[Dovecot] Deleted / read mails show up as new on remote imap clients

[Ben Morrow]

At  6PM +0100 on 25/02/13 you (Andre Bischof) wrote:
> Am 25.02.2013 15:39, schrieb Ben Morrow:
> > ...
> 
> > Can you use tcpdump or wireshark to see what TB is actually telling
> > the server to do? If you use TLS you will need to put ssl_cipher_list
> > = RSA in your dovecot.conf and point wireshark at the key file for the
> > server's certificate; make sure you remove that setting afterwards,
> > since it's a little less secure. (Specifically, TLS will normally use
> > an ephemeral Diffie-Hellman key in addition to the certificate's
> > private key, in order to make as little use of the cert key as
> > possible. This makes it impossible for a third party (like wireshark)
> > to decrypt the conversation, even with access to the private key.
> > ssl_cipher_list=RSA disables this.) Ben
> 
> To be honest, I can't. I remember using wireshark (it was named s.th. 
> else at this time) years ago and that it was very complicated.

OK.

> If you could be more specific and walk me through I surely try.

Hmm, I don't think I can, really; at least, not if you're using SSL.
Even if you aren't you would want to at least edit the capture to remove
passwords before showing it to anyone, which would require understanding
what had been captured.

Are you able to get a capture with
http://wiki2.dovecot.org/Debugging/Rawlog instead?

Ben