June 2011 - dovecot - dovecot.org

[Dovecot] limiting number of login attempts from same ip
by Jürgen Obermann 16 Jun '11

16 Jun '11

Hello, is it possible to limit the number of pop3 (or imap) login attempts from one IP with dovecot to stop attackers? We recently had an attack from one IP-address lasting 50 minutes that tried 50000 pop3-logins with guessed users and passwords. I know about Fail2Ban but really would prefer an easy to configure solution inside of dovecot. Dovecot has this anvil daemon, can it be used for that purpose? We use dovcot version 2.0.12 under Solaris 10, the pop3-login part of the configuration looking like that: service pop3-login { chroot = login client_limit = 0 drop_priv_before_exec = no executable = pop3-login extra_groups = group = idle_kill = 0 inet_listener pop3 { address = port = 110 ssl = no } inet_listener pop3s { address = port = 995 ssl = yes } privileged_group = process_limit = 0 process_min_avail = 0 protocol = pop3 service_count = 1 type = login user = $default_login_user vsz_limit = 64 M } Thanks, Jürgen -- Hochschulrechenzentrum der | Mail: Juergen.Obermann(a)hrz.uni-giessen.de Justus-Liebig-Universitaet | WWW: http://www.uni-giessen.de/obermann/ Heinrich-Buff-Ring 44 | Tel: 0641-99-13054 (0641-99-13001) D-35392 Giessen, Germany | Fax: 0641-99-13009

10 14

[Dovecot] dovecot-managesieve
by Richard Gliebe 16 Jun '11

16 Jun '11

Hi all, I have to implement a Out of Office Tool on our dovecot IMAP Server. Recently I updated dovecot-1.0.7-7.el5 to dovecot-1.1.20-1_98.el5 on our CentOS release 5.6 (Final) box via "yum update" # cat /etc/yum.conf .... [atrpms] name=Fedora Core $releasever - $basearch - ATrpms baseurl=http://dl.atrpms.net/el$releasever-$basearch/atrpms/stable gpgkey=http://ATrpms.net/RPM-GPG-KEY.atrpms gpgcheck=1 # .... After it, I installed dovecot-managesieve-0.11.12-0_5.1.el5 via yum install. These are my sieve settings in /etc/dovecot.conf: ....... version_ignore=yes # Log file to use for error messages, instead of sending them to syslog. # /dev/stderr can be used to log into stderr. log_path = /var/log/dovecot.log # Protocols we want to be serving: imap imaps pop3 pop3s managesieve # If you only want to use dovecot-auth, you can set this to "none". #protocols = imap imaps pop3 pop3s protocols = imaps pop3s pop3 managesieve mail_debug=yes protocol managesieve { # Specify an alternative address:port the daemon must listen on # (default: *:2000) #listen = localhost:2000 managesieve_logout_format = bytes ( in=%i : out=%o ) # Duplicated from plugin section sieve=~/.dovecot.sieve sieve_storage=~/sieve } plugin { # Settings for the Sieve plugin sieve=~/.dovecot.sieve sieve_dir=~/sieve } ...... After restarting dovecot, I'm getting the following errors in dovecot.log: dovecot: Jun 10 08:50:14 Info: dovecot v1.1.20 starting up (core dumps disabled) dovecot: Jun 10 08:50:16 Error: login: Login request missing a file descriptor dovecot: Jun 10 08:50:16 Error: Temporary failure in creating login processes, slowing down for now dovecot: Jun 10 08:50:16 Warning: managesieve-login: managesieve-login: capability string is empty. dovecot: Jun 10 08:50:16 Error: login: Login request missing a file descriptor dovecot: Jun 10 08:50:16 Warning: managesieve-login: managesieve-login: capability string is empty. dovecot: Jun 10 08:50:16 Error: login: Login request missing a file descriptor dovecot: Jun 10 08:50:16 Warning: managesieve-login: managesieve-login: capability string is empty. dovecot: Jun 10 08:50:16 Info: Created login processes successfully, unstalling dovecot: Jun 10 08:50:17 Error: login: Login request missing a file descriptor dovecot: Jun 10 08:50:17 Error: Temporary failure in creating login processes, slowing down for now Don't know, whats going on ..... next problem. I can't login with our Thunderbird Clients to our IMAP/sieve Server (Port 2000) to edit Sieve Filters. Authentication is set to: use IMAP Username and password Port 2000 ist listening: # netstat -an | grep 2000 tcp 0 0 0.0.0.0:2000 0.0.0.0:* LISTEN tcp 0 0 192.168.1.6:2000 192.168.1.8:2882 ESTABLISHED tcp 0 0 :::2000 :::* LISTEN Out of Office: I found a plugin for our thunderbird clients: http://www.trustedbird.org/tb/Out_of_Office is this the right one? many many hints are welcome ;-) Richard

