March 2008 - dovecot - dovecot.org

[Dovecot] v1.1.rc2 released
by Timo Sirainen 09 Mar '08

09 Mar '08

http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc2.tar.gz.sig Changes since rc1: * mail_extra_groups setting was commonly used insecurely. This setting is now deprecated. Most users should switch to using mail_privileged_group setting, but if you really need the old functionality use mail_access_groups instead. + Expire plugin now supports wildcards in mailbox names. + dbox: Expire plugin supports moving old mails to alternative dbox directory + Maildir++ quota: quota_rule=?:<rule> specifies a default rule which is used only if the maildirsize file doesn't exist. + If SSL/TLS connection isn't closed cleanly, log the last error in the disconnection line. + EXPUNGE: If new \Deleted messages were found while expunging, do it again and expunge them as well (Outlook workaround) - IMAP: SEARCH, LIST and THREAD command correctness fixes - Maildir++ quota: Quota rules and warnings with % rules didn't work if the default limits were taken from maildirsize file. - Maildir++ quota: If both byte and message limits weren't specified, maildirsize file was recalculated all the time - mbox: Flag and keyword updates may have gotten lost in some situations (happens with v1.0 too) - ldap: Don't crash if userdb lookup fails - Squat fixes and performance improvements Things left to do for v1.1.0: - dbox has a metadata corruption bug, find and fix it - Squat has some locking issues that causes errors when stress testing with multiple connections - Squat doesn't do NFS cache flushing and has some other NFS problems.

4 22

[Dovecot] v1.0.13 and v1.1.rc3 released
by Timo Sirainen 09 Mar '08

09 Mar '08

http://dovecot.org/releases/1.0/dovecot-1.0.13.tar.gz http://dovecot.org/releases/1.0/dovecot-1.0.13.tar.gz.sig http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc3.tar.gz http://dovecot.org/releases/1.1/rc/dovecot-1.1.rc3.tar.gz.sig Note that the changes for the security hole fix were quite large. I tested with several auth configurations myself and they seemed to work, but it's possible I left a bug somewhere in there breaking someone's configuration. So make sure to test that it works after upgrading. Of course it would be really nice if Dovecot had a proper test suite where testing all configurations could be automated and run before each release. I've already started this with my imaptest tool (http://imapwiki.org/ImapTest) but it only does IMAP tests and a lot of things are still missing. Some help would be nice here. * Fixed a security hole in blocking passdbs (MySQL always. PAM, passwd and shadow if blocking=yes) where user could specify extra fields in the password. The main problem here is when specifying "skip_password_check" introduced in v1.0.11 for fixing master user logins, allowing the user to log in as anyone without a valid password. - mail_privileged_group was broken in some systems (OS X, Solaris?) - IMAP THREAD: Fixed some correctness problems

1 0

[Dovecot] Security hole #6: Some passdbs allowed users to log in without a valid password
by Timo Sirainen 09 Mar '08

09 Mar '08

This affects only blocking passdbs: - MySQL - PAM, passwd and shadow if blocking=yes The underlying bug exists in all v1.0.x versions, but I couldn't figure out a way to exploit it except with v1.0.11, v1.0.12 and v1.1.rc2. Probably a good idea to upgrade in any case. The main problem is that Dovecot's internal protocols use TAB character as a delimiter, but passwords were sent unescaped through them. So passwords containing TAB characters allowed to add new internal fields. The main problem here is a new "skip_password_check" field added in v1.0.11 to fix problems with master user logins. Specifying this field allowed the user to skip the password check, as the name implies. This has been fixed thoroughly in v1.0.13 and v1.1.rc3 to make sure there are no more escaping problems with any fields, but it can be also fixed with a less intrusive patch for v1.0: http://hg.dovecot.org/dovecot-1.0/raw-rev/da2a9372e26e

