- Dovecot-news - dovecot.org

v1.1.rc2 released
by Timo Sirainen 08 Mar '08

08 Mar '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gz.sig Changes since rc1: * mail_extra_groups setting was commonly used insecurely. This setting is now deprecated. Most users should switch to using mail_privileged_group setting, but if you really need the old functionality use mail_access_groups instead. + Expire plugin now supports wildcards in mailbox names. + dbox: Expire plugin supports moving old mails to alternative dbox directory + Maildir++ quota: quota_rule=?:<rule> specifies a default rule which is used only if the maildirsize file doesn't exist. + If SSL/TLS connection isn't closed cleanly, log the last error in the disconnection line. + EXPUNGE: If new \Deleted messages were found while expunging, do it again and expunge them as well (Outlook workaround) - IMAP: SEARCH, LIST and THREAD command correctness fixes - Maildir++ quota: Quota rules and warnings with % rules didn't work if the default limits were taken from maildirsize file. - Maildir++ quota: If both byte and message limits weren't specified, maildirsize file was recalculated all the time - mbox: Flag and keyword updates may have gotten lost in some situations (happens with v1.0 too) - ldap: Don't crash if userdb lookup fails - Squat fixes and performance improvements Things left to do for v1.1.0: - dbox has a metadata corruption bug, find and fix it - Squat has some locking issues that causes errors when stress testing with multiple connections - Squat doesn't do NFS cache flushing and has some other NFS problems.

1 0

v1.0.12 released
by Timo Sirainen 05 Mar '08

05 Mar '08

http://dovecot.org/releases/1.0/dovecot-1.0.12.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.12.tar.gz.sig - Using mail_privileged_group with dotlock_use_excl=no worked, but it logged "access denied" errors.

1 0

v1.0.11 released
by Timo Sirainen 04 Mar '08

04 Mar '08

http://dovecot.org/releases/1.0/dovecot-1.0.11.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.11.tar.gz.sig * mail_extra_groups setting was commonly used insecurely. This setting is now deprecated. Most users should switch to using mail_privileged_group setting, but if you really need the old functionality use mail_access_groups instead. - mbox: Dropped some of the physical size fetch optimizations added in v1.0.8. This makes some commands slower, but should fix the rest of the problems. - IMAP: SEARCH BEFORE/ON/SINCE didn't handle timezones correctly. - ldap: auth_bind was doing lookups using subtree scope instead of the scope specified in config file. - zlib plugin crashfixes by Richard Platel - master passdbs: pass=yes setting was broken with blocking passdbs (e.g. MySQL)

1 0

Security issue #5: mail_extra_groups setting is often used insecurely
by Timo Sirainen 04 Mar '08

04 Mar '08

mail_extra_groups=mail setting is often used insecurely to give Dovecot access to create dotlocks to /var/mail directory. If you don't use mboxes in /var/mail, make sure this setting is cleared. If you do use /var/mail mboxes and Dovecot gives permission errors without it, do one of the following (in the preferred order): a) Upgrade to v1.0.11 and use the new mail_privileged_group setting instead of mail_extra_groups. b) Make /var/mail sticky and world-writable (chmod 01777 /var/mail) and clear mail_extra_groups setting. c) Make /var/mail sticky (chmod +t /var/mail) and keep mail_extra_groups setting. This fixes the main problem but some may be left. The mail_privileged_group setting is also available as a patch: http://dovecot.org/patches/1.0/dovecot-1.0.10.mail_priv_groups.diff mail_extra_groups setting has existed since Dovecot v0.99.10.6. It's never been enabled by default in the distributed dovecot-example.conf, but some distributions enable it by default (at least Debian). A longer explanation: The main problem is that if users have filesystem access to the mail server, they can create symlinks. Dovecot doesn't try to prevent following symlinks (and I don't think it should) and normally it isn't a problem. But when mail_extra_groups=mail is set: 1a) Maildir: Any files readable by mail group can be read by the user by symlinking the file to their ~/Maildir/cur/. 1b) Any mbox files readable by mail group can be read by the user by symlinking the mbox file to their ~/mail/ directory. These are pretty obvious problems and I didn't think they were all that important. Why would anyone have secret files that are mail group-readable? But apparently those do exist in some systems (maybe accidentally). 2a) mbox: Any files/directories under mail group-writable directories can be created/deleted/renamed by symlinking the directory under ~/mail/. For example ln -s /var/mail ~/mail/var, DELETE var/root will happily delete root's mailbox. This I hadn't thought about before. 2b) Maildir: Pretty much the same thing can be done with maildir but with a little less control. mail_privileged_group setting works by keeping the group in process's saved GID while it's not in use and temporarily switching it to effective GID while dotlocks are created. Currently this is done only when: 1. It's only done for INBOX mbox which doesn't exist under the same location as other mailboxes (so typically under /var/mail). 2. It's used only after initial dotlock creation try failed with EACCES error.