2 2

[Dovecot] URLAUTH-patch, BSD specific?
by Peter Mogensen 15 Jun '11

15 Jun '11

Hi, I notice that the Apple patched branch of Dovecot 2.0 with URLAUTH fails to compile on Linux. The file src/plugins/urlauth/urlauth-keys.c uses open(2) with O_EXLOCK, which to my knowledge is BSD specific. Is that a known problem? /Peter

2 1

[Dovecot] ZFS Filesystem Quota under Solaris 10 and Sparc
by Jürgen Obermann 15 Jun '11

15 Jun '11

Hallo. Filesystem quotas used to work well under Solaris 9 and ufs filesystems on the Sparc platform even with two rules for the folders in the users home directories /home/group/user and the separate filesystem /var/mail holding the inboxes: plugin { quota = fs:Home-Verzeichnis:noenforcing quota2 = fs:INBOX:noenforcing:mount=/var/mail } Since we upgraded last year to Solaris 10 with zfs filesystems on our Sparc server still using a similar setup with separate filesystems for home directories and inboxes we have no working quota plugin anymore. Currently we use dovecot 2.0.13. Are there any plans or whishes to get the filesystem quota code working again under zfs and Solaris? Best whishes, Jürgen -- Hochschulrechenzentrum der | Mail: Juergen.Obermann(a)hrz.uni-giessen.de Justus-Liebig-Universitaet | WWW: http://www.uni-giessen.de/obermann/ Heinrich-Buff-Ring 44 | Tel: 0641-99-13054 (0641-99-13001) D-35392 Giessen, Germany | Fax: 0641-99-13009

