November 2010 - dovecot

[Dovecot] correct syntax for multiple ports
by Kilburn Abrahams 12 Nov '10

12 Nov '10

Hi, What is the correct format to specify multple ports in dovecot 2. With dovecot 1.2 listen = *:143 *:6188 worked fine. I cannot find any mention in the wiki2 about the different combinations of listen, address and port parameters and dovecot complains about the combinations I tried. Does not seem to work 1. inet_listener imap { listen = *:143 *:6188 } 2. inet_listener imap { address = *:143 *:6188 } 3. inet_listener imap { port = 143, 6188 or port = 143 6188 } This start dovecot, but roundcube will not connect on port 143, although Thunderbird will connect on 1432 and 6188 listen = *, :: 1. inet_listener imap { port 143 port = 6188 } Regards K

2 4

[Dovecot] Phantom email message
by Marc Perkel 12 Nov '10

12 Nov '10

Got sort of a strange problem on one email account. Everything works fine with Thunderbird/IMAP showing the correct unread message count. But on my DroidX smartphone one of my email accounts always shows one unread message, but I can't bring any unread messages up. It's like there's something there making it think there's a message when there isn't. The email client is K-9 mail Anyone have any ideas?

4 5

[Dovecot] --exec-mail
by David Woodhouse 12 Nov '10

12 Nov '10

Most of my IMAP access is achieved by 'ssh $mailhost exec dovecot --exec-mail imap'. I'm testing Dovecot 2.0, and this doesn't seem to work any more — and I can't seem to work out how to make it work. The wiki page at http://wiki2.dovecot.org/Upgrading/2.0 has no mention of it. I looked through the git history to find the commit that broke it and see if I could find the replacement that way, but it was the commit entitled 'Initial commit for v2.0 master rewrite.', and wasn't particularly edifying. Once upon a time in the dim and distant past, I believe I used to run /usr/libexec/dovecot/imap directly. But that doesn't set the environment up correctly, so isn't the right way to do it... is it? -- dwmw2

2 2

[Dovecot] setting up Dovecot
by Scott Berry 12 Nov '10

12 Nov '10

Hello there, I am a new user of Dovecot. I am using version 1.2.12. Here is the config file: I attached the dovecot.conf file as a screenshot using dovecot -n because I am blind and haven't quite figured out how to copy from the terminal to Gnome yet. My intentions here are as follows: 1. To allow only pop3s because I want to use ssl for security. 2. I am going to be using fetchmail to grab the mail and give it to dovecot. 3. There will be three people adventually grabbing their mail through pop3s. Another question I have is when you tell someone to configure their mail client through pop3s how does that work as far as the server name meaning like most ISp's have pop.whatever.whatever.? Also I am using a smarthost with postfix to send out the mail through Google how do I tell someone how to configure the smtp server in their mail client such as Isp's such as smtp.whatever.whatever. I am using Windows for two of the clients with Windows Mail on a Vista machine and Windows Mail on a Windows 7 machine and Evolution on a Ubuntu linux machine. Looks to me like everything is copeastetic except for how to log in. The SSL cert file in "/etc/ssl/certs/dovecot.pem" is a bit tricky cause I didn't create the cert so I am not sure of the password but I did try my normal root password. Not sure if that works. Other than this actually Dovecot is quite easy to config.

2 1

[Dovecot] Dovecot 2.0.7 Virtual plugin
by Henrique Fernandes 12 Nov '10

12 Nov '10

Well, it seens the virtual plugins is not working correctly or i miss undertood how to configurate it. http://wiki2.dovecot.org/Plugins/Virtual as this wiki says, I should be possible to make an ndeamespace namespace { prefix = virtual/ separator = / location = virtual:~/Maildir/virtual } And in side of ~/Maildir/virtual create virtual folders and inside of those folders create dovecot-vitual. But it does not work. Right if i make this conf, on my imap client it shows a folder called virtual ( the prefix, or whtever i put in there ) and show nothing, only shows something if i create a dovecot-virtual inside of ~/Maildir/virtual/ i would appreciate if someone explain what i am doind wrong. Thanks! my dovecot -n # 2.0.7: /usr/local/etc/dovecot/dovecot.conf # OS: Linux 2.6.32-5-amd64 x86_64 Debian squeeze/sid mail_debug = yes mail_location = maildir:~/TesteEmail/Maildir mail_plugins = " virtual" namespace { inbox = yes location = prefix = separator = / } namespace virtual { location = virtual:~/TesteEmail/virtual/ prefix = virtual/ separator = / } passdb { driver = pam } ssl = no userdb { driver = passwd } protocol imap { mail_plugins = " virtual virtual" } []'sf.rique

