September 2009 - dovecot

[Dovecot] Security holes in CMU Sieve plugin
by Timo Sirainen 14 Sep '09

14 Sep '09

A recently found security hole in Cyrus Sieve exists also in Dovecot, because Dovecot's Sieve plugin is based on libsieve from Cyrus project. I also found and fixed a few additional buffer overflows that I can't really understand why I hadn't noticed/fixed before. This security hole affects all installations that give their users any kind of ability to modify their Sieve scripts. Even if you give only limited access it might be enough for an attacker. For example forwarding a user's mails to about 100 addresses should do the trick. Since these are buffer overflows for variables in stack, they're very likely exploitable and allow attackers to execute arbitrary code as the user. Note that this security hole doesn't exist in Stephan Bosch's excellent new Sieve plugin for Dovecot v1.2. I encourage everyone to switch to using it as soon as possible. Who knows what other holes still lurk in libsieve. The bugs are fixed in v1.1.7 release for Dovecot v1.1+: http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.1.7.tar.gz.sig and in v1.0.4 release for Dovecot v1.0: http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz http://dovecot.org/releases/sieve/dovecot-sieve-1.0.4.tar.gz.sig You can also get them as a patch: http://hg.dovecot.org/dovecot-sieve-1.1/rev/049f22520628 http://hg.dovecot.org/dovecot-sieve-1.1/rev/4577c4e1130d

1 0

[Dovecot] Sieve and locale (Japanese)
by Jorgen Lundman 14 Sep '09

14 Sep '09

I have setup Dovecot-1.2 'delivery' to use Dovecot's Sieve as well (both versions are latest from dovecot.org) I am curious if sieve can handle Japanese, or locale, in general in the language. In particular, the subject which is encoded even more complicated. if header :contains "subject" ["test", "テスト"] { So if I want to file based on above, test, and tesuto (utf-8). Most Japanese mail is send in iso-2022-jp, will it use iconv to change to utf-8 before the test? Then handle the Subject encoding? (It's also possible to be in EUC-JP, but that is unusual). Or is it something on TODO? -- Jorgen Lundman | <lundman(a)lundman.net> Unix Administrator | +81 (0)3 -5456-2687 ext 1017 (work) Shibuya-ku, Tokyo | +81 (0)90-5578-8500 (cell) Japan | +81 (0)3 -3375-1767 (home)

3 7

[Dovecot] Command died with signal 11: "/usr/lib/dovecot/deliver"
by Maciej Polewczyński 14 Sep '09