1 0

[Dovecot] Per-user "Seen" flags on public folder
by Torsten Harenberg 15 Jun '11

15 Jun '11

Dear all, sorry to bother the list again, I have a small configuration issue again with public (shared) folders. These folders should have per-user Seen flags, so I configured: namespace { type = public separator = . prefix = public. location = maildir:/var/mail/public:INDEX=%u/public subscriptions = no list = children } But this only seems to work with my account (presumably as I was the first one who touched the folder), all other users cannot change the "Seen" flags My home dir is set to /home/mail/harenber and there is a: mail# ls -l total 1162 -rwxrwxrwx 1 10001 wheel 4016 Jun 9 13:27 dovecot.index -rwxrwxrwx 1 10001 wheel 1125376 Jun 14 11:26 dovecot.index.cache -rwxrwxrwx 1 10001 wheel 2140 Jun 9 13:40 dovecot.index.log -rwxrwxrwx 1 10044 wheel 33792 Jun 9 13:28 dovecot.index.log.2 mail# pwd /home/mail/harenber/harenber/public/.fb8 (don't know why my username appears twice). which looks the same on some other account: mail# ls -l total 1380 -rw-rw-rw- 1 10002 wheel 4016 Jun 9 19:40 dovecot.index -rw-rw-rw- 1 10002 wheel 1364992 Jun 10 10:54 dovecot.index.cache -rwxrwxrwx 1 10114 wheel 16072 Jun 10 10:54 dovecot.index.log mail# pwd /home/mail/sandhoff/sandhoff/public/.fb8 The public folder looks like this: mail# pwd /var/mail/public/.fb8 mail# ls -l total 52 drwxrwxrwx 2 root wheel 512 Jun 9 13:05 cur -rwxrwxrwx 1 root wheel 54 Jun 9 13:11 dovecot-acl -rwxrwxrwx 1 root wheel 97 Jun 9 13:05 dovecot-keywords -rw-rw-rw- 1 10001 wheel 18513 Jun 9 13:27 dovecot-uidlist drwxrwxrwx 2 root wheel 23552 Jun 9 13:05 new -rwxrwxrwx 1 root wheel 0 Jun 9 13:05 subscriptions drwxrwxrwx 2 root wheel 512 Jun 9 13:05 tmp Does anybody see what I did (again) wrong? (doveconf -n at the end, as allways) Thanks Torsten -- <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> <> <> <> Dr. Torsten Harenberg harenberg(a)physik.uni-wuppertal.de <> <> Bergische Universitaet <> <> FB C - Physik Tel.: +49 (0)202 439-3521 <> <> Gaussstr. 20 Fax : +49 (0)202 439-2811 <> <> 42097 Wuppertal <> <> <> <><><><><><><>< Of course it runs NetBSD http://www.netbsd.org ><> mail# doveconf -n # 2.0.13: /usr/pkg/etc/dovecot/dovecot.conf # OS: NetBSD 5.1 amd64 ffs auth_debug = yes auth_verbose = yes base_dir = /var/run/dovecot/ mail_debug = yes mail_gid = 6 mail_location = maildir:/var/mail/user/%u/Maildir mail_plugins = acl managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date namespace { inbox = yes location = prefix = separator = . type = private } namespace { list = children location = maildir:/var/mail/public:INDEX=%u/public prefix = public. separator = . subscriptions = no type = public } passdb { args = /usr/pkg/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } plugin { acl = vfile sieve = ~/.dovecot.sieve sieve_dir = ~/sieve } protocols = imap pop3 lmtp sieve service auth { unix_listener /var/spool/postfix/private/auth { group = postfix mode = 0660 user = postfix } unix_listener auth-userdb { group = dovecot user = dovecot } } service managesieve-login { inet_listener sieve { port = 4190 } inet_listener sieve_deprecated { port = 2000 } } ssl_ca = </etc/certificates/chain.pem ssl_cert = </etc/certificates/mail.physik.uni-wuppertal.de.crt ssl_key = </etc/certificates/mail.physik.uni-wuppertal.de.key userdb { args = /usr/pkg/etc/dovecot/dovecot-ldap.conf.ext driver = ldap } protocol lmtp { mail_plugins = sieve } protocol lda { mail_plugins = sieve } protocol imap { mail_plugins = acl imap_acl } protocol sieve { managesieve_implementation_string = Dovecot Pigeonhole }

1 1

[Dovecot] doveadm who: Please Headline to STDout, not to STDERR
by Denny Schierz 15 Jun '11

15 Jun '11

hi, I've created a small script to get a sum from the users and sessions (table username and table "#"), but it is annoying that the headline "username # proto (pids) (ips)" goes to STDERR, but the normal output to STDOUT. It would be nice, if both goes to the same STD :-) cu denny

2 1

[Dovecot] Timeout during APPEND
by martin f krafft 14 Jun '11

14 Jun '11

Dear list, I am running dovecot 1.2.15 on a Debian server. One user reports continuous problems synchronising her mailbox via IMAP (offlineimap, via SSH tunnel or SSL socket). It seems that she has a large, locally-created message, but the uplink bandwidth seems to be not enough to push it before dovecot times out the APPEND command. The error/exception happens inside offlineimap's Python imaplib2.py file: APPEND => no response after 30.0 secs I do not know the IMAP protocol all that well, but it seems to me like this is broken somewhere. Could you please help me figure out the problem? -- martin | http://madduck.net/ | http://two.sentenc.es/ "man sagt nicht 'nichts!', man sagt dafür 'jenseits' oder 'gott'." - friedrich nietzsche spamtraps: madduck.bogus(a)madduck.net

2 7

[Dovecot] SSL comunication problems with client side.
by Denis Iskandarov 14 Jun '11

