September 2006 - dovecot

[Dovecot] DIGEST-MD5 doesn't work
by Jürgen Herz 01 Sep '06

01 Sep '06

Hi, my dovecot installation works since months and clients authenticate using CRAM-MD5. But today I got the first chance to test an client that supports DIGEST-MD5 - and it doesn't work. Because of lack of other supporting clients and servers I'm now at the point I don't know which side is to blame. The error I get after the client answers the servers challenge is "-ERR Authentication failed: Missing nonce parameter". Though I don't know how DIGEST-MD5 works I wonder about the message because the clients answer contains a nonce parameter (captured with tcpdump): YXV0aHppZD0ib3RycyIsY2hhcnNldD11dGYtOCxjbm9uY2U9IjFlOTZkYmZiZWEwZjUxNmVhZjEyYmM0NjU1M2JmZjVlIixkaWdlc3QtdXJpPSJwb3AzL25hbm8iLG5jPTAwMDAwMDAxLG5vbmNlPSJPVGpGWmhjS2FIVjZSVGMyZlRDTXJ3PT0iLHFvcD1hdXRoLHJlYWxtPSIiLHJlc3BvbnNlPTVmMTQyZWVlN2FmMWVmYTJhYWI5ZmM0ODNiOGJjOTJhLHVzZXJuYW1lPSJvdHJzIg== authzid="otrs",charset=utf-8,cnonce="1e96dbfbea0f516eaf12bc46553bff5e", digest-uri="pop3/nano",nc=00000001,nonce="OTjFZhcKaHV6RTc2fTCMrw==", qop=auth,realm="",response=5f142eee7af1efa2aab9fc483b8bc92a,username="otrs" Client is a Perl script using Net::POP3 and Authen::SASL Modules Dovecot is version 0.99.14 - I know it's old and not supported. If one tells me the bug is known and fixed in 1.0rc, then I'll think about upgrading, but I just to test I don't want to change my running system. Regards, Jürgen

1 1

[Dovecot] Stale imap processes
by Michael Bond 01 Sep '06

01 Sep '06

I read through the thread on Stale imap process and would like to chime in that I too am having the problem. The only imap user on the system is using Mail.app 2.1. The other users are using pop with thunderbird. After quiting mail.app and stopping dovecot I can still see many imap sessions opened. Over the course of the day a good number of imap process will be open and no one will be able to connect to the server via imap or pop. Typically I have to restart dovecot twice a day with the following: /etc/init.d/dovecot stop killall imap /etc/init.d/dovecot start I've narrowed it down to an imap issue. If i don't connect with imap the other users don't report any issues connecting with pop. I'm using mbox as my mail format on centos 4. I know that the default version on centos4 is .99, but it appears that people are still having issues into 1.0rc2. Could it have something to do with using mbox format? Mike. mbond(a)the-forgotten.org

1 0

[Dovecot] deliver LDA and INBOX location
by David Lee 01 Sep '06

01 Sep '06

(OS: Fedora Core 5; dovecot: 1.0 rc7) On a typical UNIX-like OS, the INBOXes are in "/var/spool/mail/" using the user identifier: so user 'fred' has INBOX "/var/spool/mail/fred". We have a well-established different convention which subdivides this, based on the last two digits of the uid: "/var/spool/mail/12/fred" (for fred's uid as something ending "[...]12"). This is working nicely with dovecot, using the new rc7 functionality: default_mail_env = mbox:%h:INBOX=/var/spool/mail/%-2.02i/%u:[...] I am now trying to get sendmail to use dovecot's "deliver" as the LDA, (following "http://wiki.dovecot.org/LDA") as a simple drop-in replacement for the normal LDA. (Actually our migration starting point is a UW-IMAP background using its 'tmail' as LDA.) 1. It seems that using "auth default {...socket listen {...}...}" is mandatory. Can someone confirm? This feels like an extra complication: is it strictly necessary in a NIS/PAM set-up? (Fair enough if so.) 2. The main problem is that, according to the log file, the delivery attempt is being made to an INBOX "/var/spool/mail//fred". That is, it seems to be ignoring the "default_mail_env" setting. Have I missed something in the wiki, or is this a bug of some sort? -- : David Lee I.T. Service : : Senior Systems Programmer Computer Centre : : Durham University : : http://www.dur.ac.uk/t.d.lee/ South Road : : Durham DH1 3LE : : Phone: +44 191 334 2752 U.K. :

1 1

[Dovecot] No tcp wrappers, other ideas to help stop brute force attacks?
by David Rees 01 Sep '06

01 Sep '06

I'm looking for a way to deny access to dovecot from certain IP addresses, basically to help prevent brute force attacks on the server. Right now I'm using denyhosts which scans /var/log/secure for authentication failures which then can add an entry to /etc/hosts.deny, but since dovecot doesn't have tcp wrappers support, that doesn't do anything. It doesn't look like I can run dovecot run xinetd. Any other ideas to help protect dovecot from brute force attacks? I don't think pam can help, can it? Otherwise I need to figure out a way to have denyhosts trigger iptables rules or something, or maybe there's another application that will work? -Dave

9 15

[Dovecot] one example, just one example ...
by OpenMacNews 01 Sep '06

01 Sep '06

... of a correctly formatted QUOTA spec in/for a static userdb. That's all I'm askin' for! i've tried a bunch of variants. the most recent two: user@domain.com:{PLAIN}testpass:::::: quota=maildir:storage=4096 user@domain.com:{PLAIN}testpass:::::: maildir:storage=4096 *none* (so far ...) work to override the spec in dovecot.conf. no errors in the logs; rather, simply: dovecot: Aug 31 08:54:25 Info: auth(default): passwd-file /var/MailServer/Data/USERS/imap_user_file: Read 2 users nobody? really, nobody does this successfully? richard

2 2