#1151590 dovecot-managesieved: default config enables the deprecated managesieve listener on port 2000

Package:
dovecot-managesieved
Source:
dovecot-managesieved
Description:
secure POP3/IMAP server - ManageSieve server
Submitter:
Paul A Jungwirth
Date:
2026-10-22 05:17:02 UTC
Severity:
normal
#1151590#5
Date:
2026-10-22 05:14:37 UTC
From:
To:
Trixie listens on 0.0.0.0:2000 and [::]:2000 needlessly. In
`/etc/dovecot/conf.d/20-managesieve.conf` we have:

    service managesieve-login {
      inet_listener sieve {
        port = 4190
      }

      inet_listener sieve_deprecated {
        port = 2000
      }

Compare to Bookworm where the whole `managesieve-login` block was
commented out. It listened on 4190 already, but not 2000. So upgrading
silently adds a new listener exposed to the Internet.

Since RFC 5804 replaced port 2000 with 4190 16 years ago, enabling it
now looks accidental. Also upstream's documentation at
https://doc.dovecot.org/2.4.3/core/config/sieve/managesieve.html shows
it commented out. And dovecot doesn't use the 2000 listener. The
compiled-in defaults have only the 4190 one:

    $ strings /usr/lib/dovecot/modules/settings/libmanagesieve_login_settings.so
\
        | grep -E 'inet_listener|4190|2000'
    inet_listener
    inet_listener/sieve/port
    4190

The change happened in 1:2.4.0+dfsg1-1~exp1, based on this Changelog
entry: "Update default configuration from upstream example config
bundle at https://github.com/dovecot/tools/blob/main/dovecot-2.4.0-example-config.tar.gz".
So it seems like something upstream should fix too.

Suggested fix: comment out the `sieve_deprecated` listener in
`conf.d/20-managesieve.conf`, and forward it upstream so the bundle is
corrected too.

To reproduce:

    apt install dovecot-managesieved
    ss -ltn | grep -E ':(2000|4190)'
    grep -n -A8 'service managesieve-login'
/etc/dovecot/conf.d/20-managesieve.conf