September 2008 - dovecot

[Dovecot] ACL plugin
by Matvey Soloviev 01 Oct '08

01 Oct '08

Hello, I am working on implementing support for the RFC4314 ACL management commands and responses in the ACL plugin included with dovecot 1.1.2. (I verified the error persists with 1.1.3 though.) While the described objective is still in the works, I have stumbled upon what I believe to be a critical issue with the handling of negative rights in the present ACL plugin - to be precise, the cache component of it handles them in the exact same way as it does positive rights, thus granting rather than retracting the individual privileges. To fix this, go to src/plugins/acl/acl-cache.c:391. The line and the one following it should read p[j] |= obj_cache->my_neg_rights[i]->mask[j]; Replace that to read p[j] &= ~obj_cache->my_neg_rights[i]->mask[j]; I hope this information is useful. Regards, M. Soloviev

4 7

[Dovecot] disbale to responded to an unrequested SSL Certificate
by Andre Hübner 01 Oct '08

01 Oct '08

Hi dovecot-list, just a easy question today ;) Customer did on Server a PCI-Test to test security to fit worldpay requirements. They found a critical risk at pop3s. (and some other things) This is the Textmesage: ############ Family: Remote Shell Access Critical 993/tcp 11875 Description: The remote host responded to an unrequested SSL Certificate. The remote SSL server should have sent back an Error message. This may indicate that the server is vulnerable to a remote flaw in the way that it handles unrequested certificates. You should manually inspect the SSL Server's configuration ############ Background is that we use a wildcard-cert which is installed on ervery machine and fits to servername. So you have to use the accredited Hostname/Servername to make clean ssl connection pop3s/imaps without warnings etc. Problem should be that server sends no error when requested with other hostname. This is significant part from dovecot.conf protocols = imap imaps pop3 pop3s ssl_disable = no ssl_cert_file = "/path/to/*.myhost.com.crt" ssl_key_file = "/path/to/*.myhost.com.key" ssl_ca_file = "/path/to/*.myhost.com.bundle.crt" Is there a Config-Option to send error when ssl-connect ist not established to in cert accredited Hostname/Servername ? Did not found something like this or did not really understand function of the options. I do not know backgrounds to this issue. Cant decide if it would be a security risk or disproportionated wishes of securityexperts but i want to satisfy this costumer. How to handle thos? Thank you Andre

2 1

[Dovecot] quota warnings clarification
by Ian B 01 Oct '08

01 Oct '08

I spent a long while trying to get quota warnings working with v1.1.3 on Centos5 before almost giving up. I configured everything as per the instructions on the Quota wiki page however no warning emails were being generated when I tested & no debug messages in the log to give any clues as to what I was doing wrong. It turns out I wasn't doing anything wrong, but just misunderstanding at what point the warnings are generated. The warning email appears to only be generated when a message is moved from one folder to another. I was expecting the warning to be generated when the INBOX was simply opened & viewed! Is this how it is supposed to work? If so, perhaps a note of clarification could be added to the wiki page? Make the switch to the world's best email. Get Yahoo!7 Mail! http://au.yahoo.com/y7mail

2 2

[Dovecot] Managesieve Quota
by Seth Mattinen 30 Sep '08

30 Sep '08

Has anyone (is anyone) working on adding quota support to dovecot's managesieve server? I was thinking about giving it a shot myself and I'd hate to duplicate work. It would be something very basic like a max bytes setting and the total sieve storage per user isn't allowed to exceed it. ~Seth

4 7

[Dovecot] PKI Compliance Dovecot Server
by Amit Thakkar 30 Sep '08

30 Sep '08

Hello, I work for an organization that uses a Secure Dovecot server for messaging, and recently we've had to undergo some security screenings for PKI compliance (credit card industry standards). However, the screening returned to us a failure due to the following reason (attributed to our Dovecot server, which runs on port 993 and is the only "open" port on our firewall): Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers fromseveral cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients. See also : http://www.schneier.com/paper-ssl.pdf Solution: Consult the application's documentation to disable SSL 2.0 and use SSL 3.0 or TLS 1.0 instead. See http://support.microsoft.com/kb/216482 for instructions on IIS. See http://httpd.apache.org/docs/2.0/mod/mod _ssl.html for Apache. Risk Factor: Medium / CVSS Base Score : 2 (AV:R/AC:L/Au:NR/C:P/A:N/I:N/B:N) [More] Is there a way that we can disable SSL 2.0 in Dovecot, or force it to use only TLS 1.0 ? Thank You

4 3

[Dovecot] dovecot quota messages
by Cosmin Natea 30 Sep '08

30 Sep '08

Hi. I have a question about quota messages (dovecot 1.1.3). I'm trying to use quota messages for moving messages in a new folder when they reach a certain number(10000). I made the script which is called when quota_warning condition is met. Then i made a rule to exclude that folder from quota, quota_rule3:folder:ignore The problem is that this folder is still counted in quota. I don't know if this is a bug or this is how ignore is supposed to work(maybe ignore works only for storage).

1 0

[Dovecot] dovecot quota messages problem
by costexx 30 Sep '08

30 Sep '08

Hi. I have a question about quota messages (dovecot 1.1.3). I'm tryng to use quota messages for moving messages in a new folder when they reach a certin number(10000). I made the script which is called when quota_warning condition is met. Then i made a rule to exclude that folder from quota, quota_rule3:folder:ignore The problem is that this folder is still counted in quota. I don't know if this is a bug or this is how ignore is suposed to work(maibe ignore works only for storage). -- View this message in context: http://www.nabble.com/dovecot-quota-messages-problem-tp19738722p19738722.ht… Sent from the Dovecot mailing list archive at Nabble.com.