14 Sep '09

Hello I have problem with deliver dying with signal 11. I'm using postfix + dovecot devliver. If mailbox have many (100+) redirects in sieve or many other sieve rules deliver died. I have tested this in debian etch + dovecot 1.1.18 (compiled from sources) and debian lenny + dovecot 1.1.13 from backports. Sep 7 13:58:19 mail postfix/pipe[5964]: AC6835938: to=<test1(a)mx.domain>, orig_to=<test1@domain>, relay=dovecot, delay=10, delays=0.06/0.01/0/10, dsn=5.3.0, status=bounced (Command died with signal 11: "/usr/lib/dovecot/deliver") I try to debug by running deliver via gdbhelper: GNU gdb 6.4.90-debian Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i486-linux-gnu"..."/tmp/deliver.sh": not in executable format: File format not recognized Attaching to process 8557 Reading symbols from /bin/bash...(no debugging symbols found)...done. Using host libthread_db library "/lib/tls/i686/cmov/libthread_db.so.1". Reading symbols from /lib/libncurses.so.5...(no debugging symbols found)...done. Loaded symbols for /lib/libncurses.so.5 Reading symbols from /lib/tls/i686/cmov/libdl.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/tls/i686/cmov/libdl.so.2 Reading symbols from /lib/tls/i686/cmov/libc.so.6...(no debugging symbols found)...done. Loaded symbols for /lib/tls/i686/cmov/libc.so.6 Reading symbols from /lib/ld-linux.so.2... (no debugging symbols found)...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/tls/i686/cmov/libnss_files.so.2...(no debugging symbols found)...done. Loaded symbols for /lib/tls/i686/cmov/libnss_files.so.2 (no debugging symbols found) 0xffffe410 in __kernel_vsyscall () (gdb) Signal Stop Print Pass to program Description SIGPIPE No Yes Yes Broken pipe (gdb) Signal Stop Print Pass to program Description SIGALRM No No Yes Alarm clock (gdb) Signal Stop Print Pass to program Description SIG32 No Yes Yes Real-time event 32 (gdb) Continuing. Program received signal SIGSEGV, Segmentation fault. 0xb7e458d2 in free () from /lib/tls/i686/cmov/libc.so.6 (gdb) #0 0xb7e458d2 in free () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #1 0xbfb3aed4 in ?? () No symbol table info available. #2 0xffffeffc in ?? () No symbol table info available. #3 0xb7e4a45c in mtrace () from /lib/tls/i686/cmov/libc.so.6 No symbol table info available. #4 0x08119ecc in ?? () No symbol table info available. #5 0xbfb3aed4 in ?? () No symbol table info available. #6 0xbfb3af18 in ?? () No symbol table info available. #7 0xbfb3aecc in ?? () No symbol table info available. #8 0x08118e50 in ?? () No symbol table info available. #9 0x08111f18 in ?? () No symbol table info available. #10 0xbfb3aed8 in ?? () No symbol table info available. #11 0x00000000 in ?? () No symbol table info available. (gdb) Detaching from program: /bin/bash, process 8557 my config base_dir = /var/run/dovecot/ protocols = imap imaps pop3 pop3s disable_plaintext_auth = no log_timestamp = "%Y-%m-%d %H:%M:%S " mail_location = maildir:%h/Maildir mail_privileged_group = mail verbose_proctitle = yes first_valid_uid = 1000 protocol imap { mail_max_userip_connections = 10 mail_plugin_dir = /usr/lib/dovecot/modules/imap mail_plugins = quota imap_quota zlib imap_logout_format = bytes=%i/%o imap_client_workarounds = delay-newmail } protocol pop3 { pop3_uidl_format = %Mf mail_max_userip_connections = 3 mail_plugin_dir = /usr/lib/dovecot/modules/pop3 mail_plugins = quota zlib pop3_client_workarounds = outlook-no-nuls oe-ns-eoh } protocol lda { postmaster_address = postmaster(a)example.com mail_plugins = cmusieve quota mail_plugin_dir = /usr/lib/dovecot/modules/lda sieve_global_dir = /etc/ogicom/sieve/global/ deliver_log_format = msgid=%m: %$ (subject: %s, From: %f) auth_socket_path = /var/run/dovecot/auth-master } auth_username_chars = abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@+% auth default { mechanisms = plain login passdb sql { args = /etc/dovecot/dovecot-sql.user.conf } passdb sql { args = /etc/dovecot/dovecot-sql.alias.conf } userdb prefetch { } userdb prefetch { } userdb sql { args = /etc/dovecot/dovecot-sql.deliver.conf } user = root socket listen { master { path = /var/run/dovecot/auth-master mode = 0600 user = vmail } client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } dict { } plugin { quota_rule = *:storage=5G quota = maildir } There is a bug in dovecot code? Is there workaround? -- Pozdrowienia Maciej Polewczynski Registered Linux user #117725 OGICOM Sp. z o.o., 61-131 Poznan, ul. Baraniaka 88 REGON 634407251, NIP 781-17-20-476, KRS 0000140692 kapital zakladowy: 410 000 PLN

2 4

[Dovecot] v.1.2.4 deliver maildir quota does not work
by myleetlist＠gmx.de 14 Sep '09