2 5

[Dovecot] Authentication Failure
by Carlos Mennens 11 Nov '10

11 Nov '10

I am unable to login to my new mail server running Dovecot and Postfix for some reason. When I check the mail logs, I am seeing: Nov 11 16:06:29 mail dovecot: imap-login: Disconnected (no auth attempts): rip=10.1.10.204, lip=192.168.0.200, TLS handshaking: SSL_accept() failed: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca: SSL alert number 48 Nov 11 16:06:36 mail dovecot: auth: Error: pam(carlos,10.1.10.204): pam_authenticate() failed: Authentication failure (/etc/pam.d/dovecot missing?) Nov 11 16:06:53 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts): user=<carlos>, method=PLAIN, rip=10.1.10.204, lip=192.168.0.200, TLS Nov 11 16:07:12 mail dovecot: imap-login: Disconnected (auth failed, 3 attempts): user=<carlos(a)iamghost.com>, method=PLAIN, rip=10.1.10.204, lip=192.168.0.200, TLS Below is my configuration file for Dovecot: # 2.0.7: /etc/dovecot/dovecot.conf # OS: Linux 2.6.35 x86_64 auth_mechanisms = plain login mail_location = maildir:~/mail passdb { driver = pam } protocols = imap service auth { unix_listener auth-client { group = postfix mode = 0660 user = postfix } user = root } ssl_cert = </etc/ssl/certs/mail.crt ssl_key = </etc/ssl/private/mail.key userdb { driver = passwd } protocol imap { imap_client_workarounds = delay-newmail tb-extra-mailbox-sep } Does anyone know what is causing this error or how I can resolve this?

1 0

[Dovecot] $MAIL environment variable to override mail_location works in v1.2.16 but not in v2.0.7 for /usr/libexec/dovecot/imap
by Giam Teck Choon 11 Nov '10

11 Nov '10

Hi, For the past day, I have been researching about making dovecot to support mailfront (http://untroubled.org/mailfront/) imapfront-auth natively and able to use mailfront imapfront-auth with dovecot imap v1.2.16 without starting any dovecot related services and no /etc/dovecot.conf file is required. More information about this can be read at: http://lists.untroubled.org/?list=bgware&cmd=showthread&month=201011&thread… However, same trick can't be used for dovecot v2.0.7. First error is /etc/dovecot/dovecot.conf must be exists so I just simply touch /etc/dovecot/dovecot.conf with empty content to bypass that error. I noticed v2.0.7 is not using $MAIL environment variable to override mail_location? I have read the following: http://wiki2.dovecot.org/MailLocation Any idea to override mail_location setting? I have tried various setting of environment variables such as below: --------------------8<----------8<----------8<----------8<--------------------- #!/bin/sh # $MAIL, $HOME, $MAILDIR, $MAILBOX are the same in mailfront # imapfront-auth if [ -n "$MAIL" ]; then # make dovecot imap escape colon by replacing single : to :: export MAIL=maildir:`echo $MAIL | sed 's@:@::@g'` fi export USERDB_KEYS="$USERDB_KEYS mail" # For knowing all env. uncomment the below line and # see /tmp/imapd-log.txt # printenv >>/tmp/imapd-log.txt exec "$@" --------------------8<----------8<----------8<----------8<--------------------- The above script is being placed between imapfront-auth and dovecot imap (/usr/libexec/dovecot/imap). Thanks for any kind assistance. Kindest regards, Giam Teck Choon

