- Dovecot-news - dovecot.org

1.0.beta9 released
by Timo Sirainen 13 Jun '06

13 Jun '06

Fixes a lot of bugs. The next release will be the first "release candidate" instead of a beta. * PAM: Don't call pam_setcred() unless setcred=yes PAM passdb argument was given. * Moved around settings in dovecot-example.conf to be in more logical groups. + Local delivery agent (deliver binary) works again. + LDAP: Added support for SASL binding. Patch by Geert Jansen + ssl_verify_client_cert: Check CRLs. If auth_verbose=yes, log invalid sent certificates. If verbose_ssl=yes, log even the valid certificates. When using the username from the certificate, use CommonName. Based on patch by HenkJan Wolthuis + PAM: Set PAM_TTY which is needed by some PAM plugins + dovecot --exec-mail ext <binary path> can now be used to start binaries which want dovecot.conf to be read, for example the convert-tool. - Expunging needed to be done twice if client used STORE +FLAGS.SILENT command to set the \Deleted flags - Added sql_escape_string() to lib-sql API and use it instead of normal \-escaping. - ACL plugin fixes - DIGEST-MD5: Trying to use subsequent authentication crashed dovecot-auth. - Fetching BODY when BODYSTRUCTURE was already cached caused the reply to be broken in some cases - Lots of fixes for index file handling - dbox fixes and changes - mbox syncing broke if some extraneous/broken headers were removed (eg. extra X-IMAPbase headers in mails) - Running Dovecot from inetd work now properly with POP3 - Quota plugin fixes for calculating the quota correctly

1 0

1.0.beta8 released
by Timo Sirainen 12 May '06

12 May '06

Next release will probably be called 1.0.rc1. People just don't seem to like the beta name in the version number. :) Also I think we're nearing the final v1.0. * Fixed a security hole with mbox: "1 LIST .. *" command could list all directories and files under the mbox root directory, so if your mails were stored in eg. /var/mail/%u/ directory, the command would list everything under /var/mail. + Unless nfs_check=no or mmap_disable=yes, check for the first login if the user's index directory exists in NFS mount. If so, refuse to run. This is done only on first login to avoid constant extra overhead. + If we have plugins set and imap_capability unset, figure out the IMAP capabilities automatically by running imap binary at startup. The generated capability list isn't updated until Dovecot is restarted completely, so if you add or remove IMAP plugins you should restart. If you have problems related to this, set imap_capabilities setting manually to work around it. + Added auth_username_format setting - pop3_lock_session setting wasn't really working - Lots of fixes related to quota handling. It's still not working perfectly though. - Lots of index handling fixes, especially with mmap_disable=yes - Maildir: saving mails could have sometimes caused "Append with UID n, but next_uid = m" errors - flock() locking never timeouted because ignoring SIGALRM caused the system call just to be restarted when SIGALRM occurred (probably not with all OSes though?) - kqueue: Fixed "Unrecognized event". Patch by Vaclav Haisman

1 0

Security hole with mboxes
by Timo Sirainen 12 May '06

12 May '06

Unfortunately we have our first problem that could really be counted as security hole. Giving "1 LIST .. *" IMAP command allows the user to see all files and directories under the mbox root's parent directory, so potentially you could see other users' mailbox names. Nothing can be done with them though, so it's not possible to read or modify them. There are also some other less than wanted behaviors that can be done with "." and ".." directories, such as "DELETE .." command can give errors. Also with maildir if you store indexes in different directory than mails this command can be used to delete the index files. Anyway I don't see any of these as security issues. Hopefully most people have their mail directory under user's home directory, so this would only list the home directory's contents. But if you do have users' mails stored in eg. under /var/mail/%u/ directory, giving that command would list everything under /var/mail, assuming that the process has permissions to do that (that's why you should be using different UIDs for users if possible). This affects 1.0 beta and 1.0 stable releases, but not 0.99.x. Fix is in http://dovecot.org/list/dovecot-cvs/2006-May/005563.html I'll also release 1.0 beta8 now. Thanks for Bill Boebel for noticing "DELETE .." doing weird things with maildir.

1 0

CVS forked into development/stable branches
by Timo Sirainen 08 May '06

08 May '06

New branch created to CVS: branch_1_0 It's going to stabilize into v1.0 Dovecot, hopefully somewhat soon. I'll start adding new larger features into HEAD, so you might want to switch to branch_1_0 if you're currently using Dovecot from CVS. You can do this with: cvs up -r branch_1_0 The nightly snapshots are from branch_1_0, at least for now.

1 0

1.0.beta7
by Timo Sirainen 12 Apr '06

12 Apr '06

Sorry, the authentication problem still wasn't actually fixed in beta6. Now, this time I tested every possible authentication case that it really works. I'll soon create a CVS branch which is going to stabilize into the 1.0 release. I won't add new features there so it shouldn't really get broken anymore, at least because of new features.. So, two changes in this release: + Added shutdown_clients setting to control if existing imap/pop3 processes should be killed when master is. - Master login fixes, PLAIN authentication was still broken..

1 0

1.0.beta6 released
by Timo Sirainen 12 Apr '06

12 Apr '06

Fixes, mostly: * The login and master usernames were reversed when using master_user_separator (now the order is UW-IMAP compatible). * Killing dovecot master process now kills all IMAP and POP3 processes also. + -a parameter to dovecot prints now all settings that Dovecot uses. -n prints all settings that are different from defaults. + Added pop3_lock_session setting + %M modifier returns string's MD5 sum. Patch by Ben Winslow - PLAIN SASL authentication wasn't working properly, causing failed logins with some clients (broken in beta4) - Fixes to Maildir++ quota, should actually work now - Don't crash if passwd-file has entries without passwords (eg. deny=yes databases) - Fixed prefetch userdb to work nicely with other userdbs - If master process runs out of file descriptors, don't go to infinite loop (unlikely to have happened unless the OS's default fd limit was too low) - Fixed non-plaintext password lookups from LDAP. Patch by Lior Okman - %U modifier was actually lowercasing the string. Patch by Ben Winslow

1 0

1.0.beta5 released
by Timo Sirainen 04 Apr '06

04 Apr '06

Just two changes: - Beta4's SSL proxying rewrite worked worse than I thought. Reverted it back to original code. - Filesystem quota plugin now looks up the mount path correctly.

1 0

Dovecot-news mailing list created
by Timo Sirainen 02 Apr '06

02 Apr '06

New low-traffic list created for people who only wish to see new release announcements and possibly some other rare important announcements. Also from now on no-one can send mails to either of these lists with From-field containing "tss(a)iki.fi" or "Timo Sirainen", unless it also contains a valid PGP signature from me. If someone wants to see the script (and please check if there are any bugs in it, thanks :), it's here: http://iki.fi/tss/gpgcheck.pl

1 0

Test mail
by Timo Sirainen 02 Apr '06

02 Apr '06

List created, forgot to do this before sending beta4 announcement mail.

1 0