14 Sep '09

Hi, I'm using deliver for storing new mails (nfs). Since v.1.2 deliver does not reject mails if over quota (maildir quota). test with v. 1.1.18: # HOME=/tmp/maildir/ /path/dovecot-1.1.18/libexec/dovecot/deliver -e -c /path/dovecot-1.1.18/etc/dovecot.conf # Quota exceeded (mailbox for user is full) test with v. 1.2.4: # HOME=/tmp/maildir/ /path/dovecot-1.2.4/libexec/dovecot/deliver -e -c /path/dovecot-1.2.4/etc/dovecot.conf -> mail is saved to INBOX so where is the problem? what am I doing wrong? greets, Walter. # cat maildirsize 250S 8399 21 46 1 log output with mail_debug = yes: deliver(User): Loading modules from directory: /path/dovecot-1.2.4/lib/dovecot/lda deliver(User): Module loaded: /path/dovecot-1.2.4/lib/dovecot/lda/lib10_quota_plugin.so deliver(User): Module loaded: /path/dovecot-1.2.4/lib/dovecot/lda/lib90_sieve_plugin.so deliver(User): Quota root: name=User quota backend=maildir args= deliver(User): Namespace: type=private, prefix=INBOX., sep=., inbox=yes, hidden=no, list=1, subscriptions=yes deliver(User): maildir: data=/tmp/maildir/:INDEX=MEMORY deliver(User): maildir++: root=/tmp/maildir, index=, control=, inbox=/tmp/maildir deliver(User): sieve: local script path /tmp/maildir/filter.sieve doesn't exist (using global script path in stead) deliver(User): sieve: user has no valid personal script deliver(User): sieve: no scripts to execute: reverting to default delivery. deliver(User): Namespace INBOX.: Using permissions from /tmp/maildir: mode=0700 gid=-1 deliver(User): msgid=: test () - saved mail to INBOX # 1.2.4: /path/dovecot-1.2.4/etc/dovecot.conf # OS: Linux 2.6.18-92.1.22.el5 i686 CentOS release 5.2 (Final) log_timestamp: %Y-%m-%d %H:%M:%S protocols: none ssl: no verbose_proctitle: yes mail_gid: 6 mail_location: maildir:%h:INDEX=MEMORY mmap_disable: yes mail_nfs_storage: yes mail_nfs_index: yes maildir_copy_preserve_filename: yes namespace: type: private separator: . prefix: INBOX. location: maildir:%h:INDEX=MEMORY inbox: yes list: yes subscriptions: yes lda: postmaster_address: postmaster@... mail_location: maildir:%h:INDEX=MEMORY mail_plugins: quota sieve deliver_log_format: msgid=%m: %f (%s) - %$ auth default: passdb: driver: pam userdb: driver: passwd userdb: driver: static args: allow_all_users=yes gid=6 sieve=%hfilter.sieve plugin: quota: maildir:User quota sieve: %hfilter.sieve -- GRATIS für alle GMX-Mitglieder: Die maxdome Movie-FLAT! Jetzt freischalten unter http://portal.gmx.net/de/go/maxdome01

3 6

[Dovecot] dovecot + managesieve
by Eero Volotinen 13 Sep '09

13 Sep '09

Is there way to disable plaintext managesieve protocol from dovecot and support only ssl version? how? thanks, -- Eero

2 1

[Dovecot] Dovecot upgrade from 1.0.7-7.el5 to 1.2.4 ?
by Eero Volotinen 12 Sep '09

12 Sep '09

I am currently using dovecot 1.0.7-7.el5 on 32bit centos. Plan is to upgrade to 1.2.4 using http://atrpms.net/dist/el5/dovecot/ rpms. My config is very minimal: protocols = imaps imap ssl_cert_file = /etc/pki/tls/certs/server.cert ssl_key_file = /etc/pki/tls/private/server.key ssl_cipher_list = HIGH:MEDIUM:+TLSv1:!SSLv2:+SSLv3 mail_location = maildir:~/Maildir protocol imap { } protocol pop3 { } auth default { mechanisms = plain login passdb pam { } userdb passwd { } user = root socket listen { client { path = /var/spool/postfix/private/auth mode = 0660 user = postfix group = postfix } } } Just wondering if 1.0 to 1.2.4 is safe, or do I need to upgade to 1.1 first? Thanks, Eero

2 1

[Dovecot] Question about the pop3 feature "leave messages on server for a certain period of time"
by Δημήτριος Καραπιπέ ρης 12 Sep '09

