --upload-file - <<< 'RFC 5322 content - not important'
+
+  # Postfix specific auth logs:
+  _run_in_container grep 'postfix/submission/smtpd' /var/log/mail.log
+  assert_output --partial "sasl_method=${AUTH_METHOD}, sasl_username=${USER_ACCOUNT}"
+
+  # Dovecot logs should still be checked as it is handling the actual auth process under the hood:
+  __dovecot_logs_should_verify_success
+}
+
+function __dovecot_logs_should_verify_success() {
   # Inspect the relevant Dovecot logs to catch failure / success:
   _run_in_container grep 'dovecot:' /var/log/mail.log
   refute_output --partial 'oauth2 failed: Introspection failed'
-  assert_output --partial "dovecot: imap-login: Login: user=<user1@localhost.localdomain>, method=${AUTH_METHOD}"
+  assert_output --partial "dovecot: imap-login: Login: user=<${USER_ACCOUNT}>, method=${AUTH_METHOD}"
+
+  # If another PassDB is enabled, it should not have been attempted with the XOAUTH2 / OAUTHBEARER mechanisms:
+  # dovecot: auth: passwd-file(${USER_ACCOUNT},127.0.0.1): Password mismatch (SHA1 of given password: d390c1) - trying the next passdb
+  refute_output --partial 'trying the next passdb'
 }