1 0

[Dovecot] Quota Problem?
by Michel Vega Fuenzalida 08 Mar '08

08 Mar '08

Good list I am not very good with English. I use dovecot-1.0-1.2.rc15.el5.x86_64rpm for Centos 5.1, Maildir like mailbox and I have it configured as it continues: base_dir = /var/run/dovecot/ protocols = imaps pop3s imap mail_location = maildir:~/Maildir protocol imap { mail_plugins = quota imap_quota mail_plugin_dir = /usr/lib/dovecot/imap } protocol pop3 { pop3_uidl_format = %08Xu%08Xv mail_plugins = quota mail_plugin_dir = /usr/lib/dovecot/pop3 } log_path = /var/log/dovecot.log log_timestamp = "%b %d %H:%M:%S " syslog_facility = mail auth default { mechanisms = plain #login digest-md5 cram-md5 passdb pam { } userdb passwd { } user = root } plugin { quota = maildir quota = maildir:ignore=Trash } the problem resides in the quota, when I make: #du - sh /home/muti/Maildir/ 160M /home/michelvf/Maildir/ And in the file /home/muti/Maildir/maildirsize appears: 204800000S 138594655 4180 This doesn't belong together with the real size of the mailbox. That is to say that it is not real, is this normal? or I have not well configured dovecot.conf, I really want that through the file maildirsize, to have control of the quota. Greetings -- Usemos el Software Libre "Con todos y para el bien de todos." Jose Marti, 26 de noviembre de 1891, Tampa. Michel Vega Fuenzalida. Usuario Linux: 353763 (http://counter.li.org) Coordinador Grupo: Linux-Pinero. Administrador de Red. ELAM "Clara Zetkin" Teléfono: 53 (01) 52193107 ext 115. Isla de la Juventud. Cuba.

2 1

[Dovecot] IPv6-enabled dovecot-1.1rc* does not accept IPv4-connections
by Bernhard Schmidt 08 Mar '08

08 Mar '08

Hi, I'm having a really really strange problem. After upgrading from 1.1.beta13 to 1.1.rc2 (happened with rc1 as well IIRC) I can't connect to the services using IPv4 anymore. dovecot happily binds to the IPv6 wildcard socket which should accept IPv4 connections as well. root@vs02:~# netstat -lnp --tcp | grep dovecot tcp6 0 0 :::993 :::* LISTEN 30758/dovecot tcp6 0 0 :::995 :::* LISTEN 30758/dovecot tcp6 0 0 :::110 :::* LISTEN 30758/dovecot tcp6 0 0 :::143 :::* LISTEN 30758/dovecot root@vs02:~# telnet ::1 110 Trying ::1... Connected to ::1. Escape character is '^]'. +OK Dovecot ready. quit +OK Logging out Connection closed by foreign host. root@vs02:~# telnet 127.0.0.1 110 Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused root@vs02:~# /sbin/stop dovecot dovecot (stop) running, process 30758 dovecot (stop) pre-stop, (main) process 30758 dovecot (stop) stopping, process 30758 dovecot (stop) killed, process 30758 dovecot (stop) post-stop dovecot (stop) waiting # downgrading root@vs02:~# dpkg -i dovecot_1.1.beta13-1_amd64.deb dpkg - warning: downgrading dovecot from 1.1.rc2-1 to 1.1.beta13-1. (Reading database ... 20504 files and directories currently installed.) Preparing to replace dovecot 1.1.rc2-1 (using dovecot_1.1.beta13-1_amd64.deb) ... Unpacking replacement dovecot ... Setting up dovecot (1.1.beta13-1) ... Installing new version of config file /etc/dovecot/dovecot-sql-example.conf ... Installing new version of config file /etc/dovecot/dovecot-ldap-example.conf ... Installing new version of config file /etc/dovecot/dovecot-example.conf ... root@vs02:~# /sbin/start dovecot dovecot (start) waiting dovecot (start) starting dovecot (start) pre-start, process 30816 dovecot (start) spawned, process 30818 dovecot (start) post-start, (main) process 30818 dovecot (start) running, process 30818 root@vs02:~# netstat -lnp --tcp | grep dovecot tcp6 0 0 :::993 :::* LISTEN 30818/dovecot tcp6 0 0 :::995 :::* LISTEN 30818/dovecot tcp6 0 0 :::110 :::* LISTEN 30818/dovecot tcp6 0 0 :::143 :::* LISTEN 30818/dovecot root@vs02:~# telnet 127.0.0.1 110 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. +OK Dovecot ready. quit +OK Logging out Connection closed by foreign host. I built the packages myself, both (beta13 and rc2) with the options --without-passwd --without-passwd-file --without-shadow --without-pam --without-gssapi --without-vpopmail --with-ldap --without-checkpassword --without-nss --with-deliver --with-ioloop=epoll --with-storages=maildir,raw --sysconfdir=/etc/dovecot Anyone having an idea? Thanks, Bernhard