12 Sep '09

Hi all I am missing something on the the pop3 "leave messages" rationale. Although the UIDL feature solves for the MUA the problem "whch mails should be downloaded", how the duration that these mails should be kept on server, say 10 days for one MUA and 20 days for another MUA for the same account, is resolved on the server? thanks in advance -- ΔΗΜΗΤΡΙΟΣ ΚΑΡΑΠΙΠΕΡΗΣ ΤΕΧΝ. ΥΠ. ΣΥΖΕΥΞΙΣ ΕΛΛΗΝΙΚΗ ΔΗΜΟΚΡΑΤΙΑ - Ν. ΘΕΣΣΑΛΟΝΙΚΗΣ ΔΗΜΟΣ ΘΕΣΣΑΛΟΝΙΚΗΣ - Δ/ΝΣΗ ΟΡΓΑΝΩΣΕΩΣ & ΜΕΘΟΔΩΝ 2310 - 257844 fax 2310 - 244965

8 12

[Dovecot] Sieve, vacation, variables and russian language
by Sergey Grigorian 12 Sep '09

12 Sep '09

Folks, I'm using a Sieve script for vacation messages and there's something strange with it in certain cases. The script uses the "variables" extension to produce the "Re: [original subject] (autoreply)" subject line for the vacation message. All is well except for cases when that [original subject] is written in Russian. In those cases the subject string is garbled, and the Amavis content filter says "X-Amavis-Alert: BAD HEADER SECTION, Non-encoded 8-bit data (char D0 hex):Subject: RE: \320\277\321?\320\276\320\261\320\260 (Auto[...]" It doesn't complain about English subject strings, though. I've seen the thread about "Sieve vacation with russian subject" at http://www.dovecot.org/list/dovecot/2009-July/041031.html , but that wasn't quite a solution. I can't figure out how to work around that, could anyone help out please? Mandatory info: FreeBSD 7.2 i386, dovecot 1.2.3, dovecot-sieve-1.2+0.1.11 And here's the script itself: require ["fileinto", "vacation", "variables"]; set "subject" ""; if header :matches "subject" "*" { set "subject" "${1}"; } vacation :days 1 :subject "RE: ${subject}" "[vacation message text]"; P.S. Stephan Bosch, thank you very much for what you've done with sieve.

3 3

[Dovecot] Problem Deleting IMAP Folders
by Stuart Gall 11 Sep '09

11 Sep '09

Hello, In my configuration I have mail_location = maildir:/Mail/frank.gr/%n:INDEX=/Mail/frank.gr/ __Indexes/%u I can create new folders in an IMAP session, but when I try to delete I get permission denied. From the LOG Sep 10 13:20:06 IMAP(stuart): Error: unlink_directory(/Mail/frank.gr/ __Indexes/stuart/.TEST) failed: Permission denied ls -ald /Mail/frank.gr/__Indexes/stuart/.TEST drwx------ 2 mail mem 4096 2009-09-10 13:20 /Mail/frank.gr/__Indexes/ stuart/.TEST/ ls -al /Mail/frank.gr/__Indexes/stuart/.TEST total 12 drwx------ 2 mail mem 4096 2009-09-10 13:20 ./ drwx------ 4 mail mem 4096 2009-09-10 13:20 ../ -rw------- 1 mail mem 156 2009-09-10 13:20 dovecot.index.log It looks like dovecot is trying to unlink the INDEX directory without first deleting the index log file. Anyone else experienced this problem ? -- Stuart Gall ---------------------------------------------- All of your mail are belong to us

2 2

[Dovecot] dovecot 1.2 and logging start failures
by Michal Hlavinka 11 Sep '09

11 Sep '09

Hi, I've got report about issue when dovecot fails to start and there is no error logged (error goes only to stderr) situation: 1) dovecot is running 2) dovecot is automatically updated to new version (by yum update daemon), after update, dovecot is restarted (it's part of update script) 3) new dovecot fails to start (for whatever reason) result: dovecot not running and no error message has been logged because (at least some) errors were written to stderr only and not syslog another situation (original issue) was when dovecot was configured to listen for ipv4 and ipv6 connections. ipv6 support was disabled. After server reboot, dovecot failed to start, producing dovecot: Fatal: listen(::, 143) failed: Address already in use only to stderr, nothing in logs. Would it be possible to use syslog for error output sooner or there are any cons? Regards, Michal Hlavinka

2 4