14 Jun '11

I can get messages without SSL with no problems. but i need to setup server accept only SSL secured connections. I think my configuration is very proper, but cant find "obvious" problem. Postfix 2.3.3 + dovecot 2.0.13-1_129.el5 + PostfixAdmin 2.3.3 I made own CA. configured postfix and dovecot with same cert key ca. Same public cert i gave for client just converted it to PKCS#12. I cant undestand valid and invalid certs strings in long, they look same. You can check logs and config bellow. Also some other questions regarding SSL: 1. How to make client MUA (thunderbird) automatically retrieve certificate ? My thunderbird cant do it by itself so i'm importing mail cert by myself. 2. If i want to setup Roundcube/Squirrelmail webmail clients with TLS support (https) i have to provide them with same certificates as dovecot and postfix have. Or in this case i can use whatever certificate dedicated for with "virtualhost"? dovecot-deliver.log: Jun 13 13:26:42 imap-login: Info: Invalid certificate: unable to get certificate CRL: /C=GE/ST=Tbilisi/O=Caucasus Digital Network/OU=Mail Server/CN=mx.office.dev/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 imap-login: Info: Invalid certificate: unable to get certificate CRL: /C=GE/ST=Tbilisi/L=Tbilisi/O=Caucasus Digital Network/OU=Caucasus Digital Network/CN=Caucasus Digital Network/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 imap-login: Info: Valid certificate: /C=GE/ST=Tbilisi/L=Tbilisi/O=Caucasus Digital Network/OU=Caucasus Digital Network/CN=Caucasus Digital Network/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 imap-login: Info: Valid certificate: /C=GE/ST=Tbilisi/O=Caucasus Digital Network/OU=Mail Server/CN=mx.office.dev/emailAddress=hostmaster(a)office.dev Jun 13 13:26:42 auth: Info: PLAIN(?,192.168.0.11): Client didn't present valid SSL certificate Jun 13 13:26:42 auth: Info: LOGIN(?,192.168.0.11): Client didn't present valid SSL certificate Jun 13 13:26:42 auth: Info: PLAIN(?,192.168.0.11): Client didn't present valid SSL certificate Jun 13 13:26:42 imap-login: Info: Disconnected (client sent an invalid cert): method=PLAIN, rip=192.168.0.11, lip=192.168.0.31, TLS maillog. Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x10, ret=1: before/accept initialization [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: before/accept initialization [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client hello A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write server hello A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write certificate request A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2002, ret=-1: SSLv3 read client certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client certificate A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read client key exchange A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read certificate verify A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 read finished A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write change cipher spec A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 write finished A [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2001, ret=1: SSLv3 flush data [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x20, ret=1: SSL negotiation finished successfully [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL: where=0x2002, ret=1: SSL negotiation finished successfully [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL alert: where=0x4004, ret=256: warning close notify [192.168.0.11] Jun 13 13:26:42 cent56dev dovecot: imap-login: Warning: SSL alert: where=0x4008, ret=256: warning close notify [192.168.0.11] # doveconf -n # 2.0.13: /etc/dovecot/dovecot.conf # OS: Linux 2.6.18-238.9.1.el5 i686 CentOS release 5.6 (Final) ext3 auth_mechanisms = plain login auth_socket_path = /var/run/dovecot/auth-userdb auth_ssl_require_client_cert = yes auth_verbose = yes base_dir = /var/run/dovecot/ debug_log_path = /var/log/dovecot-deliver.log dict { expire = sqlite:/etc/dovecot/dovecot-dict-sql.conf.ext quota = mysql:/etc/dovecot/dovecot-dict-sql.conf.ext } first_valid_gid = 12 first_valid_uid = 1001 hostname = mx.office.dev info_log_path = /var/log/dovecot-deliver.log last_valid_gid = 12 last_valid_uid = 1001 listen = * mail_debug = yes mail_gid = 12 mail_location = maildir:/home/vmail/%d/%u mail_plugins = quota mail_privileged_group = mail mail_uid = 1001 managesieve_notify_capability = mailto managesieve_sieve_capability = fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date mbox_write_locks = fcntl passdb { args = /etc/dovecot/conf.d/sql/sql.conf driver = sql } plugin { autocreate = Trash autocreate2 = Spam autosubscribe = Trash autosubscribe2 = Spam } postmaster_address = postmaster(a)office.dev service auth { unix_listener /var/spool/postfix/private/auth { group = mail mode = 0660 user = postfix } unix_listener auth-userdb { group = mail mode = 0660 user = vmail } } service imap-login { inet_listener imap { port = 143 } inet_listener imaps { port = 993 ssl = yes } } service pop3-login { inet_listener pop3 { port = 110 } inet_listener pop3s { port = 995 ssl = yes } } ssl_ca = </etc/pki/CA/cacert.pem ssl_cert = </etc/pki/CA/mail/mx.office.dev.crt ssl_key = </etc/pki/CA/mail/mx.office.dev.key ssl_verify_client_cert = yes userdb { args = /etc/dovecot/conf.d/sql/sql.conf driver = sql } verbose_ssl = yes protocol lda { mail_plugins = quota autocreate } protocol imap { imap_client_workarounds = delay-newmail mail_plugins = quota imap_quota autocreate } protocol pop3 { mail_plugins = quota pop3_client_workarounds = outlook-no-nuls oe-ns-eoh }