2 5

[Dovecot] dovecot dictionary attacks
by PA 11 Nov '10

11 Nov '10

Hi, I been using dovecot for awhile and its been solid, however I been having some issues with dictionary attacks. I installed fail2ban and for the most part is working fine. However today I got another spammer relaying through my server. Looking at the logs I see the following dictonary attack from 94.242.206.37 Nov 10 03:04:38 pop dovecot: pop3-login: Disconnected: rip=94.242.206.37, lip=209.213.66.10 Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(ababa,94.242.206.37): lookup ..... And so on.. Then that ip gets banned by fail2ban [root@pop ~]# grep 94.242.206.37 /var/log/fail2ban.log 2010-11-10 03:04:42,416 fail2ban.actions: WARNING [dovecot] Ban 94.242.206.37 However on my smtp mail server that ip is already sending out all sorts of spam with the sasl username of Paramus. This username Paramus never shows up on the dovevot dictionary attack, as a matter of fact the user Paramus is nowhere to be found on the dovecot log at all and I have logs going back months. Does anyone have any idea what could of happened here. I mean if the user/passwd was already harvested by 94.242.206.37 why would they bother to start another dict. attack. I'm just not sure how they guess the username/password as its not on any logs that goes back months and I don't have a dovecot record for that user. /var/log/maillog:Nov 10 02:46:16 mrelay3 postfix/smtpd[27776]: 3B64928015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:47:54 mrelay3 postfix/smtpd[27776]: 247AB28016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:48:00 mrelay3 postfix/smtpd[27785]: 87DE128016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:56:00 mrelay3 postfix/smtpd[27792]: 9728628015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:05:38 mrelay3 postfix/smtpd[27808]: D529F28015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:06:00 mrelay3 postfix/smtpd[27808]: DDF7C2801B: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=Paramus Any help would be appreciated. paul

2 3

[Dovecot] Sieve problem with managesieve
by Simone Caruso 11 Nov '10

11 Nov '10

I have a problem with a sieve script.. my config is dovecot 1.2.15 with managesieve, and roundcube. Now i have this script WORKING: -- require ["fileinto"]; # rule:[TracSvil] if anyof (header :contains "From" "xxx(a)example.com") { fileinto "INBOX.Trac Svil"; stop; } -- And this script NOT working: require ["fileinto"]; # rule:[TracSvil] if anyof (header :is "From" "trac(a)ardeek.com") { fileinto "INBOX.Trac Svil"; stop; } Can someone explain me the difference between these script? there is any error in the second script? Greetings! -- Simone Caruso IT Consultant p.iva: 03045250838

3 3

[Dovecot] dovecot dictionary attacks
by Paul Amaral 11 Nov '10

11 Nov '10

Hi, I been using dovecot for awhile and its been solid, however I been having some issues with dictionary attacks. I installed fail2ban and for the most part is working fine. However today I got another spammer relaying through my server. Looking at the logs I see the following dictonary attack from 94.242.206.37 Nov 10 03:04:38 pop dovecot: pop3-login: Disconnected: rip=94.242.206.37, lip=209.213.66.10 Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(abaft,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aarhus,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): lookup Nov 10 03:04:38 pop dovecot: auth(default): shadow(aaron,94.242.206.37): unknown user Nov 10 03:04:38 pop dovecot: auth(default): client in: AUTH 1 PLAIN service=POP3 lip=209.213.66.10 rip=94.242.206.37 resp=<hidden> Nov 10 03:04:38 pop dovecot: auth(default): shadow(ababa,94.242.206.37): lookup ..... And so on.. Then that ip gets banned by fail2ban [root@pop ~]# grep 94.242.206.37 /var/log/fail2ban.log 2010-11-10 03:04:42,416 fail2ban.actions: WARNING [dovecot] Ban 94.242.206.37 However on my smtp mail server that ip is already sending out all sorts of spam with the sasl username of Paramus. This username Paramus never shows up on the dovevot dictionary attack, as a matter of fact the user Paramus is nowhere to be found on the dovecot log at all and I have logs going back months. Does anyone have any idea what could of happened here. I mean if the user/passwd was already harvested by 94.242.206.37 why would they bother to start another dict. attack. I'm just not sure how they guess the username/password as its not on any logs that goes back months and I don't have a dovecot record for that user. /var/log/maillog:Nov 10 02:46:16 mrelay3 postfix/smtpd[27776]: 3B64928015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:47:54 mrelay3 postfix/smtpd[27776]: 247AB28016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:48:00 mrelay3 postfix/smtpd[27785]: 87DE128016: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 02:56:00 mrelay3 postfix/smtpd[27792]: 9728628015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:05:38 mrelay3 postfix/smtpd[27808]: D529F28015: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=paramus /var/log/maillog:Nov 10 03:06:00 mrelay3 postfix/smtpd[27808]: DDF7C2801B: client=unknown[94.242.206.37], sasl_method=LOGIN, sasl_username=Paramus Any help would be appreciated. paul

1 0