1 0

v1.1.rc1 released
by Timo Sirainen 21 Feb '08

21 Feb '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc1.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc1.tar.gz.sig Finally the first v1.1 release candidate. Please test so we can have a fully stable v1.1.0 release. v1.1.betas are already running in a few large installations, so I don't expect there to be many bugs left. There are no release critical bugs left and no known crash bugs. There are a few issues I'd like to fix before v1.1.0, but I don't expect to have more than 3-5 release candidates this time (certainly much less than 31 anyway..) Changes since beta16: - ioloop defaults now to best one availablable instead of poll - IMAP SEARCH correctness fixes - Fixed proxy_maybe handling with caching and with mysql - IMAP: ENVELOPE's subject field now always has TABs changed to spaces - Some crashfixes

1 0

v1.0.10 released
by Timo Sirainen 29 Dec '07

29 Dec '07

http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.10.tar.gz.sig v1.0.8 and v1.0.9 were a bit bad releases. Hopefully one day I've managed to have written a proper test suite which can be run before doing any releases.. * Security hole with LDAP+auth cache: If base setting contained %variables they weren't included in auth cache key, which broke caching. This could have caused different users with same passwords to log in as each other. - LDAP: Fixed potential infinite looping when connection to LDAP server was lost and there were queued requests. - mbox: More changes to fix problems caused by v1.0.8 and v1.0.9. - Maildir: Fixed a UIDLIST_IS_LOCKED() assert-crash in some conditions (caused by changes in v1.0.9) - If protocols=none, don't require imap executables to exist

1 0

Security hole #4: Specific LDAP + auth cache configuration may mix up user logins
by Timo Sirainen 21 Dec '07

21 Dec '07

Somehow I doubt there are any Dovecot setups left that unknowingly have this problem, but it still counts as a security hole. The possibility to cause this problem exists in Dovecot v1.0.rc11 and later. If you use: 1. passdb ldap with settings: - auth_bind = yes - auth_bind_userdn = no - base containing %variables required for unique user identification, e.g. base = dc=%d,dc=org - pass_filter not containing all %variables required for unique user identification - pass_attrs returning user-specific settings, such as user's home directory 2. userdb prefetch 3. auth_cache_size non-zero (0 is default) If two users with the same password and same pass_filter variables log in within auth_cache_ttl seconds (1h by default), the second user may get logged in with the first user's cached pass_attrs. For example if pass_attrs contained the user's home/mail directory, this would mean that the second user will be accessing the first user's mails. You most likely would have noticed this already by wondering why logins keep failing, unless pass_filter used also some %variables that most of the time uniquely identifies the user. For example %r (remote IP address) or %n (username without domain). You can fix this by upgrading to v1.0.10 (to be released soon), or using this patch: http://hg.dovecot.org/dovecot-1.0/raw-rev/2cedab21cd6d

1 0

v1.0.9 released
by Timo Sirainen 11 Dec '07

11 Dec '07

http://dovecot.org/releases/1.0/dovecot-1.0.9.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.9.tar.gz.sig + Maildir: Don't wait on dovecot-uidlist.lock when we just want to find out a new filename for the message. - mbox: v1.0.8 changes sometimes caused FETCH to fail with "got too little data", disconnecting the client. - Fixed a memory leak when FETCHing message header/body multiple times within a command (e.g. BODY[1] BODY[2]) - IMAP: Partial body fetching was still slow with mboxes

1 0

v1.0.8 released
by Timo Sirainen 28 Nov '07

28 Nov '07

http://dovecot.org/releases/1.0/dovecot-1.0.8.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.8.tar.gz.sig + Authentication: Added "password_noscheme" field that can be used instead of "password". "password" treats "{prefix}" as a password scheme while "password_noscheme" treats it as part of the password itself. So "password_noscheme" should be used if you're storing passwords as plaintext. Non-plaintext passwords never begin with "{", so this isn't a problem with them. - IMAP: Partial body fetching was sometimes non-optimal, causing the entire message to be read for every FETCH command. - deliver failed to save the message when envelope sender address contained spaces. - Maildir++ quota: We could have randomly recalculated quota when it wasn't necessary. - Login process could have crashed after logging in if client sent data before "OK Logged in" reply was sent (i.e. before master had replied that login succeeded). - Don't assert-crash when reading dovecot.index.logs generated by Dovecot v1.1. - Authentication: Don't assert-crash if password beings with "{" but doesn't contain "}". - Authentication cache didn't work when using settings that changed the username (e.g. auth_username_format).

1 0

v1.0.7 released
by Timo Sirainen 29 Oct '07

29 Oct '07

http://dovecot.org/releases/1.0/dovecot-1.0.7.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.7.tar.gz.sig Almost missed this one. I had already fixed it in v1.1 tree, but forgot to fix in v1.0 tree. - deliver: v1.0.6's "From " line ignoring could have written to a bad location in stack, possibly causing problems.

1 0