1 0

[Dovecot] dovecot 1.2.alpha1 quota dict driver mysql broken
by Robert Schetterer 29 Sep '08

29 Sep '08

Hi Timo, quota dict seems to be broken with 1.2.alpha1 MAP(robert(a)schetterer.com): read(/var/run/dovecot/dict-server) failed: Remote disconnected dovecot: Sep 24 18:43:16 Error: dict: Error in configuration file /etc/dovecot/dovecot-dict-quota.conf line 1: Unknown setting: driver dovecot: Sep 24 18:43:16 Error: dict: Failed to initialize dictionary 'quotadict' etc/dovecot/dovecot-dict-quota.conf driver = mysql connect = host=localhost dbname=postfix user=postfix password=... default_pass_scheme = PLAIN table = quota select_field = current where_field = path username_field = username worked with 1.1.3 -- Best Regards MfG Robert Schetterer Germany/Munich/Bavaria

2 8

[Dovecot] login processes killed with signal 15
by Radu Popescu 29 Sep '08

29 Sep '08

[root@xxx etc]# dovecot --version 1.1.3 [root@adi-ion etc]# dovecot -n # 1.1.3: /usr/local/etc/dovecot.conf log_path: /var/log/dovecot protocols: imap imaps pop3 pop3s ssl_cert_file: /etc/postfix/smtpd.cert ssl_key_file: /etc/postfix/smtpd.key disable_plaintext_auth: no login_dir: /usr/local/var/run/dovecot/login login_executable(default): /usr/local/libexec/dovecot/imap-login login_executable(imap): /usr/local/libexec/dovecot/imap-login login_executable(pop3): /usr/local/libexec/dovecot/pop3-login mail_location: maildir:/home/vmail/%d/%n/ mail_debug: yes mail_executable(default): /usr/local/libexec/dovecot/imap mail_executable(imap): /usr/local/libexec/dovecot/imap mail_executable(pop3): /usr/local/libexec/dovecot/pop3 mail_plugin_dir(default): /usr/local/lib/dovecot/imap mail_plugin_dir(imap): /usr/local/lib/dovecot/imap mail_plugin_dir(pop3): /usr/local/lib/dovecot/pop3 pop3_uidl_format(default): %08Xu%08Xv pop3_uidl_format(imap): %08Xu%08Xv pop3_uidl_format(pop3): %v.%u auth default: mechanisms: plain login debug: yes debug_passwords: yes passdb: driver: sql args: /usr/local/etc/dovecot-sql.conf userdb: driver: sql args: /usr/local/etc/dovecot-sql.conf socket: type: listen master: path: /usr/local/var/run/dovecot/auth-master mode: 384 user: vmail group: vmail The log looks like this - it happens every few days: dovecot: Sep 28 02:28:40 Warning: pop3-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: imap-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: pop3-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: auth(default): Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: pop3-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: imap-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: imap-login: Killed with signal 15 dovecot: Sep 28 02:28:40 Warning: I/O leak: 0x407150 (24) deliver(xxx(a)xxx.com): Sep 28 04:07:04 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:07:53 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:08:12 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:13:18 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory deliver(xxx(a)xxx.com): Sep 28 04:13:18 Error: Can't connect to auth server at /usr/local/var/run/dovecot/auth-master: No such file or directory It's not a rpm installation, it compiled by me. The OS is a CentOS5.2.

2 1

[Dovecot] Converting from MBOX to Maildir broke procmail and Spamassasin and halted incoming mail
by Dan Roberts 29 Sep '08

29 Sep '08

I could use some help here - As I use Dovecot I started here when trying to figure out why I could not add new mail folders under my Mac's Mail program, but could under Thunderbird. It was quickly pointed out that my system was set up to use MBOX and not MAILDIR, and some helpful links and notes were sent back and forth giving me a good clue as to how to perform the conversion process. I did have success in getting my mail accounts converted from mbox to maildir, but then ran aground. I could see all of my existing mail and create new folders, but I could not see any of my incoming mail. What I was late in realizing was that I needed to also adjust the settings for my LDA, which as I am using sendmail is procmail, and it was suggested that I needed to adjust /etc/procmail to include the line DEFAULT=$HOME/Maildir/ I did that, but new mail still didn't show up correctly. I can only assume that I have something still not properly adjusted in my procmail settings. Given that I got everything else to work, and even successfully upgraded dovecot, it was very frustrating to set everything back to square one with mbox so that I had a functioning system once again. I am about to have some time on my hands and am going to try again - but this time I thought I would ask for help before I possibly loose my ability to receive new mail - makes reading those suggestions very hard. At present, my etc/procmailrc file is like this. ----------- [dan@trailrunner etc]$ cat procmailrc # send mail through SpamAssassin :0 fw * < 256000 | /usr/bin/spamc -f ----------- In each users Home directory I have a .procmailrc file that further directs things on a user level. For my directory this file is currently --------------- [dan@trailrunner ~]$ cat .procmailrc MAILDIR=$HOME/mail PROBABLYJUNK = /home/dan/mail/probably-spam :O H * ^X-Spam-Status:.*Yes { EXITCODE=67 :0: probably-spam } --------------- I admit that I set up Spamassasin some years ago and though I have updated things now and then, I don't recall all of the reasoning behind the setup - just know that it has been working. Whether I put the new line "DEFAULT=$HOME/Maildir/" in one file, the other or both - I got no incoming mail. My guess was that I had offended promail in one way or another. So, as I prepare to do the MBOX to MAILDIR conversion once again, does anyone have any guidance to offer for how to properly adjust the procmail files so that I can continue to filter spam? Much appreciated. Cheers - dan

4 6