2 4

[Dovecot] dovecotpw
by Brent Clark 08 Mar '08

08 Mar '08

Hi I would like to simulate dovecot's dovecotpw with a perl script I tried / used use Crypt::SaltedHash; my $csh = Crypt::SaltedHash->new(algorithm => 'SHA-1'); $csh->add($passwd_string); my $salted = $csh->generate; also use Digest::SHA1; use MIME::Base64; $ctx = Digest::SHA1->new; $ctx->add($passwd_string); $ctx->add('salt'); my $salted = '{SSHA}' . encode_base64($ctx->digest . 'salt' ,''); But it doesnt work. Basically what im doing is authenticating against a mysql db. If i do a dovecotpw -s SSHA -p password and update the DB, then the mail client authenticates perfectly. If anyone can help, it would be most appreciated. Kind Regards Brent Clark

2 3

[Dovecot] dovecot and ldap config - getting no password in reply
by Joseph Norris 08 Mar '08

08 Mar '08

I almost go this liked but then I get the following: Mar 7 18:09:43 malaga dovecot: auth(default): ldap(jnorris,76.20.83.98): pass search: base=ou=People,dc=ucmerced,dc=edu scope=subtree filter=(&(uid=jnorris)) fields=uid,userPassword Mar 7 18:09:43 malaga dovecot: auth(default): ldap(jnorris,76.20.83.98): result: uid(user)=jnorris Mar 7 18:09:43 malaga dovecot: auth(default): ldap(jnorris,76.20.83.98): No password in reply Mar 7 18:09:45 malaga dovecot: auth(default): client out: FAIL 2 user=jnorris temp What am I missing in my conf files? -- Cell: 209.201.3410 Desk: 209.228.4576 email: jnorris(a)ucmerced.edu #Joseph Norris (Linux/Apache/Mysql/Perl - what else is there?) print @c=map chr $_+100,(6,17,15,16,-68,-3,10,11, 16,4,1, 14,-68,12,1,14,8, -68,4,-3,-1,7,1,14,-68, -26,11,15,1,12, 4,-68,-22,11,14,14,5,15,-90);

3 2

[Dovecot] User another userdb to sasl
by Nicolas Letellier 08 Mar '08

08 Mar '08

Hello, I use Dovecot 1.0.12 with Postfix on FreeBSD. It works perfectly, but I have a question. My users are virtual (stocked in a MySQL database). I use SASL Dovecot authentification, and SASL uses my userdb (for POP/IMAP access). However, I would like my users have an other login/password to send email with SMTP/SASL. Or, I don't want my users use the same login/password for POP/IMAP than SMTP. More, I don't want some users could send emails with their login/password, but I want they can fetch their mails. I'm looking for an option in my dovecot.conf to specifie a table SQL for SASL authentification (and don't use same table SQL than IMAP/POP access). How I could do for this problem? Do you have an idea? Or, simply, is it possible with Dovecot SASL? I read all Dovecot wiki, with no results... Thanks very much. Nicolas

4 3

[Dovecot] limit numbers of fails logins
by Federico Nan 07 Mar '08

07 Mar '08

Hi!! i want to limit the retry of the login process if the password dosent match. i use dovecot gssapi login plugin. if a user put your password wrong twice, i want dovecot ban that user for a while o something like that, its that possible?? thanks a lot!!! sorry my english! -- Federico Nan Nantec.net federico(a)nantec.net

2 1

[Dovecot] Can't load private key file
by adamsh＠fsfa.org 07 Mar '08

07 Mar '08

Hi Guys, I have just purchased and installed an authenticated certificate for the mail server, but I am getting errors from dovecot. My mail.err file is showing the following. Mar 7 17:56:04 mailserver dovecot: pop3-login: Can't load private key file /etc/ssl/mailserver/mail.mydomain.tld.key: error:0906A068:PEM routines:PEM_do_header:bad password read My dovecot.conf has the following set. # Uncomment these if using SSL ssl_cert_file = /etc/ssl/mailserver/mail.mydomain.tld.crt ssl_key_file = /etc/ssl/mailserver/mail.mydomain.tld.key #ssl_key_password = #ssl_ca_file = /etc/ssl/mailserver/ca/mydomain.pem #ssl_verify_client_cert = yes ssl_parameters_regenerate = 168 verbose_ssl = no I have been playing about with it all for about 3 hours now and would greatly appreciate any help ;) Regards Adam -------------------------------------------------------------------- myhosting.com - Premium Microsoft® Windows® and Linux web and application hosting - http://link.myhosting.com/myhosting

2 1