2 4

[Dovecot] Sieve question
by Dhaval Patel 14 Jun '11

14 Jun '11

I have successfully setup Postfix -> Dovecot with virtual users and spam filtering with spamassassin. Now the last remaining part is for the user defined rules. Let me describe my environment and what I am trying to achieve. I have Postfix setup to call spamc and deliver to Dovecot according to the master.cf line below. -------------------------------------------------------------- dovecot unix - n n - - pipe flags=DRhu user=vmail:vmail argv=/usr/bin/spamc -u vmail -e /usr/lib/dovecot/deliver -d ${recipient} -------------------------------------------------------------- The emails get checked by Spamassassin and are delivered to the users's mailbox (/home/vmail/username). I use an actual username (dhav) and not email address (dhaval(a)example.com) Things are working fine with that. >From reading http://wiki.dovecot.org/LDA/Sieve I see that Sieve can do global and user specified filtering. So I am planning to put the following rule into the global script so spammy emails go to the user's INBOX.spam folder. -------------------------------------------------------------- require "fileinto"; if header :contains "X-Spam-Flag" "YES" { fileinto "spam"; } -------------------------------------------------------------- My first question is, where is this global script? Do I configure the "sieve_global_dir = /etc/dovecot/sieve/"? What about he filename? Most users will not need any additional rules. There are some users that do and I am having a difficult time figuring out how it would be setup. My second question is the following. Is there a way in the global script to check if there is a file called /etc/dovecot/sieve/username or /home/vmail/username/personal_sieve_script and include it? I was using maildrop before this and procmail before that so I apologies for sounding stupid if this is not how Sieve scripts work. I am by no means tied the methods I describe above. If anyone knows of a better way to achieve what I am trying to do, I would appreciate if you let me know of it. Thanks, Dhaval

2 1

[Dovecot] Version differences, trash, upgrade
by José Antonio Suarez Pinzón 14 Jun '11

14 Jun '11

Hello everybody, I have some basic questions: 1. how can I configure the auto-empty trash plugin for all users after 3 or 4 days (This is very important, regular users do not clean their trash, or are using blackberry and do not have an option to do it or simply, do not care about it) 2. difference between version 1.2.17 and latest 2 version of Dovecot, have the version 2 an automatic option for the trash thing? 3. me as a basic skilled user, how can I made the upgrade to version 2 without major risks, I mean I do not want to leave everybody on my server without mail. I am a novice in all of this stuff, so please excuse me if I am making dumb questions. Thanks in advance for your help. Information about my installation. # 1.2.17: /etc/dovecot.conf # OS: Linux 2.6.18-164.11.1.el5 x86_64 CentOS release 5.6 (Final) protocols: imap imaps pop3 pop3s plugin: quota: maildir quota_rule: Trash:ignore Kind Regards, José Antonio Suárez Pinzón Auge CS (+57 1) 812 7629 (+57) 300 618 0017

1 0